IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 601:

  Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

  A. Use compliant encryption algorithms and tools.
  B. Use a secure password management tool to store sensitive information.
  C. Implement Mobile Device Management (MDM).
  D. Develop and test an appropriate data backup and recovery plan.
  C. Implement Mobile Device Management (MDM).

  ---

  Explanation

• Question 602:

  A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.

  What is the organization's BEST next step?

  A. Evaluate available open source threat intelligence pertaining to the vendor and their product.
  B. Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.
  C. Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.
  D. Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.
  C. Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

  ---

  Explanation

• Question 603:

  Which of the following is a component of the Clark-Wilson model?

  A. Transformation procedures
  B. Enforcement rules
  C. Data classifications
  D. Integrity labels
  A. Transformation procedures

  ---

  Explanation

• Question 604:

  Using the quantity on hand of a particular item is determined at specified, fixed-time intervals and an order is placed.

  A. Walkthroughs
  B. Formal technical reviews
  C. Periodic review system
  D. Quality control
  C. Periodic review system

  ---

  Explanation

  A Periodic Review System (also known as a fixed-interval ordering system) involves:

  Checking the inventory at fixed time intervals (e.g., weekly, monthly).

  Placing an order if the quantity on hand is below a certain threshold or to restore it to a target level.

  Not continuously monitoring stock levels-only at those set review points.

• Question 605:

  A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performeD: What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?

  A. System centric
  B. Attacker centric
  C. Threat centric
  D. Asset centric
  B. Attacker centric

  ---

  Explanation

• Question 606:

  What can help a security professional assess and mitigate vulnerabilities of an embedded device?

  A. Conduct black-box testing.
  B. Conduct red-box testing.
  C. Conduct yellow-box testing.
  D. Conduct green-box testing.
  A. Conduct black-box testing.

  ---

  Explanation

• Question 607:

  It takes an average of 3 hours to set up a model and 1 hour to run, but depending on the complexity of the models, the setup time can be significantly different. Last week. 2 modelers were working on different projects. Each worked 40 hours.

  One modeler finished 5 models a day, and the other finished 1 model a day.

  What was the demonstrated capacity last week?

  A. 25models
  B. 15models
  C. 10models
  D. 30models
  A. 25models

  ---

  Explanation

  Calculation:

  Each modeler worked 40 hours last week.

  Total models completed = 25 + 5 = 30, but that's actual output, not demonstrated capacity.

  Demonstrated capacity is usually based on the highest proven output in a standard period.

  Since Modeler 1 completed 25 models in 40 hours, that's the demonstrated capacity - the best observed output under actual conditions.

  So, the correct answer is:

  A: 25 models

• Question 608:

  Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

  A. Requiring Multi-Factor Authentication (MFA)
  B. Using public key-based authentication method
  C. Restricting authentication by Internet Protocol (IP) address
  D. Implementing access credentials management tools
  B. Using public key-based authentication method

  ---

  Explanation

• Question 609:

  Which of the following controls should a financial Institution have in place in order to prevent a trader from both entering and executing a trade?

  A. Cameras in the trading room
  B. Two-Factor Authentication (2FA)
  C. Separation of Duties (SoD)
  D. Least privilege
  C. Separation of Duties (SoD)

  ---

  Explanation

• Question 610:

  Which of the following inventory management techniques is most responsive to changes in demand levels?

  A. Two-bin system
  B. Periodic review system
  C. Cycle counting
  D. ABC classification
  B. Periodic review system

  ---

  Explanation

  The Periodic Review System regularly reviews inventory levels at fixed intervals and adjusts order quantities based on the most current demand datA: This makes it more responsive to changes in demand compared to static methods like the

  two-bin system.

  Two-bin system is simple but less responsive.

  Cycle counting is for inventory accuracy, not demand response.

  ABC classification is for prioritizing items, not for reacting to demand changes.