IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 411:

  When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:

  A. any request for shipment prior to the planning time fence.
  B. any request for shipment prior to the demand time fence (DTF).
  C. requests only for shipment before the next master production schedule (MPS) receipt.
  D. requests only for shipment in the period of the receipt.
  D. requests only for shipment in the period of the receipt.

  ---

  Explanation

  With the discrete ATP (Available-to-Promise) method, the ATP quantity is allocated only to customer orders within the same period as the master production schedule (MPS) receipt. It does not carry forward to earlier or later periods, making it "discrete" to that specific time bucket.

• Question 412:

  A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?

  A. Discuss the Non-Disclosure Agreement (NDA) with the affected staff before revoking access.
  B. Revoke the user certificates and add them to the Certificate Revocation List (CRL).
  C. Revoke user access at the time of informing them.
  D. Ask human resources to conduct exit interviews before revoking access.
  C. Revoke user access at the time of informing them.

  ---

  Explanation

• Question 413:

  Are the means by which operations management reaches their desired objectives.

  A. Products
  B. Processes
  C. People
  D. Projects
  B. Processes

  ---

  Explanation

  Processes are the means by which operations management achieves its desired objectives, such as efficiency, quality, and customer satisfaction. They define how work is done, including: Production workflows Service delivery steps Quality control routines

• Question 414:

  The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

  A. order quantity.
  B. stockout costs.
  C. carrying costs.
  D. shelf life.
  B. stockout costs.

  ---

  Explanation

  In MRO (Maintenance, Repair, and Operating) supply systems, the primary consideration is often the cost of stockouts, since the unavailability of critical repair parts or supplies can lead to equipment downtime, production delays, and lost

  revenue. Ensuring availability is typically more important than minimizing inventory costs.

• Question 415:

  When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

  A. Developing a contingency roadmap that will provide processes for each identified and documented risk element
  B. Assessing the possible impact from unauthorized access on the organization's cyber insurance policies
  C. Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment
  D. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system
  D. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

  ---

  Explanation

• Question 416:

  What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

  A. Empty jugs which can easily be filled up with water.
  B. Stock up on generator fuel and execute a generator test.
  C. Request bids for inexpensive generators.
  D. Purchase a contract with a secondary power provider.
  D. Purchase a contract with a secondary power provider.

  ---

  Explanation

• Question 417:

  A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?

  A. Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.
  B. Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.
  C. Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.
  D. Evaluate available open source threat intelligence pertaining to the vendor and their product.
  C. Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

  ---

  Explanation

• Question 418:

  An organization is concerned that if an employee's mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

  A. The device should be restarted.
  B. The device should be wiped.
  C. The device should be turned off.
  D. The device passcode should be reset.
  B. The device should be wiped.

  ---

  Explanation

• Question 419:

  During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

  Which of the following security controls would BEST prevent this type of incident in the future?

  A. Invoke code repository vulnerability scanning on a regularly scheduled basis.
  B. Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.
  C. Encrypt the application package after being digitally signed.
  D. Implement a software Bill of Materials (BOM) for each application package.
  B. Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

  ---

  Explanation

• Question 420:

  An organization's security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

  A. To identify any residual vulnerabilities prior to release in the production environment
  B. To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing
  C. To identify any residual vulnerabilities prior to the end of the trial run of the software
  D. To identify and remediate any residual vulnerabilities prior to release in the production environment
  D. To identify and remediate any residual vulnerabilities prior to release in the production environment

  ---

  Explanation