IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 1:

  Which of the following BEST describes web service security conformance testing as it relates to web services security testing?

  A. Generally includes threat modeling, requirements risk analysis, and security modeling
  B. Focused on ensuring that the security functionally performed by a web service meets its stated requirements
  C. Ensure individual protocol implementations adhere to the relevant published standards
  D. Focused on the smallest unit of the web service application, apart from the rest of the application
  C. Ensure individual protocol implementations adhere to the relevant published standards

  ---

  Explanation

• Question 2:

  Exhibit:

  

  A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

  A. 100% service levels for B and C
  B. Customer B has higher service level
  C. Customer C has higher service level
  D. Customer B and C have same service level
  B. Customer B has higher service level

  ---

  Explanation

  

• Question 3:

  Which of the following are those of space and materials handling equipment?

  A. Capital costs
  B. Material costs
  C. Variance costs
  D. Equipment costs
  D. Equipment costs

  ---

  Explanation

  Space and materials handling equipment refers to physical tools and systems used to move, store, control, and protect materials-such as conveyors, forklifts, racks, etC: The associated costs for these fall under equipment costs, which cover: Purchase price Maintenance Depreciation Operating expenses

• Question 4:

  Which of the following BEST describes the purpose of black hat testing during an assessment?

  A. Assess systems without the knowledge of end-users.
  B. Focus on identifying vulnerabilities.
  C. Examine the damage or impact an adversary can cause.
  D. Determine the risk associated with unknown vulnerabilities.
  C. Examine the damage or impact an adversary can cause.

  ---

  Explanation

• Question 5:

  A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

  A. Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.
  B. Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.
  C. Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.
  D. Security-focused CM surpasses existing security requirements of the organization.
  B. Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

  ---

  Explanation

• Question 6:

  A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?

  A. System browsing
  B. Escalating privileges
  C. Gaining access
  D. Installing additional tools
  B. Escalating privileges

  ---

  Explanation

• Question 7:

  An organization identified a Distributed Denial-Of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

  A. Internet layer
  B. Transport layer
  C. Application layer
  D. Network layer
  A. Internet layer

  ---

  Explanation

• Question 8:

  Price negotiation is most appropriate when purchasing which of the following product categories?

  A. Commodities
  B. Standard products
  C. Items of small value
  D. Made-to-order (MTO) items
  D. Made-to-order (MTO) items

  ---

  Explanation

  Price negotiation is most appropriate for Made-to-Order (MTO) items because they are customized and not standardized, making pricing less transparent and more dependent on specific requirements, lead times, and production costs. This contrasts with commodities and standard products, which typically have market-based or catalog pricing.

• Question 9:

  A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?

  A. Carrying
  B. Ordering
  C. Landed
  D. Product
  A. Carrying

  ---

  Explanation

  The order point is the level of inventory that triggers a replenishment order. By increasing the order point, the planner is increasing the average inventory level, which in turn increases the carrying cost. Carrying cost is the cost of holding inventory, such as storage, insurance, obsolescence, and opportunity cost. Ordering cost, landed cost, and product cost are not directly affected by the order point.

• Question 10:

  An organization experienced multiple compromises of endpoints, leading to breaches of systems and datA: In updating its strategy to defend against these threats, which of the following BEST considers the organization's needs?

  A. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)
  B. Zero Trust (ZT) threat modeling
  C. Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
  D. Process for Attack Simulation and Threat Analysis (PASTA)
  A. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)

  ---

  Explanation