IAPP CIPP-US Online Practice Questions and Exam Preparation

IAPP CIPP-US Online Questions & Answers

• Question 91:

  How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?

  A. It expanded the definition of "consumer reports" to include communications relating to employee investigations
  B. It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access
  C. It stipulated the purpose of obtaining a consumer report can only be for a review of the employee's credit worthiness
  D. It required employers to get an employee's consent in advance of requesting a consumer report for internal investigation purposes
  B. It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access

  ---

  Explanation

• Question 92:

  A California resident has created an account on your company's online food delivery platform and placed several orders in the past month. Later she submits a data subject request to access her personal information under the California Privacy Rights Act.

  Assuming that the CPRA is in force, which of the following data elements would your company NOT have to provide to the requester once her identity has been veri ed?

  A. Inferences made about the individual for the company's internal purposes.
  B. The loyalty account number assigned through the individual's use of the services.
  C. The time stamp for the creation of the individual's account in the platform's database.
  D. The email address submitted by the individual as part of the account registration process.
  A. Inferences made about the individual for the company's internal purposes.

  ---

  Explanation

• Question 93:

  Privacy Is Hiring Inc., a CA-based company, is an online specialty recruiting firm focusing on placing privacy professionals in roles at major companies. Job candidates create online profiles outlining their experience and credentials, and can pay $19.99/month via credit card to have their profiles promoted to potential employers. Privacy Is Hiring Inc. keeps all customer data at rest encrypted on its servers.

  Under what circumstances would Privacy Is Hiring Inc., need to notify affected individuals in the event of a data breach?

  A. If law enforcement has completed its investigation and has authorized Privacy Is Hiring Inc. to provide the notification to clients and applicable regulators.
  B. If the job candidates' credit card information and the encryption keys were among the information taken.
  C. If Privacy Is Hiring Inc., reasonably believes that job candidates will be harmed by the data breach.
  D. If the personal information stolen included the individuals' names and credit card pin numbers.
  D. If the personal information stolen included the individuals' names and credit card pin numbers.

  ---

  Explanation

• Question 94:

  Under the Driver's Privacy Protection Act (DPPA), which of the following parties would require consent of an individual in order to obtain his or her Department of Motor Vehicle information?

  A. Law enforcement agencies performing investigations.
  B. Insurance companies needing to investigate claims.
  C. Attorneys gathering information related to lawsuits.
  D. Marketers wishing to distribute bulk materials.
  A. Law enforcement agencies performing investigations.

  ---

  Explanation

• Question 95:

  The Video Privacy Protection Act of 1988 restricted which of the following?

  A. Which purchase records of audio visual materials may be disclosed
  B. When downloading of copyrighted audio visual materials is allowed
  C. When a user's viewing of online video content can be monitored
  D. Who advertisements for videos and video games may target
  A. Which purchase records of audio visual materials may be disclosed

  ---

  Explanation

  https://searchcompliance.techtarget.com/definition/Video-Privacy-Protection-Act-of-1988

• Question 96:

  Which entity within the Department of Health and Human Services (HHS) is the primary enforcer of the Health Insurance Portability and Accountability Act (HIPAA) "Privacy Rule"?

  A. Office for Civil Rights.
  B. Office of Social Services.
  C. Office of Inspector General.
  D. Office of Public Health and Safety.
  A. Office for Civil Rights.

  ---

  Explanation

  https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/how-ocr-enforces-the-hipaa-privacy-and-security-rules/index.html

• Question 97:

  What does the Massachusetts Personal Information Security Regulation require as it relates to encryption of personal information?

  A. The encryption of all personal information of Massachusetts residents when all equipment is located in Massachusetts.
  B. The encryption of all personal information stored in Massachusetts-based companies when all equipment is located in Massachusetts.
  C. The encryption of personal information stored in Massachusetts-based companies when stored on portable devices.
  D. The encryption of all personal information of Massachusetts residents when stored on portable devices.
  D. The encryption of all personal information of Massachusetts residents when stored on portable devices.

  ---

  Explanation

  https://www.dataguidance.com/notes/massachusetts-data-protection-overview

• Question 98:

  In 2011, the FTC announced a settlement with Google regarding its social networking service Google Buzz. The FTC alleged that in the process of launching the service, the company did all of the following EXCEPT?

  A. Violated its own privacy policies.
  B. Engaged in deceptive trade practices.
  C. Failed to comply with Safe Harbor principles.
  D. Failed to employ sufficient security safeguards.
  D. Failed to employ sufficient security safeguards.

  ---

  Explanation

  https://www.ftc.gov/news-events/press-releases/2011/03/ftc-charges-deceptive-privacy-practices-googles-rollout-its-buzz

• Question 99:

  Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network. Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S. Department of Health and Human Services about the breach.

  Which statement accurately describes SMH's notification responsibilities?

  A. If SMH is compliant with HIPAA, it will not have to make a separate notification to individuals in the state of New York.
  B. If SMH has more than 500 patients in the state of New York, it will need to make separate notifications to these patients.
  C. If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.
  D. If SMH makes credit monitoring available to individuals who inquire, it will not have to make a separate notification to individuals in the state of New York.
  C. If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.

  ---

  Explanation

• Question 100:

  Which entities must comply with the Telemarketing Sales Rule?

  A. For-profit organizations and for-profit telefunders regarding charitable solicitations
  B. Nonprofit organizations calling on their own behalf
  C. For-profit organizations calling businesses when a binding contract exists between them
  D. For-profit and not-for-profit organizations when selling additional services to establish customers
  A. For-profit organizations and for-profit telefunders regarding charitable solicitations

  ---

  Explanation

  https://www.ftc.gov/tips-advice/business-center/guidance/complying-telemarketing-sales-rule