Free IAPP CIPM Exam Questions
Absolute Free CIPM Exam Practice for Comprehensive Preparation
-
IAPP CIPM Exam Questions
-
Provided By: IAPP
- Exam: Certified Information Privacy Manager
- Certification: Certified Information Privacy Manager
-
Total Questions: 278
-
Updated On: Sep 04, 2026
-
Rated: 4.9 |
-
Online Users: 556
-
Question 1
-
What United States federal law requires financial institutions to declare their personal data collection practices?
Answer: B
-
What United States federal law requires financial institutions to declare their personal data collection practices?
-
Question 2
-
Which of the following controls does the PCI DSS framework NOT require?
Answer: A
-
Which of the following controls does the PCI DSS framework NOT require?
-
Question 3
-
SCENARIOPlease use the following to answer the next question:It's just what you were afraid of. Without consulting you, the information technology director at your organizationlaunched a new initiative to encourage employees to use personal devices for conducting business. Theinitiative made purchasing a new, high-specification laptop computer an attractive option, with discountedlaptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying thesales taxes. It's a great deal, and after a month, more than half the organization's employees have signed onand acquired new laptops. Walking through the facility, you see them happily customizing and comparing noteson their new computers, and at the end of the day, most take their laptops with them, potentially carryingpersonal data to their homes or other unknown locations. It's enough to give you data-protection nightmares,and you've pointed out to the information technology Director and many others in the organization the potentialhazards of this new practice, including the inevitability of eventual data loss or theft.Today you have in your office a representative of the organization's marketing department who shares with you,reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop inhand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializingbegan, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time todepart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another benchnearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, heconfirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop wasmissing. Stolen, it seems. He looks at you, embarrassed and upset.You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. Hebelieves it contains files on about 100 clients, including names, addresses and governmental identificationnumbers. He sighs and places his head in his hands in despair.What should you do first to ascertain additional information about the loss of data?
Answer: A
-
-
Question 4
-
Which of the following is a common disadvantage of a third-party audit?
Answer: C
-
Which of the following is a common disadvantage of a third-party audit?
-
Question 5
-
SCENARIOPlease use the following to answer the next question:Jonathan recently joined a healthcare payment processing solutions company as a senior privacy manager.One morning, Jonathan awakens to several emails informing him that an individual cloud server failed due to aflood in its server room, damaging its hardware and destroying all the data the company had stored on thatdrive. Jonathan was not aware that the company had this particular cloud account or that any data was beingstored there because it was not included in the data mapping or data inventory provided to him by hispredecessor. Jonathan's predecessor conducted a data inventory and mapping exercise 4 years ago andupdated it on an annual basis.Renee works in the sales department and tells Jonathan that she doesn't think that account had been usedsince the company moved to a bigger cloud vendor three years ago. She also advised him that the account wasmostly used by Human Resources (HR) and Accounts Payable (AP). Jonathan speaks to both departments andlearns that each had met with his predecessor multiple times and explained they saved sensitive personal dataon that drive, including health and financial related personal data and "other stuff." Jonathan also learns that thedata stored in that account was not backed up pursuant to company policy. Jonathan asks his IT departmentwho had access to that particular account and learns that there were no access controls in place, making theaccount available to anyone in the company, despite the purported sensitivity of the data being stored there.Jonathan is panicking as the data can't be recovered, and he can't determine exactly what data was saved onthat account or to whom it belongs. Two days later, the company receives 32 data subject access requests andAccounts Payable confirms Jonathan's worry that these data subjects' personal data was likely stored on thisaccount. He searches for the company's data subject access request policy, but later learns it doesn't exist.Based on the scenario above, what is the most appropriate next step Jonathan should take?
Answer: A
-