CIPM Scenario Practice 2023

SCENARIO ALBERT & TREASURE BOX - correct answers ANSWER THESE CARDS IN ORDER AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS SCENARIO ALBERT & TREASURE BOX For 15 years, Albert has worked at Treasure Box - a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motivated Albert to be an agent of positive change. He will soon interview for a newly advertised position, and during the interview, Albert plans on making executives aware of lapses in the company's privacy program. He feels certain he will be rewarded with a promotion for preventing negative consequences resulting from the company's outdated policies and procedures. For example, Albert has learned about the AICPA (American Institute of Certified Public Accountans)/CICA (Canadian Institute of Chartered Accountants) Privacy Maturity Model (PMM). Albert thinks the model is a useful way to measure Treasure Box's ability to protect personal data. Albert has noticed that Treasure Box fails to meet the requirements of the highest level of maturity of this model; at his interview, Albert will pledge to assist the company with meeting this level in order to provide customers with the most rigorous security available. Albert does want to show a positive outlook during his interview. He intends to praise the company's commitment to the security of customer and employee personal data against external threats. However, Albert worries about the high turnover rate within the company, particularly in the area of direct phone marketing. He sees many unfamiliar faces every day who are hired to do the marketing, and he often hears complaints in the lunch room regarding long hours and low pay, as well as what seems to be flagrant disregard for company procedures. In addition, Treasure Box has had two recent security incidents. The company has responded to the incidents with internal audits and updates to security safeguards. However, profits still seem to be affected and anecdotal evidence indicates that many people still harbor mistrust. Albert wants to help the company recover. He knows there is at least one incident the public in unaware of, although Albert does not know the details. He believes the company's insistence on keeping the incident a secret could be a further detriment to its reputation. One further way that Albert wants to help Treasure Box regain its stature is by creating a toll-free number for customers, as well as a more efficient procedure for responding to customer concerns by postal mail. In addition to his suggestions for improvement, Albert believes that his knowledge of the company's recent business maneuvers will also impress the interviewers. For example, Albert is aware of the company's intention to acquire a medical supply company in the coming weeks. With his forward thinking, Albert hopes to convince the managers who will be interviewing him that he is right for the job. - correct answers USE THIS PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE NEXT SCENARIO IS LISTED In consideration of the company's new initiatives, which of the following laws and regulations would be most appropriate for Albert to mention at the interview as a priority concern for the privacy team? A. Gramm-Leach-Bliley Act (GLBA) B. The General Data Protection Regulation (GDPR) C. The Telephone Consumer Protection Act (TCPA) D. Health Insurance Portability and Accountability Act (HIPAA) - correct answers Health Insurance Portability and Accountability Act (HIPAA) (This is important because they are considering acquiring a med co. in the US) On which of the following topics does Albert most likely need additional knowledge? A. The role of privacy in retail companies B. The necessary maturity level of privacy programs C. The possibility of delegating responsibilities related to privacy D. The requirements for a managerial position with privacy protection duties - correct answers The requirements for a managerial position with privacy protection duties Based on Albert's observations, executive leadership should most likely pay closer attention to what? A. Awareness campaigns with confusing information B. Obsolete data processing systems C. Outdated security frameworks D. Potential in-house threats - correct answers Outdated security frameworks Based on Albert's observations regarding recent security incidents, which of the following should he suggest as a priority for Treasure Box? A. Appointing an internal ombudsman to address employee complaints regarding hours and pay. B. Using a third-party auditor to address privacy protection issues not recognized by the prior internal audits. C. Working with the Human Resources department to make screening procedures for potential employees more rigorous. D. Evaluating the company's ability to handle personal health information if the plan to acquire the medical supply company goes forward - correct answers Using a third-party auditor to address privacy protection issues not recognized by the prior internal audits. What is one important factor that Albert fails to consider regarding Treasure Box's response to their recent security incident? A. Who has access to the data B. What the nature of the data is C. How data at the company is collected D. How long data at the company is kept - correct answers What the nature of the data is The company may start to earn back the trust of its customer base by following Albert's suggestion regarding which handling procedure? A. Access B. Correction C. Escalation D. Data Integrity - correct answers Access SCENARIO: PENNY & ACE SPACE - correct answers ANSWER THESE CARDS IN ORDER AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS SCENARIO: PENNY & ACE SPACE Please use the following to answer the next question: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space's practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts. Penny's colleague in Marketing is excited by the new sales and the company's plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her "I heard someone in the breakroom talking about some new privacy laws but I really don't think it affects us. We're just a small company. I mean we just sell accessories online, so what's the real risk?" He has also told her that he works with a number of small companies that help him get projects completed in a hurry. "We've got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don't have." In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny's colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team "didn't know what to do or who should do what. We hadn't been trained on it but we're a small team though, so it worked out OK in the end." Penny is concerned that these issues will compromise Ace Space's privacy and data protection. Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data "shake up". Her mission is to cultivate a strong privacy culture within the company. Penny has a meeting with Ace Space's CEO today and has been asked to give her first impressions and an overview of her next steps. - correct answers USE THIS PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE NEXT SCENARIO IS LISTED To help Penny and her CEO with their objectives, what would be the most helpful approach to address her IT concerns? A. Roll out an encryption policy B. Undertake a tabletop exercise C. Ensure inventory of IT assets is maintained D. Host a town hall discussion for all IT employees - correct answers Ensure inventory of IT assets is maintained To establish the current baseline of Ace Space's privacy maturity, Penny should consider all of the following factors EXCEPT? A. Ace Space's documented procedures B. Ace Space's employee training program C. Ace Space's vendor engagement protocols D. Ace Space's content sharing practices on social media - correct answers Ace Space's content sharing practices on social media What is the best way for Penny to understand the location, classification and processing purpose of the personal data Ace Space has? A. Analyze the data inventory to map data flows B. Audit all vendors' privacy practices and safeguards C. Conduct a Privacy Impact Assessment for the company D. Review all cloud contracts to identify the location of data servers used - correct answers Analyze the data inventory to map data flows What information will be LEAST crucial from a privacy perspective in Penny's review of vendor contracts? A. Audit rights B. Liability for a data breach C. Pricing for data security protections D. The data a vendor will have access to - correct answers Pricing for data security protections SCENARIO: CEO PAUL & HIS SON'S VENTURE - correct answers ANSWER THESE CARDS IN ORDER AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS SCENARIO: CEO PAUL & HIS SON CARLTON'S VENTURE: Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a privacy Consultant, to assess the company and report to both father and son. "Carlton won't listen to me," Paul says, "but he may pay attention to an expert." Gadgo's workplace is a clubhouse for innovation, with games, toys, snacks, espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company's procedures and technologies for data protection. It's a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don't want unnecessary measures that will only slow people down and clutter their thoughts." The meeting lasts until early evening. Upon leaving, you walk through the office. It looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A "cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night; others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!" - correct answers USE THIS PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE NEXT SCENARIO IS LISTED What would be the best kind of audit to recommend for Gadgo? A. A supplier audit B. An internal audit C. A third-party audit D. A self-certification - correct answers A third-party audit What phase in the Privacy Maturity Model (PMM) does Gadgo's privacy program best exhibit? A. Ad hoc B. Defined C. Repeatable D. Managed - correct answers Ad hoc SCENARIO: HENRY HOME FURNISHINGS AND THE NEW OWNER ANTON - correct answers ANSWER THESE CARDS IN ORDER AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS SCENARIO: HENRY HOME FURNISHINGS AND THE NEW OWNER ANTON Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry has always focused on production - not data processing - and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers. Anton knows that a single break-in could irrevocably damage the company's relationship with its loyal customers. He intends to set a goal of guaranteed zero loss of personal information. To this end, Anton originally planned to place restrictions on who was admitted to the physical premises of the company. However, Kenneth - his uncle's vice president and longtime confidante - wants to hold off on Anton's idea in favor of converting any paper records held at the company to electronic storage. Kenneth believes this process would only take one or two years. Anton likes this idea; he envisions a password-protected system that only he and Kenneth can access. Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job easier, but it will simplify the management of the stored data. The heads of subsidiaries like the art gallery and kitchenware store down the street will be responsible for their own information management. Then, any unneeded subsidiary data still in Anton's possession can be destroyed within the next few years. After learning of a recent security incident, Anton realizes that another crucial step will be notifying customers. Kenneth insists that two lost hard drives in question are not cause for concern; all of the data was encrypted and not sensitive in nature. Anton does not want to take any chances, however. He intends on sending notice letters to all employees and customers to be safe. Anton must also check for compliance with all legislative, regulatory, and market requirements related to privacy protection. Kenneth oversaw the development of the company's online presence about ten years ago, but Anton is not confident about his understanding of recent online marketing laws. Anton is assigning another trusted employee with a law background the task of the compliance assessment. After a thorough analysis, Anton knows the company should be safe for another five years, at which time he can order another check. Documentation of this analysis will show auditors due diligence. Anton has started down a long road toward improved management of the company, but he knows the effort is worth it. Anton wants his uncle's legacy to continue for many years to come. - correct answers USE THIS PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE NEXT SCENARIO IS LISTED To improve the facility's system of data security, Anton should consider following through with the plan for which of the following? A. Customer communication B. Employee access to electronic storage C. Employee advisement regarding legal matters D. Controlled access at the company headquarters - correct answers Controlled access at the company headquarters