CIPP/US Sample Questions with Verified Correct Answers

Which is the best description of the U.S. legal concept of "preemption"? A. States are prevented by federal law from passing any laws that regulate financial privacy. B. The superior government has the right to supersede the lesser governments' laws. C. State laws supersede federal law in certain areas, such as marketing. D. The EU General Data Protection Regulation (GDPR) takes precedence over U.S. law, federal or state. - Answer-B. The superior government has the right to supersede the lesser governments' laws. What is one reason the FTC publicly posts consent decrees on its website? A. To announce the amount of civil penalties the FTC levies. B. To prove that companies have complied with FTC rulings. C. To punish companies that violate FTC rulings. D. To provide guidance about what practices the FTC finds inappropriate. - Answer-D. To provide guidance about what practices the FTC finds inappropriate. A large hospital has contracted with a cloud provider to hose electronic patient medical records for access by doctors and other healthcare staff during routine care. The hospital has entered into a business associate agreement with the cloud provider. The cloud provider recently discovered a breach in their security and an unauthorized user accessed and downloaded the electronic medical records of 300 patients. Who does the cloud provider need to notify about the breach? A. The individuals affected by the breach. B. The hospital. C. Health and Human Services (HHS). D. The Federal Bureau of Investigation (FBI). - Answer-B. The hospital. Each of the following are considered acceptable reasons for sharing records of U.S. employees with third parties without containing the consent of the employees EXCEPT: A. Test marketing the company's new products. B. Determining legal standing or citizen status. C. Planning for employee retirement. D. Underwriting group insurance policies. - Answer-A. Test marketing the company's new products.