CIPM FLASHCARDS QUESTIONS AND
ANSWERS ALL CORRECT
What is the best way to understand the location, use and importance of personal data
within an organization?
A. By analyzing the data inventory
B. By testing the security of data systems
C. By evaluating methods for collecting data
D. By interviewing employees tasked with data entry - Answer-By analyzing the data
inventory
Which is TRUE about the scope and authority of data protection oversight authorities?
A. The Office of the Privacy Commissioner (OPC) of Canada has the right to impose
financial sanctions on violators
B. All authority in the European Union rests with the Data Protection Commission (DPC)
C. No one agency officially oversees the enforcement of privacy regulations in the
United States
D. The Asia-Pacific Economic Cooperation (APEC) Privacy Frameworks require all
member nations to designate a national data protection authority - Answer-No one
agency officially oversees the enforcement of privacy regulations in the United States
(There is CCPA (CA), HIPPA (US), and FTC (US) that relate to privacy via sectoral laws
for specific aspects of privacy, but nothing spans entire US for privacy law)
What is the function of the privacy operational life cycle?
A. It establishes initial plans for privacy protection and implementation
B. It allows the organization to respond to ever-changing privacy demands
C. It ensures that outdated privacy policies are retired on a set schedule
D. It allows privacy policies to mature to a fixed form - Answer-It allows the organization
to respond to ever-changing privacy demands
,Which is the best way to view an organization's privacy framework?
A. As an industry benchmark that can apply to many organizations
B. As a fixed structure that directs changes in the organization
C. As an aspirational goal that improves the organization
D. As a living structure that aligns to changes in the organization - Answer-As a fixed
structure that directs changes in the organization
An organization is establishing a mission statement for its privacy program. Which of the
following statements would be the best to use?
A. This privacy program encourages cross-organizational collaboration which will stop
all data breaches
B. Our organization was founded in 2054 to reduce the chance of a future disaster like
the one that occurred ten years ago. All individuals from our area of the country should
be concerned about a future disaster. However, with our privacyprogram, they should
not be concerned about the misuse of their information.
C. The goal of the privacy program is to protect the privacy of all individuals who
support our organization. To meet this goal, we must work to comply with all applicable
privacy laws.
D. In the next 20 years, our privacy program should be able to eliminate 80% of our
current breaches. To do this, everyone in our organization must complete our annual
privacy trainin - Answer-The goal of the privacy program is to protect the privacy of all
individuals who support our organization. To meet this goal, we must work to comply
with all applicable privacy laws.
(all of the others seem very-bad LOL)
What is one reason the European Union has enacted more comprehensive privacy laws
than the United States?
A. To ensure adequate enforcement of existing laws
B. To ensure there is adequate funding for enforcement
C. To allow separate industries to set privacy standards
D. To allow the free movement of data between member countries - Answer-To allow
the free movement of data between member countries
,What is the main function of the Asia-Pacific Economic Cooperation Privacy
Framework?
A. Enabling regional data transfers
B. Protecting data from parties outside the region
C. Establishing legal requirements for privacy protection in the region
D. Marketing privacy protection technologies developed in the region - Answer-Enabling
regional data transfers
In a sample metric template, what does "target" mean?
A. The suggested volume of data to collect
B. The percentage of completion
C. The threshold for a satisfactory rating
D. The frequency at which the data is sampled - Answer-The suggested volume of data
to collect
Under which circumstances would people who work in human resources be considered
a secondary audience for privacy metrics?
A. They do not receive training on privacy issues
B. They do not interface with the financial office
C. They do not have privacy policy as their main task
D. They do not have frequent interactions with the public - Answer-They do not have
privacy policy as their main task
A. What are you doing if you succumb to "overgeneralization" when analyzing data from metrics
Using data that is too broad to capture specific meanings
B. Possessing too many types of data to perform a valid analysis
C. Using limited data in an attempt to support broad conclusions
D. Trying to use several measurements to gauge one aspect of a program - Answer-
Using limited data in an attempt to support broad conclusions
, (this one is tough, but consider that all the other examples go from wide to narrow, and
this is the only choice that goes from narrow to wide, which correlates with the definition
for overgeneralization)
All of the following changes will likely trigger a data inventory update EXCEPT?
A. Outsourcing the Customer Relationship Management (CRM) function
B. Acquisition of a new subsidiary
C. Onboarding of a new vendor
D. Passage of new a privacy regulation - Answer-Passage of new a privacy regulation
(this is the only external choice where all three others are internal)
What is one obligation that the General Data Protection Regulation (GDPR) imposes on
data processors?
A. To honor all data access requests from data subjects
B. To inform data subjects about the identity and contact details of the controller
C. To implement appropriate technical and organizational measures that ensure an
appropriate level of security
D. To carry out data protection impact assessments in cases where processing is likely
to result in high risk to the rights and freedoms of individuals - Answer-To implement
appropriate technical and organizational measures that ensure an appropriate level of
security
ANSWERS ALL CORRECT
What is the best way to understand the location, use and importance of personal data
within an organization?
A. By analyzing the data inventory
B. By testing the security of data systems
C. By evaluating methods for collecting data
D. By interviewing employees tasked with data entry - Answer-By analyzing the data
inventory
Which is TRUE about the scope and authority of data protection oversight authorities?
A. The Office of the Privacy Commissioner (OPC) of Canada has the right to impose
financial sanctions on violators
B. All authority in the European Union rests with the Data Protection Commission (DPC)
C. No one agency officially oversees the enforcement of privacy regulations in the
United States
D. The Asia-Pacific Economic Cooperation (APEC) Privacy Frameworks require all
member nations to designate a national data protection authority - Answer-No one
agency officially oversees the enforcement of privacy regulations in the United States
(There is CCPA (CA), HIPPA (US), and FTC (US) that relate to privacy via sectoral laws
for specific aspects of privacy, but nothing spans entire US for privacy law)
What is the function of the privacy operational life cycle?
A. It establishes initial plans for privacy protection and implementation
B. It allows the organization to respond to ever-changing privacy demands
C. It ensures that outdated privacy policies are retired on a set schedule
D. It allows privacy policies to mature to a fixed form - Answer-It allows the organization
to respond to ever-changing privacy demands
,Which is the best way to view an organization's privacy framework?
A. As an industry benchmark that can apply to many organizations
B. As a fixed structure that directs changes in the organization
C. As an aspirational goal that improves the organization
D. As a living structure that aligns to changes in the organization - Answer-As a fixed
structure that directs changes in the organization
An organization is establishing a mission statement for its privacy program. Which of the
following statements would be the best to use?
A. This privacy program encourages cross-organizational collaboration which will stop
all data breaches
B. Our organization was founded in 2054 to reduce the chance of a future disaster like
the one that occurred ten years ago. All individuals from our area of the country should
be concerned about a future disaster. However, with our privacyprogram, they should
not be concerned about the misuse of their information.
C. The goal of the privacy program is to protect the privacy of all individuals who
support our organization. To meet this goal, we must work to comply with all applicable
privacy laws.
D. In the next 20 years, our privacy program should be able to eliminate 80% of our
current breaches. To do this, everyone in our organization must complete our annual
privacy trainin - Answer-The goal of the privacy program is to protect the privacy of all
individuals who support our organization. To meet this goal, we must work to comply
with all applicable privacy laws.
(all of the others seem very-bad LOL)
What is one reason the European Union has enacted more comprehensive privacy laws
than the United States?
A. To ensure adequate enforcement of existing laws
B. To ensure there is adequate funding for enforcement
C. To allow separate industries to set privacy standards
D. To allow the free movement of data between member countries - Answer-To allow
the free movement of data between member countries
,What is the main function of the Asia-Pacific Economic Cooperation Privacy
Framework?
A. Enabling regional data transfers
B. Protecting data from parties outside the region
C. Establishing legal requirements for privacy protection in the region
D. Marketing privacy protection technologies developed in the region - Answer-Enabling
regional data transfers
In a sample metric template, what does "target" mean?
A. The suggested volume of data to collect
B. The percentage of completion
C. The threshold for a satisfactory rating
D. The frequency at which the data is sampled - Answer-The suggested volume of data
to collect
Under which circumstances would people who work in human resources be considered
a secondary audience for privacy metrics?
A. They do not receive training on privacy issues
B. They do not interface with the financial office
C. They do not have privacy policy as their main task
D. They do not have frequent interactions with the public - Answer-They do not have
privacy policy as their main task
A. What are you doing if you succumb to "overgeneralization" when analyzing data from metrics
Using data that is too broad to capture specific meanings
B. Possessing too many types of data to perform a valid analysis
C. Using limited data in an attempt to support broad conclusions
D. Trying to use several measurements to gauge one aspect of a program - Answer-
Using limited data in an attempt to support broad conclusions
, (this one is tough, but consider that all the other examples go from wide to narrow, and
this is the only choice that goes from narrow to wide, which correlates with the definition
for overgeneralization)
All of the following changes will likely trigger a data inventory update EXCEPT?
A. Outsourcing the Customer Relationship Management (CRM) function
B. Acquisition of a new subsidiary
C. Onboarding of a new vendor
D. Passage of new a privacy regulation - Answer-Passage of new a privacy regulation
(this is the only external choice where all three others are internal)
What is one obligation that the General Data Protection Regulation (GDPR) imposes on
data processors?
A. To honor all data access requests from data subjects
B. To inform data subjects about the identity and contact details of the controller
C. To implement appropriate technical and organizational measures that ensure an
appropriate level of security
D. To carry out data protection impact assessments in cases where processing is likely
to result in high risk to the rights and freedoms of individuals - Answer-To implement
appropriate technical and organizational measures that ensure an appropriate level of
security
