IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 181:

  Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

  A. Project management office
  B. Chief Financial Officer (CFO)
  C. Board of Directors
  D. Chief Information Security Officer (CISO)
  D. Chief Information Security Officer (CISO)

  ---

  Explanation

• Question 182:

  An organization identified a Distributed Denial-of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

  A. Transport layer
  B. Application layer
  C. Internet layer
  D. Network layer
  C. Internet layer

  ---

  Explanation

• Question 183:

  Product design engineers sometimes change the design of a product and the components useD: These changes must be recorded and controlleD: The bill provides the method for doing so is called

  A. Engineering change control
  B. Production change control
  C. Demand change control
  D. Both A and B
  A. Engineering change control

  ---

  Explanation

  Engineering Change Control (ECC) is the formal process used to: Record, evaluate, approve, and implement design changes to a product or its components Ensure that the Bill of Materials (BOM) and other documentation reflect the latest, approved product design Maintain control and traceability of changes made by product design engineers

  Other options:

  B: Production change control: Refers to changes in manufacturing processes, not design

  C: Demand change control: Not a standard term in this context

  D: Both A and B: Incorrect-only A directly relates to design and BOM changes

  Correct Answer: A: Engineering change control

• Question 184:

  Access Control Lists (ACL), protection bits, and file passwords are typical examples of which of the following access control methods?

  A. Discretionary.
  B. Attribute-based.
  C. Mandatory.
  D. Role-based.
  A. Discretionary.

  ---

  Explanation

• Question 185:

  An organization is retiring an old server out of the data center. This server was used to store and process sensitive information. The server is being sent off-site to a recycling center. Which declassification method should be performed prior to it being sent off-site?

  A. Tokenization
  B. Anonymization
  C. Obfuscation
  D. Destruction
  D. Destruction

  ---

  Explanation

• Question 186:

  Which of the following is MOST accurate when comparing patch management and vulnerability management?

  A. Patch management manages the security lifecycle from discovery to remediation.
  B. Patch management identifies, acquires, tests, and installs code changes on a specific computing device.
  C. Vulnerability management is a process executed in specialized software to address security issues or add new features.
  D. Vulnerability management plugs security holes and remediates risk by upgrading software to the most recent versions.
  B. Patch management identifies, acquires, tests, and installs code changes on a specific computing device.

  ---

  Explanation

• Question 187:

  An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization's documented policies and standards?

  A. Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.
  B. Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.
  C. Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.
  D. Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.
  B. Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

  ---

  Explanation

• Question 188:

  A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

  A. Maintenance procedures
  B. Supplier contracts
  C. Failover designs
  D. Product catalogs
  A. Maintenance procedures

  ---

  Explanation

• Question 189:

  When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

  A. Assessing the possible impact from unauthorized access on the organization's cyber insurance policies
  B. Developing a contingency roadmap that will provide processes for each identified and documented risk element
  C. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system
  D. Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment
  C. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

  ---

  Explanation

• Question 190:

  What priority control technique is most appropriate for a firm using a cellular production system?

  A. Shortest processing time (SPT) rule
  B. Distribution requirements planning (DRP)
  C. Pull production activity control (PAC)
  D. Push production activity control (PAC)
  C. Pull production activity control (PAC)

  ---

  Explanation

  In a cellular production system, work flows through self-contained cells based on demanD: The most appropriate priority control technique is pull production activity control (PAC), where production is triggered by actual usage or demand (e.g., via kanban), helping minimize inventory and improve responsiveness.