SCENARIO
Please use the following to answer the next question:
Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but
you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently
subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society's store had been hacked. The thefts could have been employee-related.
Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a
phone call from you to clarify expectations and the “misunderstanding” has not occurred again.
As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy
protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society's operating budget is slim, and all sources of revenue are essential.
Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. “The good news,” he says, “is that we have found a low-cost provider in Finland, where
the data would also be held. So, while there may be a small charge to pass through to you, it won't be exorbitant, especially considering the advantages of a cloud.”
You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason's
Finnish provider is signing on.
If the vendor's actions raise concerns about privacy protection, what action should you take first?
A. Review the vendor selection process to see what may have been overlooked.
B. Convene the privacy team to discuss your suspicions.
C. Investigate to ensure that customer data is secure.
D. Phone the vendor to share your concerns.
A Human Resources director at a company reported that a laptop containing employee payroll data was lost on the train. Which action should the company take IMMEDIATELY?
A. Report the theft to law enforcement
B. Wipe the hard drive remotely
C. Report the theft to the senior management
D. Perform a multi-factor risk analysis
What are you doing if you succumb to "overgeneralization" when analyzing data from metrics?
A. Using data that is too broad to capture specific meanings.
B. Possessing too many types of data to perform a valid analysis.
C. Using limited data in an attempt to support broad conclusions.
D. Trying to use several measurements to gauge one aspect of a program.
A Data Privacy Officer (DPO) who posts privacy message reminders on posters and on company video screens throughout the office to reinforce the organization's privacy message is furthering which organizational program?
A. Public Service.
B. Awareness.
C. Training.
D. Ethics.
The primary purpose of privacy awareness activities is to?
A. Provide specialized information to individuals or departments handling sensitive information.
B. Consistently reinforce practices that promote a culture of accountability around privacy.
C. Ensure appropriate training has been provided on a clearly defined schedule.
D. Train recipients on standard privacy responsibilities and practices.
Which of the following privacy frameworks are legally binding?
A. Binding Corporate Rules (BCRs).
B. Generally Accepted Privacy Principles (GAPP).
C. Asia-Pacific Economic Cooperation (APEC) Privacy Framework.
D. Organization for Economic Co-Operation and Development (OECD) Guidelines.
SCENARIO
Please use the following to answer the next QUESTION:
Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space's practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts.
Penny's colleague in Marketing is excited by the new sales and the company's plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her "I heard someone in the breakroom talking about some new privacy laws but I really don't think it affects us. We're just a small company. I mean we just sell accessories online, so what's the real risk?" He has also told her that he works with a number of small companies that help him get projects completed in a hurry. "We've got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don't have."
In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny's colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team "didn't know what to do or who should do what. We hadn't been trained on it but we're a small team though, so it worked out OK in the end." Penny is concerned that these issues will compromise Ace Space's privacy and data protection.
Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data "shake up". Her mission is to cultivate a strong privacy culture within the company.
Penny has a meeting with Ace Space's CEO today and has been asked to give her first impressions and an overview of her next steps.
What information will be LEAST crucial from a privacy perspective in Penny's review of vendor contracts?
A. Audit rights
B. Liability for a data breach
C. Pricing for data security protections
D. The data a vendor will have access to
SCENARIO
Please use the following to answer the next QUESTION:
Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society's store had been hacked. The thefts could have been employee-related.
Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the "misunderstanding" has not occurred again.
As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society's operating budget is slim, and all sources of revenue are essential.
Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. "The good news," he says, "is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won't be exorbitant, especially considering the advantages of a cloud."
Lately, you have been hearing about cloud computing and you know it's fast becoming the new paradigm for various applications. However, you have heard mixed reviews about the potential impacts on privacy protection. You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason's Finnish provider is signing on.
What is the best way to prevent the Finnish vendor from transferring data to another party?
A. Restrict the vendor to using company security controls
B. Offer company resources to assist with the processing
C. Include transfer prohibitions in the vendor contract
D. Lock the data down in its current location
Which of the following is an example of Privacy by Design (PbD)?
A. A company hires a professional to structure a privacy program that anticipates the increasing demands of new laws.
B. The human resources group develops a training program for employees to become certified in privacy policy.
C. A labor union insists that the details of employers' data protection methods be documented in a new contract.
D. The information technology group uses privacy considerations to inform the development of new networking software.
Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay?
A. When the data subject is a public authority.
B. When the erasure is in the public interest.
C. When the processing is carried out by automated means.
D. When the data is no longer necessary for its original purpose.
Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only IAPP exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your CIPM exam preparations and IAPP certification application, do not hesitate to visit our Vcedump.com to find your solutions here.