IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 351:

  A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist's use of metrics for this task?

  A. An increase in reported changes in click percentages that aligns with a decrease in the number of phishes and incidents reported.
  B. A decrease in reported suspicious activity that aligns with an increase in detection of malware and DNS queries to blocked sites.
  C. An increase in reported suspicious activity that aligns with a decrease in detection of malware and DNS queries to blocked sites.
  D. A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.
  C. An increase in reported suspicious activity that aligns with a decrease in detection of malware and DNS queries to blocked sites.

  ---

  Explanation

• Question 352:

  Operational splitting is practical when:

  A. setup time is low compared to run time
  B. a suitable work center is idle
  C. it is possible for an operator to run more than one machine at a time
  D. All of the above
  D. All of the above

  ---

  Explanation

  Operational splitting involves dividing a production order into parts that can be processed simultaneously on multiple machines or work centers. It is practical when:

  A: Setup time is low compared to run time (makes splitting efficient)

  B: A suitable work center is idle (can share the workload)

  C: An operator can run multiple machines (maximizes labor efficiency) Thus, all of the above conditions support operational splitting.

• Question 353:

  What is the MAIN privacy risk raised by federated identity solutions?

  A. The potential for unauthorized access to user attributes
  B. The potential for tracking and profiling an individual's transactions
  C. The potential for exposing an organization's sensitive business information
  D. The potential to break the chain of trust between identity brokers
  A. The potential for unauthorized access to user attributes

  ---

  Explanation

• Question 354:

  Which of the following should Business Impact Analysis (BIA) reports always include?

  A. Security assessment report
  B. Recovery time objectives
  C. Plan of action and milestones
  D. Disaster Recovery Plans (DRP)
  B. Recovery time objectives

  ---

  Explanation

• Question 355:

  The service level is directly related to the number of standard deviations provided as safety stock and is usually called:

  A. safety value
  B. safety factor
  C. secure level
  D. secure stockout
  B. safety factor

  ---

  Explanation

• Question 356:

  A semiconductor manufacturer is writing a physical asset handling policy. Which of the following is MOST likely to be the rationale for the policy?

  A. Access of system logs to authorized staff
  B. Accurate and prompt tagging of all business files
  C. Assurance of safe and clean handling of company property
  D. Adoption of environmental controls in the server room
  C. Assurance of safe and clean handling of company property

  ---

  Explanation

• Question 357:

  When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

  A. Continuous Integration and Continuous Delivery (CI/CD)
  B. Common Vulnerabilities and Exposures (CVE)
  C. Security Content Automation Protocol (SCAP)
  D. Common Vulnerability Scoring System (CVSS)
  C. Security Content Automation Protocol (SCAP)

  ---

  Explanation

• Question 358:

  After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identifieD: What is the BEST description of how the threats from the workshop are being addressed?

  A. Eliminated
  B. Mitigated
  C. Transferred
  D. Accepted
  A. Eliminated

  ---

  Explanation

• Question 359:

  Which threat modeling methodology is focused on assessing risks from organizational assets?

  A. Process For Attack Simulation And Threat Analysis (PASTA)
  B. Operationally Critical Threat, Asset, And Vulnerability Evaluation (OCTAVE)
  C. Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)
  D. Damage, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)
  B. Operationally Critical Threat, Asset, And Vulnerability Evaluation (OCTAVE)

  ---

  Explanation

• Question 360:

  What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?

  A. To ensure complexity introduced by security design is addressed in the beginning stages.
  B. To reduce the overall cost of incorporating security in a system.
  C. To prevent the system from being tampered with in the future.
  D. To prevent the users from performing unauthorized actions during the testing or operational phases.
  B. To reduce the overall cost of incorporating security in a system.

  ---

  Explanation