IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 611:

  After a data loss event, an organization is reviewing its Identity and Access Management (IAM) governance process. The organization determines that the process is not operating effectively. What should be the FIRST step to effectively manage the IAM governance process?

  A. Complete an inventory of who has access to systems.
  B. Create a Role-Based Access Control (RBAC) process to determine what a specific group of users can access.
  C. Create an Attribute-Based Access Control (ABAC) process to assign access to users based on their account attributes and characteristics.
  D. Conduct an assessment and remove all inactive accounts.
  A. Complete an inventory of who has access to systems.

  ---

  Explanation

• Question 612:

  The primary benefit that results from the cross-training of employees is:

  A. improved flexibility.
  B. improved capacity.
  C. shortened lead time.
  D. effective problem-solving.
  A. improved flexibility.

  ---

  Explanation

  The primary benefit of cross-training employees is increased flexibility. When employees are trained to perform multiple tasks or roles, the organization can more easily adjust to changes in demand, cover for absences, and reallocate labor as needed, enhancing overall operational agility.

• Question 613:

  When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?

  A. Using someone else's account
  B. Distributed Denial-Of-Service (DDoS)
  C. SQL Injection (SQLi)
  D. Modifying a file
  A. Using someone else's account

  ---

  Explanation

• Question 614:

  Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

  A. Malware on the sensor
  B. Denial-Of-Service (DoS)
  C. Wardriving attack
  D. Radio Frequency (RF) interference
  A. Malware on the sensor

  ---

  Explanation

• Question 615:

  Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?

  A. Econometric models
  B. Computer simulation
  C. Time series decomposition
  D. Weighted moving average
  C. Time series decomposition

  ---

  Explanation

  Time series decomposition is specifically designed to break down historical demand data into its trend, seasonality, and random (irregular) components. This makes it highly appropriate when forecasting a product family with significant trend and seasonality, allowing for more accurate and interpretable forecasts.

• Question 616:

  An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

  A. Submit a security exception for the application and remove it from vulnerability scanning
  B. Report to the privacy officer and increase logging and monitoring of the application
  C. Continue to operate and monitor the application until it is no longer needed
  D. Implement compensating controls and prioritize upgrading the application
  D. Implement compensating controls and prioritize upgrading the application

  ---

  Explanation

• Question 617:

  A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

  A. Mitigation
  B. Prevention
  C. Recovery
  D. Wait and see
  B. Prevention

  ---

  Explanation

  Prevention is a risk control strategy that involves avoiding or eliminating the sources of risk. By deciding not to pursue a business opportunity in a foreign market due to political instability and currency fluctuations, the company prevented the potential losses or disruptions that could arise from these factors. Mitigation is a risk control strategy that involves reducing the impact or likelihood of risk. Recovery is a risk control strategy that involves restoring normal operations after a risk event occurs. Wait and see is a risk control strategy that involves monitoring the risk situation and taking action only when necessary.

• Question 618:

  An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standarD: To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?

  A. Conduct an integrated audit against the most stringent security controls.
  B. Combine the systems into a single audit and implement security controls per applicable standard.
  C. Combine the systems into a single audit against all of the associated security controls.
  D. Audit each system individually and implement the applicable standard specific security controls.
  C. Combine the systems into a single audit against all of the associated security controls.

  ---

  Explanation

• Question 619:

  In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?

  A. Implement a self-service password management capability
  B. Increase system administration personnel
  C. Implement an automated provisioning tool
  D. Increase authorization workflow steps
  C. Implement an automated provisioning tool

  ---

  Explanation

• Question 620:

  Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?

  A. Excessive privileges
  B. Need to know access
  C. Training access
  D. Least access principle
  A. Excessive privileges

  ---

  Explanation