CIPM Exam Flashcards |90 Questions with 100% Correct Answers, Exams of Company Secretarial Practice

Download CIPM Exam Flashcards |90 Questions with 100% Correct Answers and more Exams Company Secretarial Practice in PDF only on Docsity!

CIPM Exam Flashcards |90 Questions with 100%

Correct Answers

1. Which of the following is not a metric an organization would use? - ✔️✔️ Minimize security threats
2. Which of the following is least likely a goal of an organization's privacy program? - ✔️✔️ Hiring a privacy officer or manager
3. In which of the following ways can internal audit most likely help a privacy program? - ✔️✔️ Providing consultancy services
4. What can be considered to be the essence of an organization's privacy notice communicated to the outside world? - ✔️✔️ A promise on handling
5. Which of the following is most true about privacy by design? - ✔️✔️ Results, partly, in compliance with the General Data Protection Regulation
6. Which of the following is the best description of an accountable organization? - ✔️✔️ An organization with the necessary policies and procedures
7. Which step is likely not part of a privacy program with the goal to protect an organization's brand? - ✔️✔️ Prevent phishing e-mails using the company logo from being sent
8. hat is "the authority aims to safeguard the balance between the right to privacy and other rights"? - ✔️✔️ A mission or vision
9. A manufacturing company has placed computers all around the manufacturing area to help machine operators to relax during their lunch break and check their e-mails or social media. The company is doing so in an attempt to stop the machine operators from being distracted by their phones during their work and all the dangers that come with being distracted in a manufacturing area.

10. All the computers are connected to both the intranet and the internet. This allows an internal news bulletin and all policies and procedures to be displayed easily. There are regular updates, for example on family events, updates of procedures, bonus-related information and news on the employee of the month.
11. In addition to involving employees by sharing company news with them, all procedures are on the intranet. Anything from safe work practice guidelines to social media guidelines can be found on the intranet.
12. To use the computer, no login is needed. All computers are configured to be accessible to anyone, with ease. A downside of this is a shared hard-drive, and the older employees do not know that whatever they open on the computer is stored (temporarily).
13. In the scenario provided, where is the organization on the Privacy Maturity Model? - ✔️✔️ Managed
14. A manufacturing company has placed computers all around the manufacturing area to help machine operators to relax during their lunch break and check their e-mails or social media. The company is doing so in an attempt to stop the machine operators from being distracted by their phones during their work and all the dangers that come with being distracted in a manufacturing area.
15. All the computers are connected to both the intranet and the internet. This allows an internal news bulletin and all policies and procedures to be displayed easily. There are regular updates, for example on family events, updates of procedures, bonus-related information and news on the employee of the month.
16. In addition to involving employees by sharing company news with them, all procedures are on the intranet. Anything from safe work practice guidelines to social media guidelines can be found on the intranet.
17. To use the computer, no login is needed. All computers are configured to be accessible to anyone, with ease. A downside of this is a shared hard-drive, and the older employees do not know that whatever they open on the computer is stored (temporarily).
18. What is likely the biggest danger of a shared computer without user accounts? - ✔️✔️ Employees can access each other's personal data

19. A manufacturing company has placed computers all around the manufacturing area to help machine operators to relax during their lunch break and check their e-mails or social media. The company is doing so in an attempt to stop the machine operators from being distracted by their phones during their work and all the dangers that come with being distracted in a manufacturing area.
20. All the computers are connected to both the intranet and the internet. This allows an internal news bulletin and all policies and procedures to be displayed easily. There are regular updates, for example on family events, updates of procedures, bonus-related information and news on the employee of the month.
21. In addition to involving employees by sharing company news with them, all procedures are on the intranet. Anything from safe work practice guidelines to social media guidelines can be found on the intranet.
22. To use the computer, no login is needed. All computers are configured to be accessible to anyone, with ease. A downside of this is a shared hard-drive, and the older employees do not know that whatever they open on the computer is stored (temporarily).
23. Given that the employees potentially see each other's data, a notice is visible on a piece of paper next to the computer. What can this be called? - ✔️✔️ A just-in-time notice
24. How can you best describe metadata? - ✔️✔️ Information about data
25. Which of the following countries is least likely or latest to implement a comprehensive privacy law? - ✔️✔️ The United States
26. A group of petrochemical companies set up guidelines and audit each other on its compliance and individual companies report their findings to the authorities if they find a law broken, what is this most likely? - ✔️✔️ Self-regulation
27. How can a privacy standard that an organization uses be most appropriately described?
    • ✔️✔️ An approach to getting the organization to handle personal information correctly
28. A company is subject to a certain law and assigned employees responsibility for compliance and developed Excel sheets for monitoring and reporting. What could this be called? - ✔️✔️ A framework

29. Which type of organization has loose policies and managers that control small groups of employees? - ✔️✔️ Decentralized
30. When is a data protection Officer not necessarily required in the European Union? - ✔️✔️ When processing the data of 10 000 employees
31. A popular music venue hosts an event at least twice a week. It sells a certain amount of tickets for each event, so the number of people that can enter is limited. At the events photographs are taken, which is indicated at the entrance of the venue (after the ticket check).
32. One day, an angry visitor shows up, demanding to speak to the manager. It turned out his wife saw him on the photos that were published on the internet, and he had told her that he was working overtime whilst instead he went to see his favorite band.
33. The manager assured the visitor that they have every right to take photos and publish them, as it is their venue and there was a sign before entering, so the visitor could have known and could have chosen to leave. In return the visitor responds that he did not see the sign, and when checking the sign he notices that there is no warning that the photos will be published on the internet.
34. When should the photo notice ideally have been provided? - ✔️✔️ Before the purchase of the ticket
35. A popular music venue hosts an event at least twice a week. It sells a certain amount of tickets for each event, so the number of people that can enter is limited. At the events photographs are taken, which is indicated at the entrance of the venue (after the ticket check).
36. One day, an angry visitor shows up, demanding to speak to the manager. It turned out his wife saw him on the photos that were published on the internet, and he had told her that he was working overtime whilst instead he went to see his favorite band.
37. The manager assured the visitor that they have every right to take photos and publish them, as it is their venue and there was a sign before entering, so the visitor could have known and could have chosen to leave. In return the visitor responds that he did not see

the sign, and when checking the sign he notices that there is no warning that the photos will be published on the internet.

38. In the European Union, if the processing of the photo was indeed illegal, what could the data subject have done? - ✔️✔️ Sue the company for damages
39. A popular music venue hosts an event at least twice a week. It sells a certain amount of tickets for each event, so the number of people that can enter is limited. At the events photographs are taken, which is indicated at the entrance of the venue (after the ticket check).
40. One day, an angry visitor shows up, demanding to speak to the manager. It turned out his wife saw him on the photos that were published on the internet, and he had told her that he was working overtime whilst instead he went to see his favorite band.
41. The manager assured the visitor that they have every right to take photos and publish them, as it is their venue and there was a sign before entering, so the visitor could have known and could have chosen to leave. In return the visitor responds that he did not see the sign, and when checking the sign he notices that there is no warning that the photos will be published on the internet.
42. If the photographer is an external party, what would the photographer most likely be in this context? - ✔️✔️ A data processor
43. Which of the following is not an example of self-regulation? - ✔️✔️ Binding Corporate Rules
44. When designing business processes, what is the most elaborate aspect to take into account? - ✔️✔️ Consent
45. Which of the following is not a country with its regulatory authority? - ✔️✔️ Japan - Personal Information Protection Agency
46. What is the most likely reason for an organization to perform a data assessment? - ✔️✔️ To determine how the organization needs to handle the data

47. Which of the following is most likely not an element of a data inventory? - ✔️✔️ The requirement of contacting the Data Protection Authority in case of a data breach
48. Once a data inventory has finished, how would you most likely use the results? - ✔️✔️ Determine privacy priorities
49. Why can multiple departments most likely be involved in the process of creating a data inventory? - ✔️✔️ Because processes run through the entire organization
50. Which of the following is most likely to trigger the need to update the data inventory? - ✔️✔️ A change in the organization
51. What is most likely the biggest benefit for an organization of buying an online data inventory software package? - ✔️✔️ Updates with law changes
52. When developing a process for handling data breaches, which of the following is least important? - ✔️✔️ The involvement of the Chief Information Security Officer
53. Which of the following is most likely assigned to the Internal Audit department? - ✔️✔️ Privacy assessments
54. When knowing there is a process that requires an in-depth risk assessment, which of the following is least advisable? - ✔️✔️ An express Privacy Impact Assessment
55. Which of the following contains a set of guidelines for Privacy Impact Assessments? - ✔️✔️ ISO 29134
56. Which of the following is most important for an organization in order to show compliance with the General Data Protection Regulation? - ✔️✔️ Data Protection Impact Assessments
57. What is not the goal of a security control? - ✔️✔️ Administer

58. What would be the most likely reason for an organization to audit a vendor that performs processing on its request? - ✔️✔️ To take responsibility for outsourcing
59. When designing the process of obtaining consent, which of the following is least important? - ✔️✔️ To verify whether an alternative legal basis can be relied on
60. What is the best description of a processor? - ✔️✔️ An organization acting only as instructed by another organization
61. What is the biggest weakness of a Data Protection Impact Assessment? - ✔️✔️ It is subjective
62. Which is most true about an organization's privacy policy? - ✔️✔️ A privacy policy provides guidance for decisions
63. Which of the following is least likely required of an organization? - ✔️✔️ Regulate
64. After or during a data breach, what will you most likely need the marketing department for? - ✔️✔️ Sending out a mailing
65. What is something communicated by an organization to people about the organization's privacy practices? - ✔️✔️ A privacy notice
66. What is an acceptable use policy? - ✔️✔️ Specifies how people should behave on a network
67. Who is best to sign an organization's cloud computing agreements (if available)? - ✔️✔️ The Chief Information Officer
68. Which of the following would most likely be considered a data subject? - ✔️✔️ A person linked to data
69. If not responding quickly enough to a data subject's inquiry, which is not a likely consequence? - ✔️✔️ A data breach

70. Which privacy notice is most inappropriate under the General Data Protection Regulation? - ✔️✔️ A one-click 20 page PDF
71. What is an advantage of communicating an organization's privacy practices through a layered privacy notice? - ✔️✔️ Receiving relevant information only
72. What would be the least inappropriate use of a just-in-time notice? - ✔️✔️ Asking to access the location of your phone before starting your navigator
73. What is the most likely risk when deleting data too early? - ✔️✔️ Not complying with a legal requirement
74. Which of the following regulates the use of icons on websites and mobile screens? - ✔️✔️ The Digital Advertising Alliance
75. What is the difference between express and implicit consent? - ✔️✔️ Opt-in versus opt-out
76. Of the following, which is a big reason privacy laws needed to address privacy notices? - ✔️✔️ They have become lengthy and complex
77. What is most important to do, if possible, when further processing personal data beyond the scope of collection? - ✔️✔️ Aggregate to an appropriate level
78. When sending e-mails to data subjects, what can most likely cause an issue? - ✔️✔️ Improper encryption
79. When setting up an automated mailing system, which is likely most important? - ✔️✔️ Ensuring the commercial message is not unsolicited
80. Which US state was the first to require a conspicuously posted privacy notice? - ✔️✔️ California

81. What is important to do before providing someone access to their data? - ✔️✔️ Verifying their identity
82. What will companies in the public eye relying on data most likely realize at some point? - ✔️✔️ Customer trust is needed
83. When someone wants the data an organization processes of him/her corrected, what is the most likely point to pay attention to? - ✔️✔️ The connection of data elements and locations
84. Why is it important to recognize an Article 15 General Data Protection Regulation request when someone sends a complaint to your organization? - ✔️✔️ Because of the legal deadline
85. In the case of the data breach at Uber in 2016, how did Uber attempt to solve the situation? - ✔️✔️ Pay hackers
86. An internet reseller buys up cheap products and sells them for a slightly higher price. The company has a high turnover, and business is going well. There are only three employees working for the company, which is all that is needed as most is automatically shipped from a third party warehouse, with an online order that triggers an automated process.
87. Since the company is small, it does not standardize its work practices. Each employee has its own way of getting things done, and if needed they will ask the boss, who is generally in the same office and happy to assist.
88. One day, the server where all orders are stored is without password protection due to an accidental password reset. The cloud provider calls the company's boss to ask why they performed the reset, and after finding out that it was an accident, offers to check whether any external party has accessed the company's data in the hours it was freely accessible. This offer is refused, as the boss of the company regards the data not to be sensitive, as it only concerns customer orders.
89. In the scenario provided, where is the organization on the Privacy Maturity Model? - ✔️✔️ Ad hoc

90. An internet reseller buys up cheap products and sells them for a slightly higher price. The company has a high turnover, and business is going well. There are only three employees working for the company, which is all that is needed as most is automatically shipped from a third party warehouse, with an online order that triggers an automated process.
91. Since the company is small, it does not standardize its work practices. Each employee has its own way of getting things done, and if needed they will ask the boss, who is generally in the same office and happy to assist.
92. One day, the server where all orders are stored is without password protection due to an accidental password reset. The cloud provider calls the company's boss to ask why they performed the reset, and after finding out that it was an accident, offers to check whether any external party has accessed the company's data in the hours it was freely accessible. This offer is refused, as the boss of the company regards the data not to be sensitive, as it only concerns customer orders.
93. What should the company have done in light of the password reset? - ✔️✔️ The company should have accepted the offer in order to determine whether a data breach took place
94. An internet reseller buys up cheap products and sells them for a slightly higher price. The company has a high turnover, and business is going well. There are only three employees working for the company, which is all that is needed as most is automatically shipped from a third party warehouse, with an online order that triggers an automated process.
95. Since the company is small, it does not standardize its work practices. Each employee has its own way of getting things done, and if needed they will ask the boss, who is generally in the same office and happy to assist.
96. One day, the server where all orders are stored is without password protection due to an accidental password reset. The cloud provider calls the company's boss to ask why they performed the reset, and after finding out that it was an accident, offers to check whether any external party has accessed the company's data in the hours it was freely accessible. This offer is refused, as the boss of the company regards the data not to be sensitive, as it only concerns customer orders.

97. What would have been the case if an external person accessed the data? - ✔️✔️ It would likely have been a data breach
98. Which of the following is a likely consequence of not knowing how and what your organization is processing? - ✔️✔️ Unaware of consequences of mishandling
99. Development of your privacy awareness program can most likely be shared with which of the following? - ✔️✔️ The ethics and integrity department
100. Why do Chief Executive Officers not always give priority to privacy program implementation? - ✔️✔️ It does not generate revenue
101. Which of the following is the least common way to describe data about someone? - ✔️✔️ Private data
102. Where was Privacy by Design most likely developed? - ✔️✔️ Canada
103. A mobile phone application that will not function without an "unnecessary" connection to the internet at some point, is most likely not following which of the Privacy by Design principles? - ✔️✔️ End-to-end security
104. Which of the following is not Privacy by Design? - ✔️✔️ Being reactive
105. When during the design of a process you consider making use of a third-party, which would be most exemplary of Privacy by Design? - ✔️✔️ Determining whether a third-party is needed
106. When password protection is too strict, which of the following is most likely negatively impacted? - ✔️✔️ Availability
107. If you are looking for guidance on the security management system implementation, where would you look? - ✔️✔️ ISO/IEC 27003

108. When implementing a privacy program, what is important regarding access to files? - ✔️✔️ Roles should determine access
109. Where would you most likely not find guidance on data breach reporting in the United States? - ✔️✔️ Comprehensive federal privacy law
110. What would most likely help you get executives on your side regarding data breach prevention? - ✔️✔️ Showing the monetary impact of a data breach
111. Which of the following is the most common cause of a data breach? - ✔️✔️ Malicious actors
112. What is an informal readiness testing activity? - ✔️✔️ A tabletop exercise
113. What is likely the most important goal of metrics for an organization? - ✔️✔️ Inform the organization
114. A clinic has just hired you as a privacy program manager. The clinic specializes in surgeries that reverse decisions taken by parents, such as circumcision, which patients wish to reverse due to disagreement with the decisions their parents took regarding their child's body. Your team consists of the privacy officer, which is close to the age of retirement and has been assigned the privacy officer job because nobody else wanted to do it, and the security officer who will start the same day as you.
115. On your first day you familiarize yourself with the staff and the procedures that are in place. You do so in an effort to determine the best approach towards compliance and optimal privacy practices. The task proves somewhat difficult, as it seems every doctor in the clinic maintains different procedures. The procedures are written down though, so that helps, but there is no data on compliance with the policies.
116. Besides the need to identify how the current situation needs to be changed in order to be compliant with the privacy legislation, the management board has purchased software that automatically sends data about the patients' treatment to their health insurance provider, saving the administrative staff a lot of work.

117. In the provided scenario, where is the organization on the Privacy Maturity Model? - ✔️✔️ Repeatable
118. A clinic has just hired you as a privacy program manager. The clinic specializes in surgeries that reverse decisions taken by parents, such as circumcision, which patients wish to reverse due to disagreement with the decisions their parents took regarding their child's body. Your team consists of the privacy officer, which is close to the age of retirement and has been assigned the privacy officer job because nobody else wanted to do it, and the security officer who will start the same day as you.
119. On your first day you familiarize yourself with the staff and the procedures that are in place. You do so in an effort to determine the best approach towards compliance and optimal privacy practices. The task proves somewhat difficult, as it seems every doctor in the clinic maintains different procedures. The procedures are written down though, so that helps, but there is no data on compliance with the policies.
120. Besides the need to identify how the current situation needs to be changed in order to be compliant with the privacy legislation, the management board has purchased software that automatically sends data about the patients' treatment to their health insurance provider, saving the administrative staff a lot of work.
121. If a patient named Achmet comes in for a reverse-circumcision, which of the following elements would least likely be considered sensitive personal data in the European Union? - ✔️✔️ Bank account and insurance number
122. A clinic has just hired you as a privacy program manager. The clinic specializes in surgeries that reverse decisions taken by parents, such as circumcision, which patients wish to reverse due to disagreement with the decisions their parents took regarding their child's body. Your team consists of the privacy officer, which is close to the age of retirement and has been assigned the privacy officer job because nobody else wanted to do it, and the security officer who will start the same day as you.
123. On your first day you familiarize yourself with the staff and the procedures that are in place. You do so in an effort to determine the best approach towards compliance and optimal privacy practices. The task proves somewhat difficult, as it seems every doctor in the clinic maintains different procedures. The procedures are written down though, so that helps, but there is no data on compliance with the policies.

124. Besides the need to identify how the current situation needs to be changed in order to be compliant with the privacy legislation, the management board has purchased software that automatically sends data about the patients' treatment to their health insurance provider, saving the administrative staff a lot of work.
125. Since it is unclear whether the procedures that are already in place are effective and/or followed, what is the best approach to find out? - ✔️✔️ The use of metrics
126. What could be a possible advantage of implementing a market leader's privacy metrics software as opposed to your own? - ✔️✔️ Benchmarking with other organizations
127. What right is granted under the Federal Credit Reporting Act? - ✔️✔️ Access to all information a consumer reporting agency has on them
128. To whom/what should the Data Protection Officer report in an organization in the European Union? - ✔️✔️ The Chief Executive Officer 129.What is a regular, ad hoc or on demand process of checking control elements? - ✔️✔️ An audit