IAPP CIPM Exam Dumps

Certified Information Privacy Manager (CIPM)

Recent CIPM Exam Results

Our IAPP CIPM dumps are key to get success. More than 80000+ success stories.

28

Clients Passed IAPP CIPM Exam Today

92%

Passing score in Real IAPP CIPM Exam

98%

Questions were from our given CIPM dumps

IAPP CIPM Sample Questions

Question # 1

SCENARIOPlease use the following to answer the next QUESTION:Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used thesame vendor tooperate all aspects of an online store for several years. As a small nonprofit, the Societycannot afford the higher-priced options, but you have been relatively satisfied with thisbudget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice,people who purchased items from the store have had their credit card information usedfraudulently subsequent to transactions on your site, but in neither case did theinvestigation reveal with certainty that the Society’s store had been hacked. The theftscould have been employee-related.Just as disconcerting was an incident where the organization discovered that SCS had soldinformation it had collected from customers to third parties. However, as Jason Roland,your SCS account representative, points out, it took only a phone call from you to clarifyexpectations and the “misunderstanding” has not occurred again.As an information-technology program manager with the Society, the role of the privacyprofessional is only one of many you play. In all matters, however, you must consider thefinancial bottom line. While these problems with privacy protection have been significant,the additional revenues of sales of items such as shirts and coffee cups from the storehave been significant. The Society’s operating budget is slim, and all sources of revenueare essential.Now a new challenge has arisen. Jason called to say that starting in two weeks, thecustomer data from the store would now be stored on a data cloud. “The good news,” hesays, “is that we have found a low-cost provider in Finland, where the data would also beheld. So, while there may be a small charge to pass through to you, it won’t be exorbitant,especially considering the advantages of a cloud.”Lately, you have been hearing about cloud computing and you know it’s fast becoming thenew paradigm for various applications. However, you have heard mixed reviews about thepotential impacts on privacy protection. You begin to research and discover that a numberof the leading cloud service providers have signed a letter of intent to work together onshared conventions and technologies for privacy protection. You make a note to find out ifJason’s Finnish provider is signing on.What process can best answer your Questions about the vendor’s data securitysafeguards?

A. A second-party of supplier audit 
B. A reference check with other clients 
C. A table top demonstration of a potential threat 
D. A public records search for earlier legal violations 

Answer: B

Show Answer

Question # 2

An organization's privacy officer was just notified by the benefits manager that sheaccidentally sent out the retirement enrollment report of all employees to a wrong vendor.Which of the following actions should the privacy officer take first?

A. Perform a risk of harm analysis. 
B. Report the incident to law enforcement. 
C. Contact the recipient to delete the email. 
D. Send firm-wide email notification to employees. 

Answer: A

Show Answer

Question # 3

An organization’s internal audit team should do all of the following EXCEPT?

A. Implement processes to correct audit failures. 
B. Verify that technical measures are in place. 
C. Review how operations work in practice. 
D. Ensure policies are being adhered to. 

Answer: B

Show Answer

Question # 4

SCENARIOPlease use the following to answer the next QUESTION:John is the new privacy officer at the prestigious international law firm – A&M LLP. A&MLLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger &Acquisition in both U.S. and Europe.During lunch with a colleague from the Information Technology department, John heardthat the Head of IT, Derrick, is about to outsource the firm's email continuity service to theirexisting email security vendor – MessageSafe. Being successful as an email hygienevendor, MessageSafe is expanding its business by leasing cloud infrastructure from CloudInc. to host email continuity service for A&M LLP.John is very concerned about this initiative. He recalled that MessageSafe was in the newssix months ago due to a security breach. Immediately, John did a quick research ofMessageSafe's previous breach and learned that the breach was caused by anunintentional mistake by an IT administrator. He scheduled a meeting with Derrick toaddress his concerns.At the meeting, Derrick emphasized that email is the primary method for the firm's lawyersto communicate with clients, thus it is critical to have the email continuity service to avoidany possible email downtime. Derrick has been using the anti-spam service provided byMessageSafe for five years and is very happy with the quality of service provided byMessageSafe. In addition to the significant discount offered by MessageSafe, Derrickemphasized that he can also speed up the onboarding process since the firm already has aservice contract in place with MessageSafe. The existing on-premises email continuitysolution is about to reach its end of life very soon and he doesn't have the time or resourceto look for another solution. Furthermore, the off- premises email continuity service will onlybe turned on when the email service at A&M LLP's primary and secondary data centers areboth down, and the email messages stored at MessageSafe site for continuity service willbe automatically deleted after 30 days.Which of the following is a TRUE statement about the relationship among theorganizations?

A. Cloud Inc. must notify A&M LLP of a data breach immediately. 
B. MessageSafe is liable if Cloud Inc. fails to protect data from A&M LLP. 
C. Cloud Inc. should enter into a data processor agreement with A&M LLP. 
D. A&M LLP's service contract must be amended to list Cloud Inc. as a sub-processor. 

Answer: A

Show Answer

Question # 5

SCENARIOPlease use the following to answer the next QUESTION:Edufox has hosted an annual convention of users of its famous e-learning softwareplatform, and over time, it has become a grand event. It fills one of the large downtownconference hotels and overflows into the others, with several thousand attendees enjoyingthree days of presentations, panel discussions and networking. The convention is thecenterpiece of the company's product rollout schedule and a great training opportunity forcurrent users. The sales force also encourages prospective clients to attend to get a bettersense of the ways in which the system can be customized to meet diverse needs andunderstand that when they buy into this system, they are joining a community that feels likefamily.This year's conference is only three weeks away, and you have just heard news of a newinitiative supporting it: a smartphone app for attendees. The app will support lateregistration, highlight the featured presentations and provide a mobile version of theconference program. It also links to a restaurant reservation system with the best cuisine inthe areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if,that is, we actually get it working!" She laughs nervously but explains that because of thetight time frame she'd been given to build the app, she outsourced the job to a local firm."It's just three young people," she says, "but they do great work." She describes some ofthe other apps they have built. When asked how they were selected for this job, Deidreshrugs. "They do good work, so I chose them."Deidre is a terrific employee with a strong track record. That's why she's been charged todeliver this rushed project. You're sure she has the best interests of the company at heart,and you don't doubt that she's under pressure to meet a deadline that cannot be pushedback. However, you have concerns about the app's handling of personal data and itssecurity safeguards. Over lunch in the break room, you start to talk to her about it, but shequickly tries to reassure you, "I'm sure with your help we can fix any security issues if wehave to, but I doubt there'll be any. These people build apps for a living, and they knowwhat they're doing. You worry too much, but that's why you're so good at your job!"Which is the best first step in understanding the data security practices of a potentialvendor?

A. Requiring the vendor to complete a questionnaire assessing International Organizationfor Standardization (ISO) 27001 compliance. 
B. Conducting a physical audit of the vendor's facilities. 
C. Conducting a penetration test of the vendor's data security structure. 
D. Examining investigation records of any breaches the vendor has experienced. 

Answer: D

Show Answer

Question # 6

Which term describes a piece of personal data that alone may not identify an individual?

A. Unbundled data 
B. A singularity 
C. Non-aggregated infopoint 
D. A single attribute 

Answer: A

Show Answer

Question # 7

As a Data Protection Officer, one of your roles entails monitoring changes in laws andregulations and updating policies accordingly.How would you most effectively execute this responsibility?

A. Consult an external lawyer. 
B. Regularly engage regulators. 
C. Attend workshops and interact with other professionals. 
D. Subscribe to email list-serves that report on regulatory changes. 

Answer: D

Show Answer

Question # 8

SCENARIOPlease use the following to answer the next QUESTION:Amira is thrilled about the sudden expansion of NatGen. As the joint Chief ExecutiveOfficer (CEO) with her long-time business partner Sadie, Amira has watched the companygrow into a major competitor in the green energy market. The current line of productsincludes wind turbines, solar energy panels, and equipment for geothermal systems. Atalented team of developers means that NatGen's line of products will only continue togrow.With the expansion, Amira and Sadie have received advice from new senior staff membersbrought on to help manage the company's growth. One recent suggestion has been tocombine the legal and security functions of the company to ensure observance of privacylaws and the company's own privacy policy. This sounds overly complicated to Amira, whowants departments to be able to use, collect, store, and dispose of customer data in waysthat will best suit their needs. She does not want administrative oversight and complexstructuring to get in the way of people doing innovative work.Sadie has a similar outlook. The new Chief Information Officer (CIO) has proposed whatSadie believes is an unnecessarily long timetable for designing a new privacy program.She has assured him that NatGen will use the best possible equipment for electronicstorage of customer and employee data. She simply needs a list of equipment and anestimate of its cost. But the CIO insists that many issues are necessary to consider beforethe company gets to that stage.Regardless, Sadie and Amira insist on giving employees space to do their jobs. Both CEOswant to entrust the monitoring of employee policy compliance to low-level managers. Amiraand Sadie believe these managers can adjust the company privacy policy according towhat works best for their particular departments. NatGen's CEOs know that flexibleinterpretations of the privacy policy in the name of promoting green energy would be highlyunlikely to raise any concerns with their customer base, as long as the data is always usedin course of normal business activities.Perhaps what has been most perplexing to Sadie and Amira has been the CIO'srecommendation to institute a privacy compliance hotline. Sadie and Amira have relentedon this point, but they hope to compromise by allowing employees to take turns handlingreports of privacy policy violations. The implementation will be easy because theemployees need no special preparation. They will simply have to document any concernsthey hear.Sadie and Amira are aware that it will be challenging to stay true to their principles andguard against corporate culture strangling creativity and employee morale. They hope thatall senior staff will see the benefit of trying a unique approach.What Data Lifecycle Management (DLM) principle should the company follow if they end upallowing departments to interpret the privacy policy differently?

A. Prove the authenticity of the company's records. 
B. Arrange for official credentials for staff members. 
C. Adequately document reasons for inconsistencies. 
D. Create categories to reflect degrees of data importance. 

Answer: c

Show Answer