IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 171:

  A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?

  A. Maximum Tolerable Downtime (MTD)
  B. Recovery Point Objective (RPO)
  C. Recovery Time Objective (RTO)
  D. Mean Time to Recovery (MTTR)
  B. Recovery Point Objective (RPO)

  ---

  Explanation

• Question 172:

  Which of the following mechanisms are PRIMARILY designed to thwart side channel attacks?

  A. Honeypots
  B. Adding listening devices
  C. Adding noise
  D. Acoustic cryptanalysis
  C. Adding noise

  ---

  Explanation

• Question 173:

  When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?

  A. The vendor provides documented safeguards in handling confidential data.
  B. The vendor provides a copy of their externally performed risk assessment.
  C. The vendor has a Business Associate Agreement (BAA) in place before work begins.
  D. The vendor has a signed contract in place before work with data begins.
  B. The vendor provides a copy of their externally performed risk assessment.

  ---

  Explanation

• Question 174:

  Marketing has requested a significant change in the mix for a product family. The requested change falls between the demand and the planning time fences. The most appropriate action by the master scheduler is to:

  A. reject the request.
  B. accept the request.
  C. forward the request to senior management.
  D. check the availability of required material.
  D. check the availability of required material.

  ---

  Explanation

  Changes between the demand time fence and the planning time fence are generally allowed but may affect material and capacity plans. The master scheduler should first check material availability to determine if the change can be accommodated without disrupting current plans.

• Question 175:

  A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?

  A. Tandem testing
  B. Blind testing
  C. Double-gray testing
  D. Double-blind testing
  B. Blind testing

  ---

  Explanation

• Question 176:

  Which compensating control is the MOST effective to prevent fraud within an organization?

  A. Principle of least privilege
  B. Log monitoring
  C. Separation of privilege
  D. Pre-employment background checks
  C. Separation of privilege

  ---

  Explanation

• Question 177:

  The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:

  A. product manager to increase the selling price of the product.
  B. quality manager to add a new quality measurement to the operation.
  C. production supervisor to review and explain the overage.
  D. the engineering manager to evaluate the run time for the routing.
  C. production supervisor to review and explain the overage.

  ---

  Explanation

  The production supervisor is responsible for overseeing the actual operations on the shop floor. If there's a consistent overage in run time, the first step is to review what's happening during production and determine the root cause.

• Question 178:

  To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

  A. Cold Site
  B. Mobile Site
  C. Hot Site
  D. Warm Sit
  D. Warm Sit

  ---

  Explanation

• Question 179:

  Which activity follows the discovery phase of vulnerability management?

  A. Vulnerability governance
  B. Vulnerability identification
  C. Vulnerability detection
  D. Vulnerability evaluation
  D. Vulnerability evaluation

  ---

  Explanation

• Question 180:

  Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.

  What BEST describes the requirement changes that are happening?

  A. Volatility
  B. Stove-piped requirements
  C. Non-verifiable requirements
  D. Scope creep
  D. Scope creep

  ---

  Explanation