IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 301:

  An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

  A. Gray box
  B. Green box
  C. Black box
  D. White box
  A. Gray box

  ---

  Explanation

• Question 302:

  What BEST describes the end goal of a Disaster Recovery (DR) program?

  A. Review the status of mission-critical applications.
  B. Prevent business interruption.
  C. Continue business operations during a contingency.
  D. Restore normal business operations.
  D. Restore normal business operations.

  ---

  Explanation

• Question 303:

  Disaster Recovery (DR) training plan outcomes should have which KEY quality?

  A. Comprehensible
  B. Identifiable
  C. Measurable
  D. Editable
  C. Measurable

  ---

  Explanation

• Question 304:

  A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist's use of metrics for this task?

  A. A decrease in reported suspicious activity that aligns with an increase in detection of malware and Domain Name Server (DNS) queries to blocked sites.
  B. An increase in reported suspicious activity that aligns with a decrease in detection of malware and Domain Name Server (DNS) queries to blocked sites.
  C. An increase in reported changes in click percentage that aligns with a decrease in the number of phishes and incidents reported.
  D. A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.
  A. A decrease in reported suspicious activity that aligns with an increase in detection of malware and Domain Name Server (DNS) queries to blocked sites.

  ---

  Explanation

• Question 305:

  A security analyst modifies the organization's baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?

  A. Mitigating
  B. Tailoring
  C. Scoping
  D. Compensating
  B. Tailoring

  ---

  Explanation

• Question 306:

  What MUST be completed before developing physical security controls?

  A. Develop a comprehensive security policy
  B. Provide the annual security awareness training
  C. Contract for licensed and bonded security force
  D. Perform a physical security audit
  D. Perform a physical security audit

  ---

  Explanation

• Question 307:

  Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

  A. Integrity and authentication
  B. Integrity and non-repuditation
  C. Integrity and availability
  D. Confidentiality and availability
  A. Integrity and authentication

  ---

  Explanation

• Question 308:

  An organization discovered that malicious software was installed on an employee's work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

  A. Security awareness training
  B. Role-Based Access Control (RBAC)
  C. User behavior analytics solution
  D. File integrity monitoring
  C. User behavior analytics solution

  ---

  Explanation

• Question 309:

  In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

  A. The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.
  B. The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.
  C. The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.
  D. The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.
  C. The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

  ---

  Explanation

• Question 310:

  What document MOST likely states an organization's values?

  A. Union labor agreement
  B. Information protection policy
  C. Code of conduct
  D. Management standards
  C. Code of conduct

  ---

  Explanation