IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 401:

  An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be createD: What is the PRIMARY benefit of establishing an exception process?

  A. Prevent future material audit findings.
  B. Provide administrators with more autonomy.
  C. Enable management of organizational risk.
  D. Ensure better Business Continuity (BC).
  C. Enable management of organizational risk.

  ---

  Explanation

• Question 402:

  An organization has been struggling to improve their security posture after a recent breach.

  Where should the organization focus their efforts?

  A. Common configuration enumerations
  B. Business Continuity Plan (BCP)
  C. Service-Level Agreements (SLA)
  D. National vulnerability database
  A. Common configuration enumerations

  ---

  Explanation

• Question 403:

  An audit of antivirus server reports shows a number of workstations do not have current signatures installeD: The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

  A. Criteria
  B. Condition
  C. Effect
  D. Cause
  C. Effect

  ---

  Explanation

• Question 404:

  Are determined by the computer's material requirement plan logic based upon the gross requirements for a particular part.

  A. Planned orders
  B. Open order file
  C. Operational plan
  D. None of the above
  A. Planned orders

  ---

  Explanation

• Question 405:

  A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?

  A. Monitoring
  B. Web Application Firewall (WAF)
  C. Content Delivery Network (CDN)
  D. Logging
  A. Monitoring

  ---

  Explanation

• Question 406:

  Which of the following attributes describes a company with a global strategy?

  A. It uses the same basic competitive style worldwide and focuses efforts on building global brands.
  B. It customizes the basic competitive style to fit markets but focuses efforts on building global brands.
  C. It coordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.
  D. It operates plants in many host countries and uses decentralized distribution.
  A. It uses the same basic competitive style worldwide and focuses efforts on building global brands.

  ---

  Explanation

  A global strategy emphasizes standardization across markets, using a uniform competitive approach and aiming to build strong, recognizable global brands, rather than tailoring strategies to individual countries.

• Question 407:

  In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

  A. Head of human capital
  B. Head of compliance
  C. Chief Information Security Officer (CISO)
  D. Chief Information Officer (CIO)
  A. Head of human capital

  ---

  Explanation

• Question 408:

  One of the findings in the recent security assessment of a web application reads: "It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process." Which of these choices would BEST remediate this security finding?

  A. The installation and use of Dynamic Application Security Testing (DAST) software to test written code.
  B. The installation and use of Static Application Security Testing (SAST) software to test written code.
  C. The introduction of a continuous integration/continuous development pipeline to automate security into the software development change process.
  D. The introduction of a security training program for the developers.
  D. The introduction of a security training program for the developers.

  ---

  Explanation

• Question 409:

  Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

  A. Basically Available, Soft-State, Eventual-Consistency (BASE)
  B. Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)
  C. Control Objectives For Information And Related Technology (COBIT)
  D. Security, Trust, Assurance And Risk (STAR)
  B. Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

  ---

  Explanation

• Question 410:

  What is used to protect against timing uncertainty by planning order releases and order receipts earlier than required?

  A. Fast order release
  B. Safety lead time
  C. Direct release
  D. Lead command
  B. Safety lead time

  ---

  Explanation