IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 371:

  Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?

  A. Internal security policies
  B. General Data Protection Regulation (GDPR)
  C. System And Organization Controls (SOC) audit criteria
  D. Cyber insurance premiums
  B. General Data Protection Regulation (GDPR)

  ---

  Explanation

• Question 372:

  An organization's external auditors have issued a management letter identifying significant deficiencies related to the effectiveness of the previous year's global access certification. The organization wants to move from a department-based access control system to a Role-Based Access Control (RBAC) system. In addition to quickly and securely provisioning users by granting membership into predefined and approved roles, which of these presents the BEST reason to do so?

  A. The organization can implement both mandatory and dynamic access controls, except where they would be in conflict.
  B. The organization can clone roles, saving time and granting broad access to persons within the same department.
  C. The organization can give a person holding multiple roles the appropriate levels of access to specific data for each role.
  D. The organization can implement both static and dynamic access controls, adjusting them to fit any individual's access needs.
  C. The organization can give a person holding multiple roles the appropriate levels of access to specific data for each role.

  ---

  Explanation

• Question 373:

  Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?

  A. File Transfer Protocol (FTP)
  B. Security Assertion Markup Language (SAML)
  C. Peer-To-Peer (P2P) communication
  D. Transport Layer Security (TLS)
  D. Transport Layer Security (TLS)

  ---

  Explanation

• Question 374:

  A cybersecurity professional has been tasked with instituting a risk management function at a new organization. Which of the following is the MOST important step the professional should take in this endeavor?

  A. Determine the acceptable level of loss exposure at which the organization is comfortable operating.
  B. Conduct a gap assessment and produce a risk rating report for the executive leadership.
  C. Engage consultants to audit the organization against best practices and provide a risk report.
  D. Implement an enterprise Governance, Risk, and Compliance (GRC) management solution.
  A. Determine the acceptable level of loss exposure at which the organization is comfortable operating.

  ---

  Explanation

• Question 375:

  An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer datA: The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

  A. Intrusion Detection System (IDS)
  B. Domain Name System (DNS)
  C. Network Address Translation (NAT)
  D. Virtual Private Network (VPN)
  D. Virtual Private Network (VPN)

  ---

  Explanation

• Question 376:

  An organization has hired a consultant to establish their Identity and Access Management (IAM) system. One of the consultant's main priorities will be to understand the current state and establish visibility across the environment. How can the consultant start to establish an IAM governance process?

  A. Implement Attribute-Based Access Control (ABAC) process for sensitive applications.
  B. Determine authoritative identity sources.
  C. Understand connectivity to target applications.
  D. Implement Role-Based Access Control (RBAC) process for web-based applications.
  B. Determine authoritative identity sources.

  ---

  Explanation

• Question 377:

  In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?

  A. Single sourcing
  B. Multisourcing
  C. Long-term agreement
  D. Service-level agreement (SLA)
  B. Multisourcing

  ---

  Explanation

  Multisourcing involves using multiple suppliers for the same material or service, which gives a company greater leverage in negotiations and reduces dependency on any single supplier. This competitive pressure helps drive cost reductions and improves supply chain resilience.

• Question 378:

  An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?

  A. When the software is being released for testing
  B. When full system code is being merged
  C. When business analysis is being performed and systems requirements are being identified
  D. When system architecture is being defined and user interface is being designed
  B. When full system code is being merged

  ---

  Explanation

• Question 379:

  In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

  A. To track user actions and activity
  B. To prevent the installation of untrusted software
  C. To restrict a user's ability to change device settings
  D. To limit web access to only approved sites
  B. To prevent the installation of untrusted software

  ---

  Explanation

• Question 380:

  What can be based on characteristics such as customer grouping, demand characteristics, or degree of customization?

  A. Process focus
  B. Focused factory
  C. Functional focus
  D. Product and market focus
  D. Product and market focus

  ---

  Explanation

  Product and market focus involves organizing operations or strategies based on:

  Customer grouping (e.g., B2B vs. B2C)

  Demand characteristics (e.g., high volume vs. custom orders)

  Degree of customization (e.g., standard vs. personalized products)

  This focus ensures that production, marketing, and service strategies align closely with specific product lines or market segments.

  Other options:

  A: Process focus: Centers around grouping resources by similar processes.

  B: Focused factory: A facility designed to produce a narrow range of products efficiently.

  C: Functional focus: Organizes by function (e.g., marketing, finance), not customer/product traits.

  So, D: Product and market focus is the correct answer.