The IAPP CIPM Questions & Practice Test are Available On-Demand [Q145-Q167]

The IAPP CIPM Questions & Practice Test are Available On-Demand

Valid CIPM Exam Dumps Ensure you a HIGH SCORE

NEW QUESTION # 145
Which of the following is TRUE about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR)?

• A. The DPIA result must be reported to the corresponding supervisory authority.
• B. The DPIA is required if the processing activity entails risk to the rights and freedoms of an EU individual.
• C. The DPIA must include a description of the proposed processing operation and its purpose.
• D. The DPIA report must be published to demonstrate the transparency of the data processing.

Answer: C

Explanation:
The statement that is true about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR) is that the DPIA must include a description of the proposed processing operation and its purpose. According to Article 35(7) of the GDPR, a DPIA shall contain at least:
"a systematic description of the envisaged processing operations and the purposes of the processing";
"an assessment of the necessity and proportionality of the processing operations in relation to the purposes";
"an assessment of the risks to the rights and freedoms of data subjects";
"the measures envisaged to address the risks";
"safeguards", "security measures";
"mechanisms to ensure the protection of personal data";
"to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned"5 Therefore, a DPIA must include a description of what data processing activities are planned and why they are needed as part of its content. This helps to provide a clear overview of the processing operation and its objectives as well as to assess its necessity and proportionality in relation to its purposes6 Reference: 5: [General Data Protection Regulation (GDPR) - Official Legal Text], Article 35(7); 6: Data protection impact assessments | ICO

NEW QUESTION # 146
Which of the following best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?

• A. All employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established.
• B. Employees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement.
• C. All employees are subject to the rules in their entirety, regardless of where the work is taking place.
• D. Employees must sign an ad hoc contractual agreement each time personal data is exported.

Answer: A

Explanation:
Binding Corporate Rules (BCRs) are a mechanism for international organizations to transfer personal data within their group of companies across different jurisdictions, in compliance with the EU General Data Protection Regulation (GDPR) and other privacy laws. BCRs are legally binding and enforceable by data protection authorities and data subjects. BCRs must ensure that all employees who process personal data follow the privacy regulations of the jurisdictions where the data originates from, regardless of where they are located or where the data is transferred to. References: [Binding Corporate Rules], [BCRs for controllers],
[BCRs for processors]
Reference: https://www.lexology.com/library/detail.aspx?g=80239951-01b8-409f-9019-953f5233852e

NEW QUESTION # 147
SCENARIO
Please use the following to answer the next QUESTION:
Ben works in the IT department of IgNight, Inc., a company that designs lighting solutions for its clients.
Although IgNight's customer base consists primarily of offices in the US, some individuals have been so impressed by the unique aesthetic and energy-saving design of the light fixtures that they have requested IgNight's installations in their homes across the globe.
One Sunday morning, while using his work laptop to purchase tickets for an upcoming music festival, Ben happens to notice some unusual user activity on company files. From a cursory review, all the data still appears to be where it is meant to be but he can't shake off the feeling that something is not right. He knows that it is a possibility that this could be a colleague performing unscheduled maintenance, but he recalls an email from his company's security team reminding employees to be on alert for attacks from a known group of malicious actors specifically targeting the industry.
Ben is a diligent employee and wants to make sure that he protects the company but he does not want to bother his hard-working colleagues on the weekend. He is going to discuss the matter with this manager first thing in the morning but wants to be prepared so he can demonstrate his knowledge in this area and plead his case for a promotion.
Going forward, what is the best way for IgNight to prepare its IT team to manage these kind of security events?

• A. Update its data inventory.
• B. Tabletop exercises.
• C. IT security awareness training.
• D. Share communications relating to scheduled maintenance.

Answer: B

Explanation:
The best way for IgNight to prepare its IT team to manage these kind of security events is to conduct tabletop exercises. Tabletop exercises are simulated scenarios that test the organization's ability to respond to security incidents in a realistic and interactive way. Tabletop exercises typically involve:
* A facilitator who guides the participants through the scenario and injects additional challenges or variables
* A scenario that describes a plausible security incident based on real-world threats or past incidents
* A set of objectives that define the expected outcomes and goals of the exercise
* A set of questions that prompt the participants to discuss their roles, responsibilities, actions, decisions, and communications during the incident response process
* A feedback mechanism that collects the participants' opinions and suggestions on how to improve the incident response plan and capabilities Tabletop exercises help an organization prepare for and deal with security incidents by:
* Enhancing the awareness and skills of the IT team and other stakeholders involved in incident response
* Identifying and addressing the gaps, weaknesses, and challenges in the incident response plan and process
* Improving the coordination and collaboration among the IT team and other stakeholders during incident response
* Evaluating and validating the effectiveness and efficiency of the incident response plan and process
* Generating and implementing lessons learned and best practices for incident response The other options are not as effective or useful as tabletop exercises for preparing the IT team to manage security events. Updating the data inventory is a good practice for maintaining an accurate and comprehensive record of the personal data that the organization collects, processes, stores, shares, or disposes of. However, it does not test or improve the organization's incident response capabilities or readiness. IT security awareness training is a good practice for educating the IT team and other employees on the basic principles and practices of cybersecurity. However, it does not simulate or replicate the real-world situations and challenges that the IT team may face during security incidents. Sharing communications relating to scheduled maintenance is a good practice for informing the IT team and other stakeholders of the planned activities and potential impacts on the IT systems and infrastructure. However, it does not prepare the IT team for dealing with unplanned or unexpected security events that may require immediate and coordinated response. References: CISA Tabletop Exercise Packages; Cybersecurity Tabletop Exercise Examples, Best Practices, and Considerations; Six Tabletop Exercises to Help Prepare Your Cybersecurity Team

NEW QUESTION # 148
SCENARIO
Please use the following to answer the next question:
Martin Briseno is the director of human resources at the Canyon City location of the U.S. hotel chain Pacific Suites. In 1998, Briseno decided to change the hotel's on-the-job mentoring model to a standardized training program for employees who were progressing from line positions into supervisory positions. He developed a curriculum comprising a series of lessons, scenarios, and assessments, which was delivered in-person to small groups. Interest in the training increased, leading Briseno to work with corporate HR specialists and software engineers to offer the program in an online format. The online program saved the cost of a trainer and allowed participants to work through the material at their own pace.
Upon hearing about the success of Briseno's program, Pacific Suites corporate Vice President Maryanne Silva-Hayes expanded the training and offered it company-wide. Employees who completed the program received certification as a Pacific Suites Hospitality Supervisor. By 2001, the program had grown to provide industry-wide training. Personnel at hotels across the country could sign up and pay to take the course online.
As the program became increasingly profitable, Pacific Suites developed an offshoot business, Pacific Hospitality Training (PHT). The sole focus of PHT was developing and marketing a variety of online courses and course progressions providing a number of professional certifications in the hospitality industry.
By setting up a user account with PHT, course participants could access an information library, sign up for courses, and take end-of-course certification tests. When a user opened a new account, all information was saved by default, including the user's name, date of birth, contact information, credit card information, employer, and job title. The registration page offered an opt-out choice that users could click to not have their credit card numbers saved. Once a user name and password were established, users could return to check their course status, review and reprint their certifications, and sign up and pay for new courses. Between 2002 and
2008, PHT issued more than 700,000 professional certifications.
PHT's profits declined in 2009 and 2010, the victim of industry downsizing and increased competition from e- learning providers. By 2011, Pacific Suites was out of the online certification business and PHT was dissolved.
The training program's systems and records remained in Pacific Suites' digital archives, un-accessed and unused. Briseno and Silva-Hayes moved on to work for other companies, and there was no plan for handling the archived data after the program ended. After PHT was dissolved, Pacific Suites executives turned their attention to crucial day-to-day operations. They planned to deal with the PHT materials once resources allowed.
In 2012, the Pacific Suites computer network was hacked. Malware installed on the online reservation system exposed the credit card information of hundreds of hotel guests. While targeting the financial data on the reservation site, hackers also discovered the archived training course data and registration accounts of Pacific Hospitality Training's customers. The result of the hack was the exfiltration of the credit card numbers of recent hotel guests and the exfiltration of the PHT database with all its contents.
A Pacific Suites systems analyst discovered the information security breach in a routine scan of activity reports. Pacific Suites quickly notified credit card companies and recent hotel guests of the breach, attempting to prevent serious harm. Technical security engineers faced a challenge in dealing with the PHT data.
PHT course administrators and the IT engineers did not have a system for tracking, cataloguing, and storing information. Pacific Suites has procedures in place for data access and storage, but those procedures were not implemented when PHT was formed. When the PHT database was acquired by Pacific Suites, it had no owner or oversight. By the time technical security engineers determined what private information was compromised, at least 8,000 credit card holders were potential victims of fraudulent activity.
What key mistake set the company up to be vulnerable to a security breach?

• A. Collecting too much information and keeping it for too long
• B. Overlooking the need to organize and categorize data
• C. Neglecting to make a backup copy of archived electronic files
• D. Failing to outsource training and data management to professionals

Answer: B

NEW QUESTION # 149
When conducting due diligence during an acquisition, what should a privacy professional avoid?

• A. Allowing legal in both companies to handle the privacy laws and compliance.
• B. Benchmarking the two Companies privacy policies against one another.
• C. Planning for impacts on the data processing operations post-acquisition.
• D. Discussing with the acquired company the type and scope of their data processing.

Answer: A

Explanation:
Explanation
When conducting due diligence during an acquisition, a privacy professional should avoid allowing legal in both companies to handle the privacy laws and compliance. This is because legal teams may not have the expertise or the resources to address all the privacy issues and risks that may arise from the acquisition. A privacy professional should be involved in the due diligence process to ensure that the privacy policies, practices, and obligations of both companies are aligned and compliant with the applicable laws and regulations. The other options are not things that a privacy professional should avoid, but rather things that they should do as part of the due diligence process. References: CIPM Body of Knowledge, Domain V:
Privacy Program Management, Section A: Privacy Program Administration, Subsection 3: Due Diligence.

NEW QUESTION # 150
What is the main purpose in notifying data subjects of a data breach?

• A. To ensure organizations have accountability for the sufficiency of their security measures.
• B. To allow individuals to take any actions required to protect themselves from possible consequences.
• C. To avoid financial penalties and legal liability.
• D. To enable regulators to understand trends and developments that may shape the law.

Answer: B

Explanation:
Step-by-Step Comprehensive Detailed Explanation with All Information Privacy Manager CIPM Study Guide References Data breach notifications are intended to protect individuals and allow them to take action. Let's analyze the options:
A . To avoid financial penalties and legal liability:
While compliance with breach notification laws can reduce liability, this is not the primary purpose of notifying data subjects.
B . To enable regulators to understand trends and developments that may shape the law:
This describes the purpose of breach reporting to regulators, not notifying data subjects.
C . To ensure organizations have accountability for the sufficiency of their security measures:
This relates to internal accountability and compliance but is not the main reason for notifying data subjects.
D . To allow individuals to take any actions required to protect themselves from possible consequences:
This is the primary purpose of data breach notifications, empowering individuals to mitigate risks like identity theft or financial fraud.
CIPM Study Guide References:
Privacy Program Operational Life Cycle - "Respond" phase includes breach notification as a requirement under various laws (e.g., GDPR, CCPA).
GDPR Article 34 specifies that breach notifications to individuals aim to enable protective actions.

NEW QUESTION # 151
Formosa International operates in 20 different countries including the United States and France. What organizational approach would make complying with a number of different regulations easier?

• A. Fair Information Practices.
• B. Data mapping.
• C. Decentralized privacy management.
• D. Rationalizing requirements.

Answer: D

Explanation:
Rationalizing requirements is an organizational approach that involves identifying and harmonizing the common elements of different privacy regulations and standards. This can make compliance easier and more efficient, as well as reduce the risk of conflicts or gaps in privacy protection. Rationalizing requirements can also help to create a consistent privacy policy and culture across different jurisdictions and business units. Reference: CIPM Study Guide, page 23.

NEW QUESTION # 152
You would like your organization to be independently audited to demonstrate compliance with international privacy standards and to identify gaps for remediation.
Which type of audit would help you achieve this objective?

• A. First-party audit.
• B. Third-party audit.
• C. Second-party audit.
• D. Fourth-party audit.

Answer: B

Explanation:
A third-party audit would help an organization achieve the objective of demonstrating compliance with international privacy standards and identifying gaps for remediation. A third-party audit is an audit conducted by an independent and external auditor who is not affiliated with either the audited organization or its customers. A third-party audit can provide an objective and impartial assessment of the organization's privacy practices and policies, as well as verify its compliance with relevant standards and regulations. A third-party audit can also help the organization identify areas for improvement and recommend corrective actions. A third-party audit can enhance the organization's reputation, trustworthiness, and credibility among its stakeholders and customers.
A first-party audit is an audit conducted by the organization itself or by someone within the organization who has been designated as an auditor. A first-party audit is also known as an internal audit. A first-party audit can help the organization monitor its own performance, evaluate its compliance with internal policies and procedures, and identify potential risks and opportunities for improvement. However, a first-party audit may not be sufficient to demonstrate compliance with external standards and regulations, as it may lack independence and objectivity.
A second-party audit is an audit conducted by a party that has an interest in or a relationship with the audited organization, such as a customer, a supplier, or a partner. A second-party audit is also known as an external audit. A second-party audit can help the party verify that the audited organization meets its contractual obligations, expectations, and requirements. A second-party audit can also help the party evaluate the quality and reliability of the audited organization's products or services. However, a second-party audit may not be able to provide a comprehensive and unbiased assessment of the audited organization's privacy practices and policies, as it may be influenced by the party's own interests and objectives. References: Types of Audits: 14 Types of Audits and Level of Assurance (2022)

NEW QUESTION # 153
SCENARIO
Please use the following to answer the next QUESTION:
Ben works in the IT department of IgNight, Inc., a company that designs lighting solutions for its clients. Although IgNight's customer base consists primarily of offices in the US, some individuals have been so impressed by the unique aesthetic and energy-saving design of the light fixtures that they have requested IgNight's installations in their homes across the globe.
One Sunday morning, while using his work laptop to purchase tickets for an upcoming music festival, Ben happens to notice some unusual user activity on company files. From a cursory review, all the data still appears to be where it is meant to be but he can't shake off the feeling that something is not right. He knows that it is a possibility that this could be a colleague performing unscheduled maintenance, but he recalls an email from his company's security team reminding employees to be on alert for attacks from a known group of malicious actors specifically targeting the industry.
Ben is a diligent employee and wants to make sure that he protects the company but he does not want to bother his hard-working colleagues on the weekend. He is going to discuss the matter with this manager first thing in the morning but wants to be prepared so he can demonstrate his knowledge in this area and plead his case for a promotion.
To determine the steps to follow, what would be the most appropriate internal guide for Ben to review?

• A. Business Continuity and Disaster Recovery Plan.
• B. IT Systems and Operations Handbook.
• C. Code of Business Conduct.
• D. Incident Response Plan.

Answer: C

NEW QUESTION # 154
SCENARIO
Please use the following to answer the next question:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it:
a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" You see evidence that company employees routinely circumvent the privacy officer in developing new initiatives. How can you best draw attention to the scope of this problem?

• A. Hold discussions with the department head of anyone who fails to consult with the privacy officer.
• B. Develop a metric showing the number of initiatives launched without consultation and include it in reports, presentations, and consultation.
• C. Insist upon one-on-one consultation with each person who works around the privacy officer.
• D. Take your concerns straight to the Chief Executive Officer.

Answer: A

NEW QUESTION # 155
SCENARIO
Please use the following lo answer the next question:
The board risk committee of your organization is particularly concerned not only by the number and frequency of data breaches reported to it over the past 12 months, but also the inconsistency in responses and poor incident response turnaround times.
Upon reviewing the current incident response plan (IRP), it was discovered that while the business continuity plan (BCP> had been updated on time, the IRP, linked to BCP. was last updated over three years ago.
The board risk committee has noted this as high risk especially since company policy is to review and update policies and plans annually. Consequently, the newly appointed data protection officer (DPO) was requested to provide a paper on how she would remediate the situation.
As a seasoned data privacy professional, you have been requested to assist the new DPO.
Your first recommendation in addressing the board risk committee's concerns is to?

• A. Integrate the IRP into the BCP so it is not a stand-alone document.
• B. Focus on training and awareness sessions in order to familiarize relevant staff with current policies and procedures.
• C. Conduct a table-top exercise based on the version of the IRP that is currently on record.
• D. Update the IRP with the applicable emergency contact information, policies and procedures, as well as timelines and action steps.

Answer: D

NEW QUESTION # 156
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
In order to determine the best course of action, how should this incident most productively be viewed?

• A. As an incident that requires the abrupt initiation of a notification campaign.
• B. As a potential compromise of personal information through unauthorized access.
• C. As the premeditated theft of company data, until shown otherwise.
• D. As the accidental loss of personal property containing data that must be restored.

Answer: B

Explanation:
Explanation
This answer recognizes the risk of data breach that may result from the loss of the laptop, as it may expose the personal information of the clients to unauthorized or unlawful processing. A data breach is defined as a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. A data breach may have serious consequences for the individuals whose data is compromised, such as identity theft, fraud, discrimination, financial loss or reputational damage. Therefore, it is important to view this incident as a potential compromise of personal information and take appropriate measures to contain, assess and mitigate the impact of the breach. References: IAPP CIPM Study Guide, page 86; ISO/IEC 27002:2013, section 16.1.1

NEW QUESTION # 157
Your marketing team wants to know why they need a check box for their SMS opt-in. You explain it is part of the consumer's right to?

• A. Have access.
• B. Be informed.
• C. Raise complaints.
• D. Request correction.

Answer: B

Explanation:
Explanation
The marketing team needs a check box for their SMS opt-in because it is part of the consumer's right to be informed. This right means that consumers have the right to know how their personal data is collected, used, shared, and protected by the organization. The check box allows consumers to give their consent and opt-in to receive SMS messages from the organization, and also informs them of the purpose and scope of such messages. The other rights are not relevant in this case, as they are related to other aspects of data processing, such as correction, complaints, and access. References: CIPM Body of Knowledge, Domain IV: Privacy Program Communication, Section A: Communicating to Stakeholders, Subsection 1: Consumer Rights.

NEW QUESTION # 158
Which of the following helps build trust with customers and stakeholders?

• A. Enable customers to view and change their own personal information within a dedicated portal.
• B. Only publish what is legally necessary to reduce your liability.
• C. Publish your privacy policy using broad language to ensure all of your organization's activities are captured.
• D. Provide a dedicated privacy space with the privacy policy, explanatory documents and operation frameworks.

Answer: D

Explanation:
Providing a dedicated privacy space with the privacy policy, explanatory documents and operation frameworks helps build trust with customers and stakeholders. A dedicated privacy space is a section on an organization's website or app that provides clear and transparent information about how the organization processes personal information and respects data subject rights. It can include documents such as: a privacy policy that explains what personal information is collected, why it is collected, how it is used, who it is shared with, and how it is protected; explanatory documents that provide more details or examples of specific processing activities or scenarios; and operation frameworks that describe the procedures and mechanisms for data subject requests, complaints, inquiries, or feedback. A dedicated privacy space can help customers and stakeholders understand the organization's privacy practices, choices, and values, and enhance their confidence and trust.
Reference:
CIPM Body of Knowledge (2021), Domain II: Privacy Program Framework, Section A: Privacy Program Framework Components, Subsection 1: Privacy Policies CIPM Study Guide (2021), Chapter 4: Privacy Program Framework Components, Section 4.1: Privacy Policies CIPM Textbook (2019), Chapter 4: Privacy Program Framework Components, Section 4.1: Privacy Policies CIPM Practice Exam (2021), Question 140

NEW QUESTION # 159
What does it mean to "rationalize" data protection requirements?

• A. Address the less stringent laws and regulations, and inform stakeholders why they are applicable
• B. Look for overlaps in laws and regulations from which a common solution can be developed
• C. Determine where laws and regulations are redundant in order to eliminate some from requiring compliance
• D. Evaluate the costs and risks of applicable laws and regulations and address those that have the greatest penalties

Answer: C

NEW QUESTION # 160
Which of the following is NOT a type of privacy program metric?

• A. Commercial metrics.
• B. Data enhancement metrics.
• C. Business enablement metrics.
• D. Value creation metrics.

Answer: D

Explanation:
Explanation
Types of privacy program metrics include business enablement metrics, data enhancement metrics, and commercial metrics. Business enablement metrics measure the effectiveness of the privacy program in enabling the business to function without compromising privacy. Data enhancement metrics measure the effectiveness of the privacy program in enhancing data protection, such as through data minimization, access controls, and data security. Commercial metrics measure the effectiveness of the privacy program in creating value, such as through the development of new products, services, and customer experiences.
Privacy program metrics are used to assess the effectiveness of a privacy program and measure its progress.
These metrics can include business enablement metrics, data enhancement metrics, and commercial metrics.
Value creation metrics, however, are not typically used as privacy program metrics.

NEW QUESTION # 161
Which of the following methods analyzes data collected based the scale and not the endpoint of the privacy program?

• A. Trend Analysis.
• B. The Privacy Maturity Model.
• C. Business Resiliency.
• D. Return on Investment.

Answer: B

NEW QUESTION # 162
A Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) are conducted during what phase of a System Development Life Cycle (SDLC)?

• A. Design.
• B. Deployment.
• C. Maintenance.
• D. Testing.

Answer: A

NEW QUESTION # 163
A systems audit uncovered a shared drive folder containing sensitive employee data with no access controls and therefore was available for all employees to view. What is the first step to mitigate further risks?

• A. Notify legal counsel of a privacy incident.
• B. Check access logs to see who accessed the folder.
• C. Restrict access to the folder.
• D. Notify all employees whose information was contained in the file.

Answer: C

Explanation:
The first step to mitigate further risks when a systems audit uncovers a shared drive folder containing sensitive employee data with no access controls is to restrict access to the folder. This can be done by implementing appropriate access controls, such as user authentication, role-based access, and permissions, to ensure that only authorized individuals can view and access the sensitive data.
Reference:
https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492158151.pdf
https://www.itgovernance.co.uk/blog/5-reasons-why-employees-dont-report-data-breaches/
https://www.ncsc.gov.uk/guidance/report-cyber-incident

NEW QUESTION # 164
SCENARIO
Please use the following to answer the next QUESTION:
For 15 years, Albert has worked at Treasure Box - a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the
48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motivated Albert to be an agent of positive change.
He will soon interview for a newly advertised position, and during the interview, Albert plans on making executives aware of lapses in the company's privacy program. He feels certain he will be rewarded with a promotion for preventing negative consequences resulting from the company's outdated policies and procedures.
For example, Albert has learned about the AICPA (American Institute of Certified Public Accountans)/CICA (Canadian Institute of Chartered Accountants) Privacy Maturity Model (PMM). Albert thinks the model is a useful way to measure Treasure Box's ability to protect personal data. Albert has noticed that Treasure Box fails to meet the requirements of the highest level of maturity of this model; at his interview, Albert will pledge to assist the company with meeting this level in order to provide customers with the most rigorous security available.
Albert does want to show a positive outlook during his interview. He intends to praise the company's commitment to the security of customer and employee personal data against external threats. However, Albert worries about the high turnover rate within the company, particularly in the area of direct phone marketing. He sees many unfamiliar faces every day who are hired to do the marketing, and he often hears complaints in the lunch room regarding long hours and low pay, as well as what seems to be flagrant disregard for company procedures.
In addition, Treasure Box has had two recent security incidents. The company has responded to the incidents with internal audits and updates to security safeguards. However, profits still seem to be affected and anecdotal evidence indicates that many people still harbor mistrust. Albert wants to help the company recover.
He knows there is at least one incident the public in unaware of, although Albert does not know the details. He believes the company's insistence on keeping the incident a secret could be a further detriment to its reputation. One further way that Albert wants to help Treasure Box regain its stature is by creating a toll-free number for customers, as well as a more efficient procedure for responding to customer concerns by postal mail.
In addition to his suggestions for improvement, Albert believes that his knowledge of the company's recent business maneuvers will also impress the interviewers. For example, Albert is aware of the company's intention to acquire a medical supply company in the coming weeks.
With his forward thinking, Albert hopes to convince the managers who will be interviewing him that he is right for the job.
What is one important factor that Albert fails to consider regarding Treasure Box's response to their recent security incident?

• A. What the nature of the data is
• B. How data at the company is collected
• C. How long data at the company is kept
• D. Who has access to the data

Answer: A

Explanation:
Explanation
This answer is an important factor that Albert fails to consider, as it can affect the legal and ethical obligations and implications of the company's response to the security incident, as well as the potential impact and harm to the individuals whose data is involved. The nature of the data refers to the type, category, sensitivity and value of the data that is collected, processed and stored by the company, such as personal, financial, health, biometric or behavioral data. Depending on the nature of the data, the company may have different requirements or restrictions for notifying, reporting or disclosing the security incident to the relevant authorities, customers, partners or stakeholders, as well as for mitigating or compensating the effects of the incident. For example, if the data is considered sensitive or confidential, such as health or medical information, the company may have a higher duty of care and a stricter obligation to protect and secure the data, as well as to inform and assist the individuals whose data is compromised.

NEW QUESTION # 165
In a mobile app for purchasing and selling concert tickets, users are prompted to create a personalized profile prior to engaging in transactions. Once registered, users can securely access their profiles within the app, empowering them to manage and modify personal data as needed.
Which foundational Privacy by Design (PbD) principle does this feature follow?

• A. Respect for user privacy - keep it user-centric.
• B. Proactive, not reactive; preventative, not remedial.
• C. Full functionality - positive-sum, not zero-sum.
• D. End-to-end security - full life cycle protection.

Answer: A

Explanation:
Comprehensive and Detailed Explanation:
This scenario follows the Privacy by Design (PbD) principle of "Respect for User Privacy - Keep it User-Centric" because it gives users direct control over their personal data, allowing them to access, modify, and manage their information.
Option A (Proactive, not reactive; preventative, not remedial) emphasizes anticipating privacy risks before they arise, which is not the focus of this feature.
Option B (Full functionality - positive-sum, not zero-sum) refers to integrating privacy protections without sacrificing usability or security.
Option D (End-to-end security - full life cycle protection) relates to safeguarding data throughout its entire life cycle, which is not the main principle demonstrated in this scenario.
Reference:
CIPM Official Textbook, Module: Privacy by Design (PbD) and Privacy Engineering - Section on User Control and Transparency Principles.

NEW QUESTION # 166
SCENARIO
Please use the following to answer the next question:
As the director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development.
You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change.
Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place.
Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective.
You are left contemplating: What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success? What are the next action steps?
Which of the following would be most effectively used as a guide to a systems approach to implementing data protection?

• A. Data Life Cycle Management Standards
• B. International Organization for Standardization 27000 Series
• C. United Nations Privacy Agency Standards
• D. International Organization for Standardization 9000 Series

Answer: B

Explanation:
Explanation/Reference: https://www.itgovernance.co.uk/blog/what-is-the-iso-27000-series-of-standards

NEW QUESTION # 167
......

CIPM Exam Practice Questions prepared by IAPP Professionals: https://realexamcollection.examslabs.com/IAPP/Certified-Information-Privacy-Manager/best-CIPM-exam-dumps.html