IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 91:

  Preventive maintenance plus continuing efforts to adapt, modify, and refine equipment to increase flexibility, reduce material handling, and promote continuous flow, is called:

  A. Source maintenance
  B. Pull-up system
  C. Total productive maintenance
  D. valid schedule maintenance
  C. Total productive maintenance

  ---

  Explanation

  Total Productive Maintenance (TPM) goes beyond basic preventive maintenance by incorporating continuous improvement efforts to: Increase equipment flexibility Reduce material handling Promote continuous flow Involve operators in equipment care It's a comprehensive approach aimed at maximizing equipment effectiveness across the production process.

• Question 92:

  In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

  A. Between the policy engine and the trust engine, because it enforces security policies
  B. As close to the workload as possible, because it impacts authorization decisions
  C. As close to the workload as possible, because it impacts authentication decisions
  D. Between the data stores and the trust engine, because it improves security policies
  B. As close to the workload as possible, because it impacts authorization decisions

  ---

  Explanation

• Question 93:

  In pyramid forecasting, the "roll up" process begins with:

  A. combining individual product item forecasts into forecasts for product families.
  B. combining forecasts for product families into a total business forecast.
  C. allocating total business forecast changes to product families.
  D. allocating product family forecast changes to individual products.
  A. combining individual product item forecasts into forecasts for product families.

  ---

  Explanation

  In pyramid forecasting, the "roll up" process refers to aggregating forecasts from the lowest level (individual product items) up to higher levels such as product families and eventually the total business forecast. This supports consistency and alignment across planning levels.

• Question 94:

  The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

  A. Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.
  B. Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.
  C. Request a software demo with permission to have a third-party penetration test completed on it.
  D. Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.
  A. Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

  ---

  Explanation

• Question 95:

  A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

  A. Encryption in transit
  B. Layer 7 filtering
  C. Encryption at rest
  D. Password hashing
  C. Encryption at rest

  ---

  Explanation

• Question 96:

  Which of the following BEST describes the responsibility of an information System Security Officer?

  A. Establish the baseline, architecture, and management direction and ensure compliance
  B. Ensure adherence to physical security policies and procedures
  C. Direct, coordinate, plan, and organize information security activities
  D. Ensure the availability of the systems and their contents
  C. Direct, coordinate, plan, and organize information security activities

  ---

  Explanation

• Question 97:

  What is the main negative effect of changing the due dates of open orders?

  A. The schedule information becomes inaccurate.
  B. The customer service level decreases.
  C. It leads to "nervousness" in the schedule.
  D. The schedule does not support demand.
  C. It leads to "nervousness" in the schedule.

  ---

  Explanation

  Frequent changes to the due dates of open orders can cause "nervousness" in the schedule - a term used in production and materials planning to describe instability and excessive adjustments. This can disrupt production flow, increase costs, and reduce overall efficiency.

• Question 98:

  Which security concept states that a subject (user, application, or asset) be given only the access needed to complete a task?

  A. Discretionary Access Control (DAC)
  B. Principle of least privilege
  C. Need to know
  D. Role-Based Access Control (RBAC)
  B. Principle of least privilege

  ---

  Explanation

• Question 99:

  A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.

  What is the BEST action the engineer can take to ensure secure operations?

  A. Refer to the organization's SCADA security standards and policies.
  B. Refer to the SCADA risk assessment and industry standards.
  C. Review the organizational Standard Operating Procedures (SOP).
  D. Conduct logging and monitoring of the system and apply need to know and least privileges.
  D. Conduct logging and monitoring of the system and apply need to know and least privileges.

  ---

  Explanation

• Question 100:

  If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?

  A. Determine if the organization's risk posture allows the system to operate without the continuous monitoring of the controls in question
  B. Identify and monitor only the technical controls, as they cover the most critical threats to the organization
  C. Ensure that the organization's Configuration Management (CM) and control processes are documented and executed according to policy
  D. Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls
  A. Determine if the organization's risk posture allows the system to operate without the continuous monitoring of the controls in question

  ---

  Explanation