If you are interested in taking the IAPP CIPM exam, you need to complete the IAPP CIPM exam. Some simple techniques can be used to increase your chances of successfully completing the IAPP CIPM exam. Use Pass4itSure IAPP CIPM exam dumps https://www.pass4itsure.com/cipm.html (PDF and practice test software) to successfully pass the IAPP CIPM exam in your first attempt.
IAPP CIPM pdf free download https://drive.google.com/file/d/1iI98KlYps5BxqRpz3CcwjYz6lYwlC3Lj/view?usp=sharing
IAPP CIPM practice test free – Pass4itSure
QUESTION 1
Under the General Data Protection Regulation (GDPR), what must be included in a written agreement between the
controller and processor in relation to processing conducted on the controller\\’s behalf?
A. An obligation on the processor to report any personal data breach to the controller within 72 hours.
B. An obligation on both parties to report any serious personal data breach to the supervisory authority.
C. An obligation on both parties to agree to a termination of the agreement if the other party is responsible for a
personal data breach.
D. An obligation on the processor to assist the controller in complying with the controller\\’s obligations to notify the
supervisory authority about personal data breaches.
Correct Answer: A
QUESTION 2
What is the main reason to begin with 3-5 key metrics during the program development process?
A. To avoid undue financial costs.
B. To keep the focus on the main organizational objectives.
C. To minimize selective data use.
D. To keep the process limited to as few people as possible.
Correct Answer: C
QUESTION 3
SCENARIO
Please use the following to answer the next question:
As they company\\’s new chief executive officer, Thomas Goddard wants to be known as a leader in data
protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video
viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection
circles for its ethically questionable practices, including unauthorized sales of personal data to marketers.
Hoopy also was the target of credit card data theft that made headlines around the world, as at least two
million credit card numbers were thought to have been pilfered despite the company\\’s claims that
“appropriate” data protection safeguards were in place. The scandal affected the company\\’s business as
competitors were quick to market an increased level of protection while offering similar entertainment and
media content. Within three weeks after the scandal broke, Hoopy founder and CEO Maxwell Martin,
Goddard\\’s mentor, was forced to step down.
Goddard, however, seems to have landed on his feet, securing the CEO position at your company,
Medialite, which is just emerging from its start-up phase. He sold the company\\’s board and investors on
his vision of Medialite building its brand partly on the basis of industry-leading data protection standards
and procedures. He may have been a key part of a lapsed or even rogue organization in matters of privacy
but now he claims to be reformed and a true believer in privacy protection. In his first week on the job, he
calls you into his office and explains that your primary work responsibility is to bring his vision for privacy to
life. But you also detect some reservations. “We want Medialite to have absolutely the highest standards,”
he says. “In fact, I want us to be able to say that we are the clear industry leader in privacy and data
protection. However, I also need to be a responsible steward of the company\\’s finances. So, while I want
the best solutions across the board, they also need to be cost effective.”
You are told to report back in a week\\’s time with your recommendations. Charged with this ambiguous
mission, you depart the executive suite, already considering your next steps.
The company has achieved a level of privacy protection that established new best practices for the
industry. What is a logical next step to help ensure a high level of protection?
A. Brainstorm methods for developing an enhanced privacy framework
B. Develop a strong marketing strategy to communicate the company\\’s privacy practices
C. Focus on improving the incident response plan in preparation for any breaks in protection
D. Shift attention to privacy for emerging technologies as the company begins to use them
Correct Answer: C
QUESTION 4
SCENARIO
Please use the following to answer the next question:
It\\’s just what you were afraid of. Without consulting you, the information technology director at your
organization launched a new initiative to encourage employees to use personal devices for conducting
business. The initiative made purchasing a new, high-specification laptop computer an attractive option,
with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization
is also paying the sales taxes. It\\’s a great deal, and after a month, more than half the organization\\’s
employees have signed on and acquired new laptops. Walking through the facility, you see them happily
customizing and comparing notes on their new computers, and at the end of the day, most take their
laptops with them, potentially carrying personal data to their homes or other unknown locations. It\\’s
enough to give you data-protection nightmares, and you\\’ve pointed out to the information technology
Director and many others in the organization the potential hazards of this new practice, including the
inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization\\’s marketing department who shares with
you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with
laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and
socializing began, with the laptop “safely” tucked on a bench, beneath his jacket. Later that night, when it
was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on
another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a
sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not
found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it
contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and
places his head in his hands in despair.
In order to determine the best course of action, how should this incident most productively be viewed?
A. As the accidental loss of personal property containing data that must be restored.
B. As a potential compromise of personal information through unauthorized access.
C. As an incident that requires the abrupt initiation of a notification campaign.
D. As the premeditated theft of company data, until shown otherwise.
Correct Answer: B
QUESTION 5
SCENARIO
Please use the following to answer the next question:
Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company,
Special Handling Shipping, for his work in reforming certain “rogue” offices. Last year, news broke that a
police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the
United States. Video from the office\\’s video surveillance cameras leaked to news operations showed a
drug exchange between Special Handling staff and undercover officers.
In the wake of this incident, Kelly had been sent to Providence to change the “hands off” culture that upper
management believed had let the criminal elements conduct their illicit transactions. After a few weeks
under Kelly\\’s direction, the office became a model of efficiency and customer service. Kelly monitored his
workers\\’ activities using the same cameras that had recorded the illegal conduct of their former coworkers.
Now Kelly has been charged with turning around the office in Cork, Ireland, another trouble spot. The
company has received numerous reports of the staff leaving the office unattended. When Kelly arrived, he
found that even when present, the staff often spent their days socializing or conducting personal business
on their mobile phones. Again, he observed their behaviors using surveillance cameras. He issued written
reprimands to six staff members based on the first day of video alone.
Much to Kelly\\’s surprise and chagrin, he and the company are now under investigation by the Data
Protection Commissioner of Ireland for allegedly violating the privacy rights of employees. Kelly was told
that the company\\’s license for the cameras listed facility security as their main use, but he does not know
why this matters. He has pointed out to his superiors that the company\\’s training programs on privacy
protection and data collection mention nothing about surveillance video.
You are a privacy protection consultant, hired by the company to assess this incident, report on the legal
and compliance issues, and recommend next steps.
What does this example best illustrate about training requirements for privacy protection?
A. Training needs must be weighed against financial costs.
B. Training on local laws must be implemented for all personnel.
C. Training must be repeated frequently to respond to new legislation.
D. Training must include assessments to verify that the material is mastered.
Correct Answer: B
QUESTION 6
SCENARIO
Please use the following to answer the next question:
Natalia, CFO of the Nationwide Grill restaurant chain, had never seen her fellow executives so anxious.
Last week, a data processing firm used by the company reported that its system may have been hacked,
and customer data such as names, addresses, and birthdays may have been compromised. Although the
attempt was proven unsuccessful, the scare has prompted several Nationwide Grill executives to question
the company\\’s privacy program at today\\’s meeting.
Alice, a vice president, said that the incident could have opened the door to lawsuits, potentially damaging Nationwide
Grill\\’s market position. The Chief Information Officer (CIO), Brendan, tried to assure her that even if there had been an
actual breach, the chances of a successful suit against the company were slim. But Alice remained unconvinced.
Spencer – a former CEO and currently a senior advisor – said that he had always warned against the use of contractors
for data processing. At the very least, he argued, they should be held contractually liable for telling customers about any
security incidents. In his view, Nationwide Grill should not be forced to soil the company name for a problem it did not
cause.
One of the business development (BD) executives, Haley, then spoke, imploring everyone to see reason. “Breaches
can happen, despite organizations\\’ best efforts,” she remarked. “Reasonable preparedness is key.” She reminded
everyone of the incident seven years ago when the large grocery chain Tinkerton\\’s had its financial information
compromised after a large order of Nationwide Grill frozen dinners. As a longtime BD executive with a solid
understanding of Tinkerton\\’s\\’s corporate culture, built up through many years of cultivating relationships, Haley was
able to successfully manage the company\\’s incident response.
Spencer replied that acting with reason means allowing security to be handled by the security functions within the
company – not BD staff. In a similar way, he said, Human Resources (HR) needs to do a better job training employees
to prevent incidents. He pointed out that Nationwide Grill employees are overwhelmed with posters, emails, and memos
from both HR and the ethics department related to the company\\’s privacy program. Both the volume and the
duplication of information means that it is often ignored altogether.
Spencer said, “The company needs to dedicate itself to its privacy program and set regular in-person trainings for all
staff once a month.”
Alice responded that the suggestion, while well-meaning, is not practical. With many locations, local HR departments
need to have flexibility with their training schedules. Silently, Natalia agreed.
How could the objection to Spencer\\’s training suggestion be addressed?
A. By requiring training only on an as-needed basis.
B. By offering alternative delivery methods for trainings.
C. By introducing a system of periodic refresher trainings.
D. By customizing training based on length of employee tenure.
Correct Answer: B
QUESTION 7
Which of the following controls does the PCI DSS framework NOT require?
A. Implement strong asset control protocols.
B. Implement strong access control measures.
C. Maintain an information security policy.
D. Maintain a vulnerability management program.
Correct Answer: A
QUESTION 8
SCENARIO
Please use the following to answer the next question:
As they company\\’s new chief executive officer, Thomas Goddard wants to be known as a leader in data
protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video
viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection
circles for its ethically questionable practices, including unauthorized sales of personal data to marketers.
Hoopy also was the target of credit card data theft that made headlines around the world, as at least two
million credit card numbers were thought to have been pilfered despite the company\\’s claims that
“appropriate” data protection safeguards were in place. The scandal affected the company\\’s business as
competitors were quick to market an increased level of protection while offering similar entertainment and
media content. Within three weeks after the scandal broke, Hoopy founder and CEO Maxwell Martin,
Goddard\\’s mentor, was forced to step down.
Goddard, however, seems to have landed on his feet, securing the CEO position at your company, Medialite, which is
just emerging from its start-up phase. He sold the company\\’s board and investors on his vision of Medialite building its
brand partly on the basis of industry-leading data protection standards and procedures. He may have been a key part of
a lapsed or even rogue organization in matters of privacy but now he claims to be reformed and a true believer in
privacy protection. In his first week on the job, he calls you into his office and explains that your primary work
responsibility is to bring his vision for privacy to life. But you also detect some reservations. “We want Medialite to have
absolutely the highest standards,” he says. “In fact, I want us to be able to say that we are the clear industry leader in
privacy and data protection. However, I also need to be a responsible steward of the company\\’s finances. So, while I
want the best solutions across the board, they also need to be cost effective.”
You are told to report back in a week\\’s time with your recommendations. Charged with this ambiguous mission, you
depart the executive suite, already considering your next steps.
You are charged with making sure that privacy safeguards are in place for new products and initiatives. What is the best
way to do this?
A. Hold a meeting with stakeholders to create an interdepartmental protocol for new initiatives
B. Institute Privacy by Design principles and practices across the organization
C. Develop a plan for introducing privacy protections into the product development stage
D. Conduct a gap analysis after deployment of new products, then mend any gaps that are revealed
Correct Answer: C
QUESTION 9
What does it mean to “rationalize” data protection requirements?
A. Evaluate the costs and risks of applicable laws and regulations and address those that have the greatest penalties
B. Look for overlaps in laws and regulations from which a common solution can be developed
C. Determine where laws and regulations are redundant in order to eliminate some from requiring compliance
D. Address the less stringent laws and regulations, and inform stakeholders why they are applicable
Correct Answer: C
QUESTION 10
SCENARIO
Please use the following to answer the next question:
As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with
your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following
a series of relatively minor data breaches that could easily have been worse. However, you have not had a
reportable incident for the three years that you have been with the company. In fact, you consider your
program a model that others in the data storage industry may note in their own program development.
You started the program at Consolidated from a jumbled mix of policies and procedures and worked
toward coherence across departments and throughout operations. You were aided along the way by the
program\\’s sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear
understanding of the need for change.
Initially, your work was greeted with little confidence or enthusiasm by the company\\’s “old guard” among
both the executive team and frontline personnel working with data and interfacing with clients. Through the
use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the
costs that easily could occur given the current state of operations, you soon had the leaders and key
decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face
meetings with each department and the development of a baseline privacy training program achieved
sufficient “buy-in” to begin putting the proper procedures into place.
Now, privacy protection is an accepted component of all current operations involving personal or protected
data and must be part of the end product of any process of technological development. While your
approach is not systematic, it is fairly effective.
You are left contemplating:
What must be done to maintain the program and develop it beyond just a data breach prevention
program?
How can you build on your success?
What are the next action steps?
What process could most effectively be used to add privacy protections to a new, comprehensive program
being developed at Consolidated?
A. Privacy by Design.
B. Privacy Step Assessment.
C. Information Security Planning.
D. Innovation Privacy Standards.
Correct Answer: C
QUESTION 11
SCENARIO
Please use the following to answer the next question:
You lead the privacy office for a company that handles information from individuals living in several
countries throughout Europe and the Americas. You begin that morning\\’s privacy review when a contracts
officer sends you a message asking for a phone call. The message lacks clarity and detail, but you
presume that data was lost.
When you contact the contracts officer, he tells you that he received a letter in the mail from a vendor
stating that the vendor improperly shared information about your customers. He called the vendor and
confirmed that your company recently surveyed exactly 2000 individuals about their most recent
healthcare experience and sent those surveys to the vendor to transcribe it into a database, but the vendor
forgot to encrypt the database as promised in the contract. As a result, the vendor has lost control of the
data.
The vendor is extremely apologetic and offers to take responsibility for sending out the notifications. They
tell you they set aside 2000 stamped postcards because that should reduce the time it takes to get the
notice in the mail. One side is limited to their logo, but the other side is blank and they will accept whatever
you want to write. You put their offer on hold and begin to develop the text around the space constraints.
You are content to let the vendor\\’s logo be associated with the notification.
The notification explains that your company recently hired a vendor to store information about their most
recent experience at St. Sebastian Hospital\\’s Clinic for Infectious Diseases. The vendor did not encrypt the
information and no longer has control of it. All 2000 affected individuals are invited to sign-up for email
notifications about their information. They simply need to go to your company\\’s website and watch a quick
advertisement, then provide their name, email address, and month and year of birth.
You email the incident-response council for their buy-in before 9 a.m. If anything goes wrong in this situation, you want
to diffuse the blame across your colleagues. Over the next eight hours, everyone emails their comments back and forth.
The consultant who leads the incident-response team notes that it is his first day with the company, but he has been in
other industries for 45 years and will do his best. One of the three lawyers on the council causes the conversation to
veer off course, but it eventually gets back on track. At the end of the day, they vote to proceed with the notification you
wrote and use the vendor\\’s postcards.
Shortly after the vendor mails the postcards, you learn the data was on a server that was stolen, and make the decision
to have your company offer credit monitoring services. A quick internet search finds a credit monitoring company with a
convincing name: Credit Under Lock and Key (CRUDLOK). Your sales rep has never handled a contract for 2000
people, but develops a proposal in about a day which says CRUDLOK will:
1.
Send an enrollment invitation to everyone the day after the contract is signed.
2.
Enroll someone with just their first name and the last-4 of their national identifier.
3.
Monitor each enrollee\\’s credit for two years from the date of enrollment.
4.
Send a monthly email with their credit rating and offers for credit-related services at market rates.
5.
Charge your company 20% of the cost of any credit restoration.
You execute the contract and the enrollment invitations are emailed to the 2000 individuals. Three days later you sit down and document all that went well and all that could have gone better. You put it in a file to reference the next time
an incident occurs.
What is the most concerning limitation of the incident-response council?
A. You convened it to diffuse blame
B. The council has an overabundance of attorneys
C. It takes eight hours of emails to come to a decision
D. The leader just joined the company as a consultant
Correct Answer: A
QUESTION 12
SCENARIO
Please use the following to answer the next question:
You lead the privacy office for a company that handles information from individuals living in several
countries throughout Europe and the Americas. You begin that morning\\’s privacy review when a contracts
officer sends you a message asking for a phone call. The message lacks clarity and detail, but you
presume that data was lost.
When you contact the contracts officer, he tells you that he received a letter in the mail from a vendor
stating that the vendor improperly shared information about your customers. He called the vendor and
confirmed that your company recently surveyed exactly 2000 individuals about their most recent
healthcare experience and sent those surveys to the vendor to transcribe it into a database, but the vendor
forgot to encrypt the database as promised in the contract. As a result, the vendor has lost control of the
data.
The vendor is extremely apologetic and offers to take responsibility for sending out the notifications. They
tell you they set aside 2000 stamped postcards because that should reduce the time it takes to get the
notice in the mail. One side is limited to their logo, but the other side is blank and they will accept whatever
you want to write. You put their offer on hold and begin to develop the text around the space constraints.
You are content to let the vendor\\’s logo be associated with the notification.
The notification explains that your company recently hired a vendor to store information about their most
recent experience at St. Sebastian Hospital\\’s Clinic for Infectious Diseases. The vendor did not encrypt the information and no longer has control of it. All 2000 affected individuals are invited to sign-up for email
notifications about their information. They simply need to go to your company\\’s website and watch a quick
advertisement, then provide their name, email address, and month and year of birth.
You email the incident-response council for their buy-in before 9 a.m. If anything goes wrong in this
situation, you want to diffuse the blame across your colleagues. Over the next eight hours, everyone
emails their comments back and forth. The consultant who leads the incident-response team notes that it
is his first day with the company, but he has been in other industries for 45 years and will do his best. One of the three
lawyers on the council causes the conversation to veer off course, but it eventually gets back on track. At the end of the
day, they vote to proceed with the notification you wrote and use the vendor\\’s postcards.
Shortly after the vendor mails the postcards, you learn the data was on a server that was stolen, and make the decision
to have your company offer credit monitoring services. A quick internet search finds a credit monitoring company with a
convincing name: Credit Under Lock and Key (CRUDLOK). Your sales rep has never handled a contract for 2000
people, but develops a proposal in about a day which says CRUDLOK will:
1.
Send an enrollment invitation to everyone the day after the contract is signed.
2.
Enroll someone with just their first name and the last-4 of their national identifier.
3.
Monitor each enrollee\\’s credit for two years from the date of enrollment.
4.
Send a monthly email with their credit rating and offers for credit-related services at market rates.
5.
Charge your company 20% of the cost of any credit restoration.
You execute the contract and the enrollment invitations are emailed to the 2000 individuals. Three days later you sit
down and document all that went well and all that could have gone better. You put it in a file to reference the next time
an incident occurs.
Regarding the credit monitoring, which of the following would be the greatest concern?
A. The vendor\\’s representative does not have enough experience
B. Signing a contract with CRUDLOK which lasts longer than one year
C. The company did not collect enough identifiers to monitor one\\’s credit
D. You are going to notify affected individuals via a letter followed by an email
Correct Answer: A
QUESTION 13
SCENARIO
Please use the following to answer the next question:
Ben works in the IT department of IgNight, Inc., a company that designs lighting solutions for its clients.
Although IgNight\\’s customer base consists primarily of offices in the US, some individuals have been so
impressed by the unique aesthetic and energy-saving design of the light fixtures that they have requested
IgNight\\’s installations in their homes across the globe.
One Sunday morning, while using his work laptop to purchase tickets for an upcoming music festival, Ben
happens to notice some unusual user activity on company files. From a cursory review, all the data still
appears to be where it is meant to be but he can\\’t shake off the feeling that something is not right. He
knows that it is a possibility that this could be a colleague performing unscheduled maintenance, but he
recalls an email from his company\\’s security team reminding employees to be on alert for attacks from a
known group of malicious actors specifically targeting the industry.
Ben is a diligent employee and wants to make sure that he protects the company but he does not want to
bother his hard-working colleagues on the weekend. He is going to discuss the matter with this manager first thing in the
morning but wants to be prepared so he can demonstrate his knowledge in this area and plead his case for a
promotion.
If this were a data breach, how is it likely to be categorized?
A. Availability Breach.
B. Authenticity Breach.
C. Confidentiality Breach.
D. Integrity Breach.
Correct Answer: C
IAPP CIPM pdf free download https://drive.google.com/file/d/1iI98KlYps5BxqRpz3CcwjYz6lYwlC3Lj/view?usp=sharing
Here share the latest IAPP CIPM exam dumps pdf, IAPP CIPM exam questions, and answers! Trust Pass4itSure IAPP CIPM dumps https://www.pass4itsure.com/cipm.html (Updated: Jun 28, 2021). Study hard and wish you a successful exam!
