Free IAPP CIPM Exam Dumps Questions & Answers

With whom would it be best for a privacy professional in an organization to consult regarding Privacy- Enhancing Technologies (PETs)?

• A.  A specialist focused on AI.
• B.  An information technologist specializing in information privacy technology.
• C.  An independent privacy technology advocate.
• D.  An engineer who designs information security technology products.

What is least likely to be achieved by implementing a Data Lifecycle Management (DLM) program?

• A.  Ensuring data is kept for no longer than necessary.
• B.  Reducing storage costs.
• C.  Crafting policies which ensure minimal data is collected.
• D.  Increasing awareness of the importance of confidentiality.

SCENARIO
Please use the following to answer the next question
You were recently hired by InStyte Date Corp as a privacy manager to help InStyle Data Corp become compliant with a new data protection law The law mandates that businesses have reasonable and appropriate security measures in place to protect personal data. Violations of that mandate are heavily fined and the legislators have stated that they will aggressively pursue companies that don t comply with the new law You are paved with a security manager and tasked with reviewing InStyle Data Corp s current state and advising the business how it can meet the "reasonable and appropriate security" requirement InStyle Data Corp has grown rapidly and has not kept a data inventory or completed a data mapping InStyte Data Corp has also developed security-related policies ad hoc and many have never been implemented The various teams involved in the creation and testing of InStyle Data Corp s products experience significant turnover and do not have well defined roles There's little documentation addressing what personal data is processed by which product and for what purpose Work needs to begin on this project immediately so that InStyle Data Corp can become compliant by the time the law goes into effect. You and you partner discover that InStyle Data Corp regularly sends files containing sensitive personal data back to its customers through email sometimes using InStyle Data Corp employees personal email accounts. You also team that InStyle Data Corp s privacy and information security teams are not informed of new personal data flows, new products developed by InStyte Data Corp that process personal data, or updates to existing InStyle Data Corp products that may change what or how the personal data is processed until after the product or update has gone have.
Through a review of InStyle Date Corp's test and development environment logs, you discover InStyle Data Corp sometimes gives login credentials to any InStyle Data Corp employee or contractor who requests them.
The test environment only contains dummy data but the development environment contains personal data including Social Security Numbers, hearth ^formation and financial information All credentialed InStyle Data Corp employees and contractors have the ability to after and delete personal data in both environments regardless of their role or what project they are working on.
You and your partner provide a gap assessment citing the issues you spotted, along with recommended remedial actions and a method to measure implementation InStyle Data Corp implements all of the recommended security controls You review the processes roles, controls and measures taken to appropriately protect the personal data at every stop However, you realize there is no plan for monitoring and nothing in place addressing sanctions for violations of the updated policies and procedures InStyle Data Corp pushes back, stating they do not have the resources for such monitoring.
Having completed the gap assessment, you and your partner need to first undertake a thorough review of?

• A.  Data life cyde
• B.  Privacy Impact (PIA).
• C.  Security policies.
• D.  System development life cycle.

SCENARIO
Please use the following to answer the next QUESTION:
Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space's practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts.
Penny's colleague in Marketing is excited by the new sales and the company's plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her "I heard someone in the breakroom talking about some new privacy laws but I really don't think it affects us. We're just a small company. I mean we just sell accessories online, so what's the real risk?" He has also told her that he works with a number of small companies that help him get projects completed in a hurry. "We've got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don't have." In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny's colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team
"didn't know what to do or who should do what. We hadn't been trained on it but we're a small team though, so it worked out OK in the end." Penny is concerned that these issues will compromise Ace Space's privacy and data protection.
Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data "shake up". Her mission is to cultivate a strong privacy culture within the company.
Penny has a meeting with Ace Space's CEO today and has been asked to give her first impressions and an overview of her next steps.
What information will be LEAST crucial from a privacy perspective in Penny's review of vendor contracts?

• A.  Pricing for data security protections
• B.  Audit rights
• C.  The data a vendor will have access to
• D.  Liability for a data breach

If an organization maintains a separate ethics office, to whom would its officer typically report to in order to retain the greatest degree of independence?

• A.  The Chief Financial Officer.
• B.  The Board of Directors.
• C.  The Human Resources Director.
• D.  The organization's General Counsel.