Free IAPP CIPM Sample Questions

Question 1

The General Data Protection Regulation (GDPR) specifies fines that may be levied againstdata controllers for certain infringements. Which of the following will be subject toadministrative fines of up to 10 000 000 EUR, or in the case of an undertaking, up to 2% ofthe total worldwide annual turnover of the preceding financial year?

A. Failure to demonstrate that consent was given by the data subject to the processing oftheir personal data where it is used as the basis for processing 
B. Failure to implement technical and organizational measures to ensure data protection isenshrined by design and default 
C. Failure to process personal information in a manner compatible with its original purpose 
D. Failure to provide the means for a data subject to rectify inaccuracies in personal data 

Answer: A

Question 2

SCENARIOPlease use the following to answer the next QUESTION:It's just what you were afraid of. Without consulting you, the information technology directorat your organization launched a new initiative to encourage employees to use personaldevices for conducting business. The initiative made purchasing a new, high-specificationlaptop computer an attractive option, with discounted laptops paid for as a payrolldeduction spread over a year of paychecks. The organization is also paying the salestaxes. It's a great deal, and after a month, more than half the organization's employeeshave signed on and acquired new laptops. Walking through the facility, you see themhappily customizing and comparing notes on their new computers, and at the end of theday, most take their laptops with them, potentially carrying personal data to their homes orother unknown locations. It's enough to give you data- protection nightmares, and you'vepointed out to the information technology Director and many others in the organization thepotential hazards of this new practice, including the inevitability of eventual data loss ortheft.Today you have in your office a representative of the organization's marketing departmentwho shares with you, reluctantly, a story with potentially serious consequences. The nightbefore, straight from work, with laptop in hand, he went to the Bull and Horn Pub to playbilliards with his friends. A fine night of sport and socializing began, with the laptop "safely"tucked on a bench, beneath his jacket. Later that night, when it was time to depart, heretrieved the jacket, but the laptop was gone. It was not beneath the bench or on anotherbench nearby. The waitstaff had not seen it. His friends were not playing a joke on him.After a sleepless night, he confirmed it this morning, stopping by the pub to talk to thecleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks atyou, embarrassed and upset.You ask him if the laptop contains any personal data from clients, and, sadly, he nods hishead, yes. He believes it contains files on about 100 clients, including names, addressesand governmental identification numbers. He sighs and places his head in his hands indespair.Which is the best way to ensure that data on personal equipment is protected?

A. User risk training. 
B. Biometric security. 
C. Encryption of the data. 
D. Frequent data backups. 

Answer: A

Question 3

Read the following steps:Perform frequent data back-ups.Perform test restorations to verify integrity of backed-up data.Maintain backed-up data offline or on separate servers.These steps can help an organization recover from what

A. Phishing attacks
B. Authorization errors 
C. Ransomware attacks
D. Stolen encryption keys

Answer: c

Question 4

“Collection”, “access” and “destruction” are aspects of what privacy management process?

A. The data governance strategy 
B. The breach response plan 
C. The metric life cycle 
D. The business case 

Answer: A

Question 5

SCENARIOPlease use the following to answer the next QUESTION.Manasa is a product manager at Omnipresent Omnimedia, where she is responsible forleading the development of the company’s flagship product, the Handy Helper. The HandyHelper is an application that can be used in the home to manage family calendars, doonline shopping, and schedule doctor appointments.After having had a successful launch in the United States, the Handy Helper is about to bemade available for purchase worldwide.The packaging and user guide for the Handy Helper indicate that it is a “privacy friendly”product suitable for the whole family, including children, but does not provide any furtherdetail or privacy notice. In order to use the application, a family creates a single account,and the primary user has access to all information about the other users. Upon start up, theprimary user must check a box consenting to receive marketing emails from OmnipresentOmnimedia and selected marketing partners in order to be able to use the application.Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreementwith a European distributor of Handy Helper when he fielded many Questions about theproduct from the distributor. Sanjay needed to look more closely at the product in order tobe able to answer the Questions as he was not involved in the product developmentprocess.In speaking with the product team, he learned that the Handy Helper collected and storedall of a user’s sensitive medical information for the medical appointment scheduler. In fact,all of the user’s information is stored by Handy Helper for the additional purpose of creatingadditional products and to analyze usage of the product. This data is all stored in the cloudand is encrypted both during transmission and at rest.Consistent with the CEO’s philosophy that great new product ideas can come from anyone,all Omnipresent Omnimedia employees have access to user data under a program called“Eureka.” Omnipresent Omnimedia is hoping that at some point in the future, the data willreveal insights that could be used to create a fully automated application that runs onartificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-termgoal.What security controls are missing from the Eureka program?

A. Storage of medical data in the cloud is not permissible under the General DataProtection Regulation (GDPR) 
B. Data access is not limited to those who “need to know” for their role 
C. Collection of data without a defined purpose might violate the fairness principle 
D. Encryption of the data at rest prevents European users from having the right of accessand the right of portability of their data 

Answer: B