1 | Page
CIPM Test - Chris B Questions and Answers
In addition to regulatory requirements and business practices,
what important factors must a global privacy strategy consider?
A. Monetary exchange
B. Geographic features
C. Political history
D.Cultural norms
Ans: Cultural norms
How are individual program needs and specific organizational
goals identified in privacy framework development?
A. By employing metrics to align privacy protection with objectives
B. Through conversations with the privacy team
C. By employing an industry-standard needs analysis
D. Through creation of the business case
Ans: By employing metrics to align privacy protection with objectives
In privacy protection, what is a "covered entity"?
A. Personal data collected by a privacy organization
B. An organization subject to the privacy provisions of HIPAA
C. A privacy office or team fully responsible for protecting
personal information
D. Hidden gaps in privacy protection that may go unnoticed
without expert analysis
Ans: . An organization subject to the privacy provisions of HIPAA
Which of the following is an example of Privacy by Design (PbD)?
A. A company hires a professional to structure a privacy program
that anticipates the increasing demands of new laws.
B. The human resources group develops a training program from
employees to become certified in privacy policy.
© 2025 All rights reserved
, 2 | Page
C. A labor union insists that the details of employers' data
protection methods be documented in a new contract.
D. The information technology group uses privacy considerations
to inform the development of new networking software.
Ans: The information technology group uses privacy considerations to
inform the development of new networking software.
What is the key factor that lays the foundation for all other
elements of a privacy program?
A. The applicable privacy regulations
B. The structure of a privacy team
C. A privacy mission statement
D. A responsible internal stakeholder
Ans: A privacy mission statement
SCENARIO
Please use the following to answer the next question:
Martin Briseno is the director of human resources at the Canyon
City location of the U.S. hotel chain Pacific Suites. In 1998, Briseno
decided to change the hotel's on-the-job mentoring model to a
standardized training program for employees who were
progressing from line positions into
supervisory positions. He developed a curriculum comprising a
series of lessons, scenarios, and
assessments, which was delivered in-person to small groups.
Interest in the training increased,
leading Briseno to work with corporate HR specialists and software
engineers to offer the program in an online format. The online
program saved the cost of a trainer and allowed participants to
work through the material at their own pace.
Upon hearing about the success of Briseno's program, Pacific
Suites corporate Vice President Maryanne Silva-Hayes expanded
the training and offered
© 2025 All rights reserved
, 3 | Page
Ans: 6. Minimizing the amount of harm to the affected individuals
7. Information would have been categorized and assigned a deadline for
destruction
8. Collecting too much information and keeping it for too long
9. As the parent company, it should have ensured its existing data access
and storage procedures were integrated into PHT's system.
10. Privacy by Design
Please use the following to answer the next question:
As the company's new chief executive officer, Thomas Goddard
wants to be known as a leader in data protection. Goddard
recently served as the chief financial officer of Hoopy.com, a
pioneer in online video viewing with millions of users around the
world. Unfortunately, Hoopy is infamous within privacy protection
circles for its ethically Questionable practices, including
unauthorized sales of personal data to marketers.
Hoopy also was the target of credit card data theft that made
headlines around the world, as at least two million credit card
numbers were thought to have been pilfered despite the
company's claims that "appropriate" data protection safeguards
were in place. The scandal affected the company's business as
competitors were quick to market an increased level of protection
while offering similar entertainment and media content. Within
three weeks after
© 2025 All rights reserved
CIPM Test - Chris B Questions and Answers
In addition to regulatory requirements and business practices,
what important factors must a global privacy strategy consider?
A. Monetary exchange
B. Geographic features
C. Political history
D.Cultural norms
Ans: Cultural norms
How are individual program needs and specific organizational
goals identified in privacy framework development?
A. By employing metrics to align privacy protection with objectives
B. Through conversations with the privacy team
C. By employing an industry-standard needs analysis
D. Through creation of the business case
Ans: By employing metrics to align privacy protection with objectives
In privacy protection, what is a "covered entity"?
A. Personal data collected by a privacy organization
B. An organization subject to the privacy provisions of HIPAA
C. A privacy office or team fully responsible for protecting
personal information
D. Hidden gaps in privacy protection that may go unnoticed
without expert analysis
Ans: . An organization subject to the privacy provisions of HIPAA
Which of the following is an example of Privacy by Design (PbD)?
A. A company hires a professional to structure a privacy program
that anticipates the increasing demands of new laws.
B. The human resources group develops a training program from
employees to become certified in privacy policy.
© 2025 All rights reserved
, 2 | Page
C. A labor union insists that the details of employers' data
protection methods be documented in a new contract.
D. The information technology group uses privacy considerations
to inform the development of new networking software.
Ans: The information technology group uses privacy considerations to
inform the development of new networking software.
What is the key factor that lays the foundation for all other
elements of a privacy program?
A. The applicable privacy regulations
B. The structure of a privacy team
C. A privacy mission statement
D. A responsible internal stakeholder
Ans: A privacy mission statement
SCENARIO
Please use the following to answer the next question:
Martin Briseno is the director of human resources at the Canyon
City location of the U.S. hotel chain Pacific Suites. In 1998, Briseno
decided to change the hotel's on-the-job mentoring model to a
standardized training program for employees who were
progressing from line positions into
supervisory positions. He developed a curriculum comprising a
series of lessons, scenarios, and
assessments, which was delivered in-person to small groups.
Interest in the training increased,
leading Briseno to work with corporate HR specialists and software
engineers to offer the program in an online format. The online
program saved the cost of a trainer and allowed participants to
work through the material at their own pace.
Upon hearing about the success of Briseno's program, Pacific
Suites corporate Vice President Maryanne Silva-Hayes expanded
the training and offered
© 2025 All rights reserved
, 3 | Page
Ans: 6. Minimizing the amount of harm to the affected individuals
7. Information would have been categorized and assigned a deadline for
destruction
8. Collecting too much information and keeping it for too long
9. As the parent company, it should have ensured its existing data access
and storage procedures were integrated into PHT's system.
10. Privacy by Design
Please use the following to answer the next question:
As the company's new chief executive officer, Thomas Goddard
wants to be known as a leader in data protection. Goddard
recently served as the chief financial officer of Hoopy.com, a
pioneer in online video viewing with millions of users around the
world. Unfortunately, Hoopy is infamous within privacy protection
circles for its ethically Questionable practices, including
unauthorized sales of personal data to marketers.
Hoopy also was the target of credit card data theft that made
headlines around the world, as at least two million credit card
numbers were thought to have been pilfered despite the
company's claims that "appropriate" data protection safeguards
were in place. The scandal affected the company's business as
competitors were quick to market an increased level of protection
while offering similar entertainment and media content. Within
three weeks after
© 2025 All rights reserved
