CIPM Pre-Exam Practice Tests (Updated 275 Questions) [Q87-Q104]

CIPM Pre-Exam Practice Tests | (Updated 275 Questions)

Valid CIPM Exam Q&A PDF - One Year Free Update

The CIPM Exam covers a wide range of topics that are essential for privacy professionals, including privacy program governance, privacy program operational lifecycle, privacy regulations and standards, data protection and security, and privacy program assessment. CIPM exam is designed to test the knowledge, skills, and abilities required to manage and implement privacy programs effectively. Passing the CIPM exam indicates that a candidate has a comprehensive understanding of privacy management and can apply that knowledge to real-world scenarios.

 

NEW QUESTION # 87
SCENARIO
Please use the following to answer the next QUESTION:
Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won't listen to me," Paul says, "but he may pay attention to an expert." Gadgo's workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company's procedures and technologies for data protection. It's a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don't want unnecessary measures that will only slow people down and clutter their thoughts." The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A
"cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!" What phase in the Privacy Maturity Model (PMM) does Gadgo's privacy program best exhibit?

• A. Repeatable.
• B. Managed.
• C. Defined.
• D. Ad hoc.

Answer: D

Explanation:
This answer is the best way to describe the phase in the Privacy Maturity Model (PMM) that Gadgo's privacy program best exhibits, as it shows that the company has no formal or consistent approach to privacy protection and that its privacy practices are largely reactive, unplanned and uncoordinated. The ad hoc phase is the lowest level of maturity in the PMM, which is a framework that measures the effectiveness and maturity of an organization's privacy program based on five phases: ad hoc, repeatable, defined, managed and optimized. The ad hoc phase indicates that the organization has little or no awareness of its privacy obligations and risks, and that its privacy activities are dependent on individual efforts or initiatives, rather than on organizational policies or processes. References: IAPP CIPM Study Guide, page 891; ISO/IEC 27002:
2013, section 18.1.1
Reference: https://vvena.nl/wp-content/uploads/2018/04/aicpa_cica_privacy_maturity_model.pdf (page 2)

NEW QUESTION # 88
Which of the following is NOT an important factor to consider when developing a data retention policy?

• A. Compliance requirement
• B. Organizational culture.
• C. Technology resource.
• D. Business requirement.

Answer: B

Explanation:
Explanation
Organizational culture is not an important factor to consider when developing a data retention policy. A data retention policy is a document that defines how long an organization retains personal information for various purposes and how it disposes of it securely when it is no longer needed. A data retention policy should be based on factors such as: business requirements, such as operational needs, customer expectations, contractual obligations, or industry standards; compliance requirements, such as legal obligations, regulatory mandates, or audit recommendations; and technology resources, such as storage capacity, backup systems, encryption methods, or disposal tools. Organizational culture, which refers to the values, beliefs, norms, and behaviors that shape how an organization operates and interacts with its stakeholders, is not a relevant factor for determining data retention periods or disposal methods.
References:
* CIPM Body of Knowledge (2021), Domain IV: Privacy Program Operational Life Cycle, Section B:
Protecting Personal Information, Subsection 4: Data Retention
* CIPM Study Guide (2021), Chapter 8: Protecting Personal Information, Section 8.4: Data Retention
* CIPM Textbook (2019), Chapter 8: Protecting Personal Information, Section 8.4: Data Retention
* CIPM Practice Exam (2021), Question 141

NEW QUESTION # 89
SCENARIO
Please use the following to answer the next QUESTION:
For 15 years, Albert has worked at Treasure Box - a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motivated Albert to be an agent of positive change.
He will soon interview for a newly advertised position, and during the interview, Albert plans on making executives aware of lapses in the company's privacy program. He feels certain he will be rewarded with a promotion for preventing negative consequences resulting from the company's outdated policies and procedures.
For example, Albert has learned about the AICPA (American Institute of Certified Public Accountans)/CICA (Canadian Institute of Chartered Accountants) Privacy Maturity Model (PMM). Albert thinks the model is a useful way to measure Treasure Box's ability to protect personal dat a. Albert has noticed that Treasure Box fails to meet the requirements of the highest level of maturity of this model; at his interview, Albert will pledge to assist the company with meeting this level in order to provide customers with the most rigorous security available.
Albert does want to show a positive outlook during his interview. He intends to praise the company's commitment to the security of customer and employee personal data against external threats. However, Albert worries about the high turnover rate within the company, particularly in the area of direct phone marketing. He sees many unfamiliar faces every day who are hired to do the marketing, and he often hears complaints in the lunch room regarding long hours and low pay, as well as what seems to be flagrant disregard for company procedures.
In addition, Treasure Box has had two recent security incidents. The company has responded to the incidents with internal audits and updates to security safeguards. However, profits still seem to be affected and anecdotal evidence indicates that many people still harbor mistrust. Albert wants to help the company recover. He knows there is at least one incident the public in unaware of, although Albert does not know the details. He believes the company's insistence on keeping the incident a secret could be a further detriment to its reputation. One further way that Albert wants to help Treasure Box regain its stature is by creating a toll-free number for customers, as well as a more efficient procedure for responding to customer concerns by postal mail.
In addition to his suggestions for improvement, Albert believes that his knowledge of the company's recent business maneuvers will also impress the interviewers. For example, Albert is aware of the company's intention to acquire a medical supply company in the coming weeks.
With his forward thinking, Albert hopes to convince the managers who will be interviewing him that he is right for the job.
Based on Albert's observations regarding recent security incidents, which of the following should he suggest as a priority for Treasure Box?

• A. Working with the Human Resources department to make screening procedures for potential employees more rigorous.
• B. Using a third-party auditor to address privacy protection issues not recognized by the prior internal audits.
• C. Appointing an internal ombudsman to address employee complaints regarding hours and pay.
• D. Evaluating the company's ability to handle personal health information if the plan to acquire the medical supply company goes forward

Answer: D

NEW QUESTION # 90
SCENARIO
Please use the following to answer the next question:
Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States.
Video from the office's video surveillance cameras leaked to news operations showed a drug exchange between Special Handling staff and undercover officers.
In the wake of this incident, Kelly had been sent to Providence to change the "hands off" culture that upper management believed had let the criminal elements conduct their illicit transactions. After a few weeks under Kelly's direction, the office became a model of efficiency and customer service. Kelly monitored his workers' activities using the same cameras that had recorded the illegal conduct of their former co-workers.
Now Kelly has been charged with turning around the office in Cork, Ireland, another trouble spot. The company has received numerous reports of the staff leaving the office unattended. When Kelly arrived, he found that even when present, the staff often spent their days socializing or conducting personal business on their mobile phones. Again, he observed their behaviors using surveillance cameras. He issued written reprimands to six staff members based on the first day of video alone.
Much to Kelly's surprise and chagrin, he and the company are now under investigation by the Data Protection Commissioner of Ireland for allegedly violating the privacy rights of employees. Kelly was told that the company's license for the cameras listed facility security as their main use, but he does not know why this matters. He has pointed out to his superiors that the company's training programs on privacy protection and data collection mention nothing about surveillance video.
You are a privacy protection consultant, hired by the company to assess this incident, report on the legal and compliance issues, and recommend next steps.
What does this example best illustrate about training requirements for privacy protection?

• A. Training on local laws must be implemented for all personnel.
• B. Training must include assessments to verify that the material is mastered.
• C. Training must be repeated frequently to respond to new legislation.
• D. Training needs must be weighed against financial costs.

Answer: A

NEW QUESTION # 91
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
What should you do first to ascertain additional information about the loss of data?

• A. Investigate the background of the person reporting the incident.
• B. Interview the person reporting the incident following a standard protocol.
• C. Call the police to investigate even if you are unsure a crime occurred.
• D. Check company records of the latest backups to see what data may be recoverable.

Answer: B

Explanation:
This answer is the best way to ascertain additional information about the loss of data, as it allows you to gather relevant facts and details from the person who witnessed or experienced the incident. A standard protocol for interviewing the person reporting the incident should include questions such as:
When and where did the incident occur?
What type and amount of data was involved?
How was the data stored or protected on the laptop?
Who else had access to or knowledge of the laptop or the data?
What actions have been taken so far to recover or secure the laptop or the data?
How did you discover or report the incident?
Do you have any evidence or clues about who may have taken or accessed the laptop or the data?
Do you have any other information that may be relevant or helpful for the investigation? Interviewing the person reporting the incident following a standard protocol can help you to establish a clear timeline and scope of the incident, identify potential sources of evidence, assess the level of risk and harm to the individuals and the organization, and determine the next steps for responding to and resolving the incident. Reference: IAPP CIPM Study Guide, page 87; ISO/IEC 27002:2013, section 16.1.4

NEW QUESTION # 92
How are individual program needs and specific organizational goals identified in privacy framework development?

• A. By employing metrics to align privacy protection with objectives
• B. Through creation of the business case
• C. By employing an industry-standard needs analysis
• D. Through conversations with the privacy team

Answer: A

NEW QUESTION # 93
The main reason the response to this incident should be integrated into the Business Continuity Plan (BCP) is because?

• A. The impact on the company's competitive advantage is potentially significant.
• B. The repercussions for the company could have significant environmental impacts.
• C. The need for retraining employees will be paramount.
• D. Major stakeholders are involved from every critical area of the business.

Answer: D

Explanation:
Comprehensive and Detailed Explanation:
A Business Continuity Plan (BCP) ensures that organizations can recover from disruptions and maintain essential functions. Major stakeholders from every critical area must be involved to coordinate an effective response.
* Option A (Environmental impacts) is relevant for physical disaster recovery but not directly for a data breach.
* Option B (Retraining employees) is important but does not justify integrating the incident into BCP.
* Option D (Competitive advantage loss) is a consequence but not the primary reason for BCP integration.
* Option C (Major stakeholders are involved from every critical area of the business) is the correct answer because a comprehensive response requires cross-functional collaboration, including IT, legal, HR, and compliance teams.
Reference:CIPM Official Textbook, Module: Incident Response and Business Continuity - Section on Integrating Privacy into Business Continuity Planning.

NEW QUESTION # 94
Which of the following is a physical control that can limit privacy risk?

• A. user access reviews.
• B. Keypad or biometric access.
• C. Encryption.
• D. Tokenization.

Answer: B

Explanation:
A physical control that can limit privacy risk is keypad or biometric access. This is a type of access control that restricts who can enter or access a physical location or device where personal data is stored or processed. Keypad or biometric access requires a code or a biological feature (such as a fingerprint or a face scan) to authenticate the identity and authorization of the person seeking access. This can prevent unauthorized access, theft, loss, or damage of personal data by outsiders or insiders, . Reference: [CIPM - International Association of Privacy Professionals], [Free CIPM Study Guide - International Association of Privacy Professionals]

NEW QUESTION # 95
SCENARIO
Please use the following to answer the next QUESTION:
Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth.
Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/ printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end.
Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed.
As Richard begins to research more about Data Lifecycle Management (DLM), he discovers that the law office can lower the risk of a data breach by doing what?

• A. Minimizing the time it takes to retrieve the sensitive data.
• B. Reducing the volume and the type of data that is stored in its system.
• C. Increasing the number of experienced staff to code and categorize the incoming data.
• D. Prioritizing the data by order of importance.

Answer: B

NEW QUESTION # 96
Which statement is FALSE regarding the use of technical security controls?

• A. Technical security controls deployed for one jurisdiction often satisfy another jurisdiction.
• B. A person with security knowledge should be involved with the deployment of technical security controls.
• C. Technical security controls are part of a data governance strategy.
• D. Most privacy legislation lists the types of technical security controls that must be implemented.

Answer: A

NEW QUESTION # 97
All of the following would be recommended for effective identity access management (IAM) EXCEPT?

• A. User responsibility.
• B. Biometrics.
• C. Credentials.
• D. Demographics.

Answer: D

Explanation:
Step-by-Step Comprehensive Detailed Explanation with All Information Privacy Manager CIPM Study Guide References Identity and Access Management (IAM) is essential for securing access to systems and data. Let's evaluate the options:
A). User responsibility:
Ensuring users understand and comply with IAM policies is crucial for effective implementation.
B). Demographics:
Demographics (e.g., age, gender) are not relevant factors in IAM practices, as they do not contribute to authenticating or authorizing access.
C). Biometrics:
Biometric identifiers, such as fingerprints or facial recognition, are commonly used for secure authentication.
D). Credentials:
Credentials, such as usernames, passwords, or tokens, are fundamental elements of IAM systems.
CIPM Study Guide References:
* Privacy Program Operational Life Cycle - "Protect" phase discusses access management strategies.
* IAM frameworks emphasize authentication methods (e.g., credentials, biometrics) and user accountability.

NEW QUESTION # 98
The theft of proprietary information could have best been prevented by?

• A. Requiring multi-factor authentication for contractor access to confidential company data.
• B. Doing criminal background checks on all contractors.
• C. Escalating access requests for approval by the appropriate data custodian.
• D. Having requests for access reviewed by the privacy office.

Answer: A

Explanation:
Comprehensive and Detailed Explanation:
The most effective way to prevent unauthorized access and data theft is requiring multi-factor authentication (MFA), which adds an extra layer of security beyond just passwords.
* Option A (Criminal background checks on all contractors) - Background checks help reduce risk but do not prevent credential misuse.
* Option B (Reviewing access requests by the privacy office) - The privacy office may advise on best practices but is not responsible for granting or enforcing access controls.
* Option C (Escalating access requests for approval by a data custodian) - While this improves oversight, it does not actively prevent credential misuse.
* Option D (Requiring MFA) is the best solution because it ensures that even if a password is compromised, an additional authentication factor is required, reducing unauthorized access risks.
Reference:CIPM Official Textbook, Module: Access Controls and Authentication - Section on Multi- Factor Authentication (MFA) and Least Privilege Principles.

NEW QUESTION # 99
SCENARIO
Please use the following to answer the next QUESTION:
Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production - not data processing - and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers. Anton knows that a single break-in could irrevocably damage the company's relationship with its loyal customers. He intends to set a goal of guaranteed zero loss of personal information.
To this end, Anton originally planned to place restrictions on who was admitted to the physical premises of the company. However, Kenneth - his uncle's vice president and longtime confidante - wants to hold off on Anton's idea in favor of converting any paper records held at the company to electronic storage. Kenneth believes this process would only take one or two years. Anton likes this idea; he envisions a password- protected system that only he and Kenneth can access.
Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job easier, but it will simplify the management of the stored data. The heads of subsidiaries like the art gallery and kitchenware store down the street will be responsible for their own information management. Then, any unneeded subsidiary data still in Anton's possession can be destroyed within the next few years.
After learning of a recent security incident, Anton realizes that another crucial step will be notifying customers. Kenneth insists that two lost hard drives in Question are not cause for concern; all of the data was encrypted and not sensitive in nature. Anton does not want to take any chances, however. He intends on sending notice letters to all employees and customers to be safe.
Anton must also check for compliance with all legislative, regulatory, and market requirements related to privacy protection. Kenneth oversaw the development of the company's online presence about ten years ago, but Anton is not confident about his understanding of recent online marketing laws. Anton is assigning another trusted employee with a law background the task of the compliance assessment. After a thorough analysis, Anton knows the company should be safe for another five years, at which time he can order another check.
Documentation of this analysis will show auditors due diligence.
Anton has started down a long road toward improved management of the company, but he knows the effort is worth it. Anton wants his uncle's legacy to continue for many years to come.
Which important principle of Data Lifecycle Management (DLM) will most likely be compromised if Anton executes his plan to limit data access to himself and Kenneth?

• A. Ensuring data retrievability.
• B. Implementing clear policies.
• C. Ensuring adequacy of infrastructure.
• D. Practicing data minimalism.

Answer: D

Explanation:
Explanation
The important principle of Data Lifecycle Management (DLM) that will most likely be compromised if Anton executes his plan to limit data access to himself and Kenneth is ensuring data retrievability. Data retrievability refers to the ability to access and use data when needed for business purposes or legal obligations1 It involves maintaining the availability, integrity, and usability of data throughout its lifecycle2 However, if Anton restricts data access to only himself and Kenneth, he will create a single point of failure and a bottleneck for data retrieval. This could pose several risks and challenges for the company, such as:
* Losing data if Anton or Kenneth forgets the password or leaves the company without sharing it with others.
* Delaying data retrieval if Anton or Kenneth is unavailable or unresponsive when someone else needs the data urgently.
* Violating data protection laws or regulations that require data access by certain parties or authorities under certain circumstances.
* Reducing data quality or accuracy if Anton or Kenneth fails to update or maintain the data properly.
* Missing business opportunities or insights if Anton or Kenneth does not share the data with other relevant stakeholders or departments.
Therefore, Anton should reconsider his plan and adopt a more balanced and secure approach to data access management that follows the principle of least privilege. This means granting data access only to those who need it for their specific roles and responsibilities and revoking it when no longer needed3 He should also implement proper authentication, authorization, encryption, backup, and audit mechanisms to protect the data from unauthorized or unlawful access, use, disclosure, alteration, or destruction4 References: 1: Data Retrievability: What Is It?; 2: Data Lifecycle Management | IBM; 3: What is Least Privilege? Definition & Examples; 4: Technical Security Controls: Encryption, Firewalls & More

NEW QUESTION # 100
Which of the following is a common disadvantage of a third-party audit?

• A. It provides a level of unbiased, expert recommendations.
• B. It identifies weaknesses of internal controls.
• C. It requires a learning curve about the organization.
• D. It lends credibility to an internal audit program.

Answer: C

NEW QUESTION # 101
SCENARIO
Please use the following to answer the next QUESTION:
Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States. Video from the office's video surveillance cameras leaked to news operations showed a drug exchange between Special Handling staff and undercover officers.
In the wake of this incident, Kelly had been sent to Providence to change the "hands off" culture that upper management believed had let the criminal elements conduct their illicit transactions. After a few weeks under Kelly's direction, the office became a model of efficiency and customer service. Kelly monitored his workers' activities using the same cameras that had recorded the illegal conduct of their former co-workers.
Now Kelly has been charged with turning around the office in Cork, Ireland, another trouble spot. The company has received numerous reports of the staff leaving the office unattended. When Kelly arrived, he found that even when present, the staff often spent their days socializing or conducting personal business on their mobile phones. Again, he observed their behaviors using surveillance cameras. He issued written reprimands to six staff members based on the first day of video alone.
Much to Kelly's surprise and chagrin, he and the company are now under investigation by the Data Protection Commissioner of Ireland for allegedly violating the privacy rights of employees. Kelly was told that the company's license for the cameras listed facility security as their main use, but he does not know why this matters. He has pointed out to his superiors that the company's training programs on privacy protection and data collection mention nothing about surveillance video.
You are a privacy protection consultant, hired by the company to assess this incident, report on the legal and compliance issues, and recommend next steps.
Knowing that the regulator is now investigating, what would be the best step to take?

• A. Negotiate the terms of a settlement before formal legal action takes place.
• B. If you know the organization is guilty, advise it to accept the punishment.
• C. Consult an attorney experienced in privacy law and litigation.
• D. Use your background and knowledge to set a course of action.

Answer: C

Explanation:
Explanation
This answer is the best step to take knowing that the regulator is now investigating, as it can help the organization to obtain legal advice and representation on how to respond to and cooperate with the investigation, as well as how to defend or resolve any potential claims or disputes that may arise from the incident. Consulting an attorney experienced in privacy law and litigation can also help the organization to understand its rights and obligations under the applicable laws and regulations, as well as the possible outcomes and consequences of the investigation. An attorney can also assist the organization in preparing and submitting any required documents or evidence, communicating with the regulator or other parties, negotiating a settlement or agreement, or challenging or appealing any decisions or actions taken by the regulator. References: IAPP CIPM Study Guide, page 871; ISO/IEC 27002:2013, section 16.1.5

NEW QUESTION # 102
In addition to regulatory requirements and business practices, what important factors must a global privacy strategy consider?

• A. Monetary exchange
• B. Cultural norms
• C. Political history
• D. Geographic features

Answer: D

NEW QUESTION # 103
Your company wants to convert paper records that contain customer personal information into electronic form, upload the records into a new third-party marketing tool and then merge the customer personal information in the marketing tool with information from other applications.
As the Privacy Officer, which of the following should you complete to effectively make these changes?

• A. A Personal Data Inventory.
• B. A Privacy Impact Assessment (PIA).
• C. A Record of Authority.
• D. A Privacy Threshold Analysis (PTA).

Answer: B

Explanation:
Explanation
A Privacy Impact Assessment (PIA) is a process that helps an organization identify and evaluate the potential privacy risks and impacts of a new or existing project, program, system, or service that involves the collection, use, disclosure, or retention of personal information. A PIA also helps an organization identify and implement appropriate measures to mitigate or eliminate those risks and impacts, and ensure compliance with applicable privacy laws, regulations, and standards. A PIA should be completed to effectively make changes that involve customer personal information, such as converting paper records into electronic form, uploading the records into a new third-party marketing tool, and merging the customer personal information in the marketing tool with information from other applications. A PIA can help an organization assess the necessity, proportionality, and legality of the proposed changes, as well as the potential privacy risks to the customers and the organization, such as unauthorized access, disclosure, modification, or loss of personal information, identity theft, fraud, reputational damage, or legal liability. A PIA can also help an organization implement appropriate measures to mitigate or eliminate those risks, such as data minimization, encryption, anonymization, pseudonymization, consent management, access control, security safeguards, contractual clauses, data protection impact assessments (DPIAs), data subject rights, breach notification procedures, and privacy policies.
References:
* CIPM Body of Knowledge (2021), Domain IV: Privacy Program Operational Life Cycle, Section C:
Monitoring and Managing Program Performance Subsection 1: Privacy Impact Assessments1
* CIPM Study Guide (2021), Chapter 9: Monitoring and Managing Program Performance Section 9.1:
Privacy Impact Assessments2
* CIPM Textbook (2019), Chapter 9: Monitoring and Managing Program Performance Section 9.1:
Privacy Impact Assessments3
* CIPM Practice Exam (2021), Question 1464

NEW QUESTION # 104
......

To be eligible to take the CIPM exam, candidates must have at least two years of professional privacy experience, or one year of privacy experience plus a privacy-related certification. CIPM exam consists of 90 multiple-choice questions and must be completed within two hours. The passing score is 300 out of a possible 500 points.

 

Certified Information Privacy Manager (CIPM) Free Update Certification Sample Questions: https://www.examdiscuss.com/IAPP/exam/CIPM/

Trend for IAPP CIPM pdf dumps before actual exam: https://drive.google.com/open?id=1x_6IKGQbGXGOOdGomW0ju7Wl2hlQRqRq