CIPM IAPP Exam Questions and Free Practice Test

Question 7

SCENARIO
Please use the following to answer the next QUESTION:
Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide.
The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application.
Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many Questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the Questions as he was not involved in the product development process.
In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest. Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Omnipresent
Omnimedia employees have access to user data under a program called Eureka. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal.
What can Sanjay do to minimize the risks of offering the product in Europe?

A. Sanjay should advise the distributor that Omnipresent Omnimedia has certified to the Privacy Shield Framework and there should be no issues.

B. Sanjay should work with Manasa to review and remediate the Handy Helper as a gating item before it is released.

C. Sanjay should document the data life cycle of the data collected by the Handy Helper.

D. Sanjay should write a privacy policy to include with the Handy Helper user guide.

Correct Answer:C

Question 8

What is the main purpose of a privacy program audit?

A. To mitigate the effects of a privacy breach.

B. To justify a privacy department budget increase.

C. To make decisions on privacy staff roles and responsibilities.

D. To ensure the adequacy of data protection procedures.

Correct Answer:D

Question 9

You would like your organization to be independently audited to demonstrate compliance with international privacy standards and to identify gaps for remediation.
Which type of audit would help you achieve this objective?

A. First-party audit.

B. Second-party audit.

C. Third-party audit.

D. Fourth-party audit.

Correct Answer:C

Question 10

Which of the following indicates you have developed the right privacy framework for your organization?

A. It includes a privacy assessment of each major system.

B. It improves the consistency of the privacy program.

C. It works at a different type of organization.

D. It identifies all key stakeholders by name.

Correct Answer:A

Question 11

What is one obligation that the General Data Protection Regulation (GDPR) imposes on data processors?

A. To honor all data access requests from data subjects.

B. To inform data subjects about the identity and contact details of the controller.

C. To implement appropriate technical and organizational measures that ensure an appropriate level of security.

D. To carry out data protection impact assessments in cases where processing is likely to result in high risk to the rights and freedoms of individuals.

Correct Answer:D

Question 12

How are individual program needs and specific organizational goals identified in privacy framework development?

A. By employing metrics to align privacy protection with objectives.

B. Through conversations with the privacy team.

C. By employing an industry-standard needs analysis.

D. Through creation of the business case.

Correct Answer:A

START CIPM EXAM