CIPM IAPP Exam Questions and Free Practice Test

Question 19

SCENARIO
Please use the following to answer the next QUESTION:
John is the new privacy officer at the prestigious international law firm – A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe.
During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor – MessageSafe. Being successful as an email hygiene vendor, MessageSafe is expanding its business by leasing cloud infrastructure from Cloud Inc. to host email continuity service for A&M LLP.
John is very concerned about this initiative. He recalled that MessageSafe was in the news six months ago due to a security breach. Immediately, John did a quick research of MessageSafe's previous breach and learned that the breach was caused by an unintentional mistake by an IT administrator. He scheduled a meeting with Derrick to address his concerns.
At the meeting, Derrick emphasized that email is the primary method for the firm's lawyers to communicate with clients, thus it is critical to have the email continuity service to avoid any possible email downtime. Derrick has been using the anti-spam service provided by MessageSafe for five years and is very happy with the quality of service provided by MessageSafe. In addition to the significant discount offered by MessageSafe, Derrick emphasized that he can also speed up the onboarding process since the firm already has a service contract in place with MessageSafe. The existing on-premises email continuity solution is about to reach its end of life very soon and he doesn't have the time or resource to look for another solution. Furthermore, the off-premises email continuity service will only be turned on when the email service at A&M LLP's primary and secondary data centers are both down, and the email messages stored at MessageSafe site for continuity service will be automatically deleted after 30 days.
Which of the following is the most effective control to enforce MessageSafe's implementation of appropriate technical countermeasures to protect the personal data received from A&M LLP?

A. MessageSafe must apply due diligence before trusting Cloud In

B. with the personal data received from A&M LLP.

C. MessageSafe must flow-down its data protection contract terms with A&M LLP to Cloud Inc.

D. MessageSafe must apply appropriate security controls on the cloud infrastructure.

E. MessageSafe must notify A&M LLP of a data breach.

Correct Answer:D

Question 20

What is the main function of the Asia-Pacific Economic Cooperation Privacy Framework?

A. Enabling regional data transfers.

B. Protecting data from parties outside the region.

C. Establishing legal requirements for privacy protection in the region.

D. Marketing privacy protection technologies developed in the region.

Correct Answer:A

Question 21

Which is the best way to view an organization’s privacy framework?

A. As an industry benchmark that can apply to many organizations

B. As a fixed structure that directs changes in the organization

C. As an aspirational goal that improves the organization

D. As a living structure that aligns to changes in the organization

Correct Answer:B

Question 22

Why were the nongovernmental privacy organizations, Electronic Frontier Foundation (EFF) and Electronic Privacy Information Center (EPIC), established?

A. To promote consumer confidence in the Internet industry.

B. To improve the user experience during online shopping.

C. To protect civil liberties and raise consumer awareness.

D. To promote security on the Internet through strong encryption.

Correct Answer:C

Question 23

What is the best way to understand the location, use and importance of personal data within an organization?

A. By analyzing the data inventory.

B. By testing the security of data systems.

C. By evaluating methods for collecting data.

D. By interviewing employees tasked with data entry.

Correct Answer:C

Question 24

SCENARIO
Please use the following to answer the next QUESTION:
Ben works in the IT department of IgNight, Inc., a company that designs lighting solutions for its clients. Although IgNight's customer base consists primarily of offices in the US, some individuals have been so impressed by the unique aesthetic and energy-saving design of the light fixtures that they have requested
IgNight's installations in their homes across the globe.
One Sunday morning, while using his work laptop to purchase tickets for an upcoming music festival, Ben happens to notice some unusual user activity on company files. From a cursory review, all the data still appears to be where it is meant to be but he can't shake off the feeling that something is not right. He knows that it is a possibility that this could be a colleague performing unscheduled maintenance, but he recalls an email from his company's security team reminding employees to be on alert for attacks from a known group of malicious actors specifically targeting the industry.
Ben is a diligent employee and wants to make sure that he protects the company but he does not want to bother his hard-working colleagues on the weekend. He is going to discuss the matter with this manager first thing in the morning but wants to be prepared so he can demonstrate his knowledge in this area and plead his case for a promotion.
To determine the steps to follow, what would be the most appropriate internal guide for Ben to review?

A. Incident Response Plan.

B. Code of Business Conduct.

C. IT Systems and Operations Handbook.

D. Business Continuity and Disaster Recovery Plan.

Correct Answer:B

START CIPM EXAM