1 | Page
CIPM PRATICE TEST 2 (1-30) Questions
and Answers
In addition to regulatory requirements and business practices,
what important factors must a global privacy strategy consider?
A. Monetary exchange
B. Geographic features
C. Political history
D. Cultural norms
Ans: Cultural norms
How are individual program needs and specific organizational
goals identified in privacy framework development?
A. By employing metrics to align privacy protection with objectives
B. Through conversations with the privacy team
C. By employing an industry-standard needs analysis
D. Through creation of the business case
Ans: By employing metrics to align privacy protection with objectives
In privacy protection, what is a "covered entity"?
A. Personal data collected by a privacy organization
B. An organization subject to the privacy provisions of HIPAA
C. A privacy office or team fully responsible for protecting
personal information
D. Hidden gaps in privacy protection that may go unnoticed
without expert analysis
Ans: An organization subject to the privacy provisions of HIPAA
Which of the following is an example of Privacy by Design (PbD)?
A. A company hires a professional to structure a privacy program
that anticipates the increasing demands of new laws.
B. The human resources group develops a training program from
employees to become certified in privacy policy.
© 2025 All rights reserved
, 2 | Page
C. A labor union insists that the details of employers' data
protection methods be documented in a new contract.
D. The information technology group uses privacy considerations
to inform the development of new networking software.
Ans: The information technology group uses privacy considerations to
inform the development of new networking software.
What is the key factor that lays the foundation for all other
elements of a privacy program?
A. The applicable privacy regulations
B. The structure of a privacy team
C. A privacy mission statement
D. A responsible internal stakeholder
Ans: A privacy mission statement
Under the General Data Protection Regulation (GDPR), which of
the following situations would LEAST likely require a controller to
notify a data subject?
A. A hacker publishes usernames, phone numbers and purchase
history online after a cyber-attack
B. An encrypted USB key with sensitive personal data is stolen
C. Personal data of a group of individuals is erroneously sent to
the wrong mailing list
D. A direct marketing email is sent with recipients visible in the
'cc' field
Ans: An encrypted USB key with sensitive personal data is stolen
SCENARIO
Please use the following to answer the next question:
Martin Briseno is the director of human resources at the Canyon
City location of the U.S. hotel chain Pacific Suites. In 1998, Briseno
decided to change the hotel's on-the-job mentoring model to a
standardized training program for employees who were
progressing from line positions into
supervisory positions. He developed a curriculum comprising a
series of lessons, scenarios, and
© 2025 All rights reserved
CIPM PRATICE TEST 2 (1-30) Questions
and Answers
In addition to regulatory requirements and business practices,
what important factors must a global privacy strategy consider?
A. Monetary exchange
B. Geographic features
C. Political history
D. Cultural norms
Ans: Cultural norms
How are individual program needs and specific organizational
goals identified in privacy framework development?
A. By employing metrics to align privacy protection with objectives
B. Through conversations with the privacy team
C. By employing an industry-standard needs analysis
D. Through creation of the business case
Ans: By employing metrics to align privacy protection with objectives
In privacy protection, what is a "covered entity"?
A. Personal data collected by a privacy organization
B. An organization subject to the privacy provisions of HIPAA
C. A privacy office or team fully responsible for protecting
personal information
D. Hidden gaps in privacy protection that may go unnoticed
without expert analysis
Ans: An organization subject to the privacy provisions of HIPAA
Which of the following is an example of Privacy by Design (PbD)?
A. A company hires a professional to structure a privacy program
that anticipates the increasing demands of new laws.
B. The human resources group develops a training program from
employees to become certified in privacy policy.
© 2025 All rights reserved
, 2 | Page
C. A labor union insists that the details of employers' data
protection methods be documented in a new contract.
D. The information technology group uses privacy considerations
to inform the development of new networking software.
Ans: The information technology group uses privacy considerations to
inform the development of new networking software.
What is the key factor that lays the foundation for all other
elements of a privacy program?
A. The applicable privacy regulations
B. The structure of a privacy team
C. A privacy mission statement
D. A responsible internal stakeholder
Ans: A privacy mission statement
Under the General Data Protection Regulation (GDPR), which of
the following situations would LEAST likely require a controller to
notify a data subject?
A. A hacker publishes usernames, phone numbers and purchase
history online after a cyber-attack
B. An encrypted USB key with sensitive personal data is stolen
C. Personal data of a group of individuals is erroneously sent to
the wrong mailing list
D. A direct marketing email is sent with recipients visible in the
'cc' field
Ans: An encrypted USB key with sensitive personal data is stolen
SCENARIO
Please use the following to answer the next question:
Martin Briseno is the director of human resources at the Canyon
City location of the U.S. hotel chain Pacific Suites. In 1998, Briseno
decided to change the hotel's on-the-job mentoring model to a
standardized training program for employees who were
progressing from line positions into
supervisory positions. He developed a curriculum comprising a
series of lessons, scenarios, and
© 2025 All rights reserved
