CIPM Exam Questions & Answers

Formosa International operates in 20 different countries including the United States and France.

What organizational approach would make complying with a number of different regulations easier?

A. Data mapping.

B. Fair Information Practices.

C. Rationalizing requirements.

D. Decentralized privacy management.

Incipia Corporation just trained the last of its 300 employees on their new privacy policies and procedures.

If Incipia wanted to analyze the effectiveness of the training over the next 6 months, which form of trend analysis should they use?

A. Cyclical.

B. Irregular.

C. Statistical.

D. Standard variance.

SCENARIO

Please use the following to answer the next question:

Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new

privacy officer. The company is based in California but thanks to some great publicity from a social media

influencer last year, the company has received an influx of sales from the EU and has set up a regional

office in Ireland to support this expansion. To become familiar with Ace Space's practices and assess what

her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the

work that they have been doing and their compliance efforts.

Penny's colleague in Marketing is excited by the new sales and the company's plans, but is also

concerned that Penny may curtail some of the growth opportunities he has planned. He tells her "I heard

someone in the breakroom talking about some new privacy laws but I really don't think it affects us. We're

just a small company. I mean we just sell accessories online, so what's the real risk?" He has also told her

that he works with a number of small companies that help him get projects completed in a hurry. "We've

got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push

through the payment. Reviewing the contracts takes time that we just don't have."

In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a

number of precautions to protect its website from malicious activity, it has not taken the same level of care

of its physical files or internal infrastructure. Penny's colleague in IT has told her that a former employee

lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their

customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague

that the IT team "didn't know what to do or who should do what. We hadn't been trained on it but we're a

small team though, so it worked out OK in the end." Penny is concerned that these issues will compromise

Ace Space's privacy and data protection.

Penny is aware that the company has solid plans to grow its international sales and will be working closely

with the CEO to give the organization a data "shake up". Her mission is to cultivate a strong privacy culture

within the company.

Penny has a meeting with Ace Space's CEO today and has been asked to give her first impressions and

an overview of her next steps.

To help Penny and her CEO with their objectives, what would be the most helpful approach to address her

IT concerns?

A. Roll out an encryption policy

B. Undertake a tabletop exercise

C. Ensure inventory of IT assets is maintained

D. Host a town hall discussion for all IT employees