從Google Drive中免費下載最新的KaoGuTi CIPM PDF版考試題庫：https://drive.google.com/open?id=1mnloTaZF1O_ug9fKxlmWtIXbSaB5y7O6
人生有太多的變數和未知的誘惑，所以我們趁年輕時要為自己打下堅實的基礎，你準備好了嗎？KaoGuTi IAPP的CIPM考試培訓資料將是最好的培訓資料，它的效果將是你終生的伴侶，作為IT行業的你，你體會到緊迫感了嗎？選擇KaoGuTi，你將打開你的成功之門，裏面有最閃耀的光芒等得你去揮灑，加油！
| Certification Vendor: | IAPP |
|---|---|
| Exam Name: | Certified Information Privacy Manager |
| Exam Number: | CIPM |
| Exam Duration: | 150 minutes |
| Available Languages: | English |
| Exam Format: | Multiple Choice |
| Real Exam Qty: | 90 |
| Passing Score: | 300 (scaled score) |
| Related Certifications: | CIPP/C CIPP/US CIPT CIPP/E |
| Certificate Validity Period: | 2 years |
| Exam Price: | USD 550 |
| Sample Questions: | IAPP CIPM Sample Questions |
| Exam Way: | Computer-based testing at Pearson VUE centers or online proctored |
| Pre Condition: | No formal prerequisites; recommended privacy management experience |
| Official Syllabus URL: | https://iapp.org/certify/cipm/ |
想要通過 CIPM 認證考試並不是僅僅依靠與考試相關的書籍就可以辦到的。與其盲目地學習考試要求的相關知識，不如做一些有價值的試題。KaoGuTi 為您提供一個明確的和特殊的解決方案，我們為您提供詳細的 IAPP CIPM 的問題和答案。我們的專家來自不同地區有經驗的技術專家編寫 CIPM 考古題。我們的 CIPM 考古題是我們經過多次測試和整理得到的擬真題，確保考生順利通過CIPM 考試。
IAPP的CIPM認證考試開放給來自不同背景的專業人士參加，包括隱私官員、數據保護官員、法律專業人員、合規專業人員和風險管理專業人員。該考試旨在驗證候選人對隱私管理最佳實踐的知識以及他們應用這些實踐解決實際場景的能力。
取得CIPM認證代表一個人承諾保護隱私的能力並有效地管理隱私計劃。此外，它也為個人在就業市場上提供競爭優勢，因為許多組織正在尋找已證明在隱私計劃管理方面具有知識和專業能力的專業人員。
問題 #113
Under the General Data Protection Regulation (GDPR), what are the obligations of a processor that engages a sub-processor?
答案：C
解題說明：
Under the General Data Protection Regulation (GDPR), the obligations of a processor that engages a sub- processor are to obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor. The GDPR defines a processor as a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. A sub-processor is a third party that is engaged by the processor to carry out specific processing activities on behalf of the controller. The GDPR requires that the processor does not engage another processor without prior specific or general written authorization of the controller. In the case of general written authorization, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. The processor must also ensure that the same data protection obligations as set out in the contract or other legal act between the controller and the processor are imposed on that other processor by way of a contract or other legal act under Union or Member State law, . References: [GDPR Article 28], [CIPM - International Association of Privacy Professionals]
問題 #114
SCENARIO
Please use the following to answer the next question:
Liam is the newly appointed information technology (IT) compliance manager at Mesa, a USbased outdoor clothing brand with a global E-commerce presence. During his second week, he is contacted by the company's IT audit manager, who informs him that the auditing team will be conducting a review of Mesa's privacy compliance risk in a month.
A bit nervous about the audit, Liam asks his boss what his predecessor had completed related to privacy compliance before leaving the company. Liam is told that a consent management tool had been added to the website and they commissioned a privacy risk evaluation from a small consulting firm last year that determined that their risk exposure was relatively low given their current control environment. After reading the consultant's report, Liam realized that the scope of the assessment was limited to breach notification laws in the US and the Payment Card Industry's Data Security Standard (PCI DSS).
Not wanting to let down his new team, Liam kept his concerns about the report to himself and figured he could try to put some additional controls into place before the audit. Having some privacy compliance experience in his last role, Liam thought he might start by having discussions with the E-commerce and marketing teams.
The E-commerce Director informed him that they were still using the cookie consent tool forcibly placed on the home screen by the CIO, but could not understand the point since their office was not located in California or Europe. The marketing director touted his department's success with purchasing email lists and taking a shotgun approach to direct marketing. Both directors highlighted their tracking tools on the website to enhance customer experience while learning more about where else the customer had shopped. The more people Liam met with, the more it became apparent that privacy awareness and the general control environment at Mesa needed help.
With three weeks before the audit, Liam updated Mesa's Privacy Notice himself, which was taken and revised from a competitor's website. He also wrote policies and procedures outlining the roles and responsibilities for privacy within Mesa and distributed the document to all departments he knew of with access to personal information.
During this time. Liam also filled the backlog of data subject requests for deletion that had been sent to him by the customer service manager. Liam worked with application owners to remove these individual's information and order history from the customer relationship management (CRM) tool, the enterprise resource planning (ERP). the data warehouse and the email server.
At the audit kick-off meeting. Liam explained to his boss and her team that there may still be some room for improvement, but he thought the risk had been mitigated to an appropriate level based on the work he had done thus far.
After the audit had been completed, the audit manager and Liam met to discuss her team's findings, and much to his dismay. Liam was told that none of the work he had completed prior to the audit followed best practices for governance and risk mitigation. In fact, his actions only opened the company up to additional risk and scrutiny. Based on these findings. Liam worked with external counsel and an established privacy consultant to develop a remediation plan.
Given the feedback provided to Liam after the audit, what maturity level would the audit team most likely have assigned to Mesa's privacy policies and procedures if they use the Privacy Maturity Model (PMM)?
答案：C
解題說明：
Comprehensive and Detailed Explanation:
Mesa's privacy program lacks structured policies, governance, and consistent application of privacy controls, meaning its privacy practices are at the Ad-hoc maturity level.
Option A (Repeatable) means some processes are in place but are not well-documented or consistently followed. Mesa does not meet this threshold.
Option C (Defined) would require fully documented and standardized privacy policies, which Mesa lacks.
Option D (Managed) means policies are monitored and enforced consistently, which is far beyond Mesa's current state.
The Ad-hoc level is assigned when privacy governance is informal, reactive, and lacks structured policies-exactly the situation Mesa is in.
問題 #115
SCENARIO
Please use the following to answer the next QUESTION:
Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments.
After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide.
The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application.
Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many Questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the Questions as he was not involved in the product development process.
In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest.
Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called Eureka. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal.
What element of the Privacy by Design (PbD) framework might the Handy Helper violate?
答案：B
解題說明：
Explanation
The Handy Helper might violate the element of the Privacy by Design (PbD) framework that requires integrating privacy throughout the system development life cycle. According to the PbD framework, privacy should be embedded into the design and architecture of IT systems and business practices, not added as an afterthought1 This means that privacy should be considered at every stage of the system development life cycle, from planning to analysis to design to development to implementation to maintenance2 However, the Handy Helper seems to have been developed without involving Sanjay, the head of privacy, or conducting a privacy impact assessment (PIA) to identify and mitigate potential privacy risks3 The product also lacks a clear and transparent privacy notice that informs users about what data is collected, how it is used, where it is stored, who has access to it, and what choices they have4 These issues could expose the product to legal and reputational challenges, especially in regions with strict data protection regulations, such as Europe. References: 1: Privacy by Design - The LIFE Institute; 2: System Development Life Cycle - GeeksforGeeks; 3: [Privacy Impact Assessment (PIA) | NZ Digital government]; 4: [Privacy Notices under EU Data Protection Law | Privacy International]
問題 #116
SCENARIO
Please use the following to answer the next question:
For 15 years, Albert has worked at Treasure Box - a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the
48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motivated Albert to be an agent of positive change.
He will soon interview for a newly advertised position, and during the interview, Albert plans on making executives aware of lapses in the company's privacy program. He feels certain he will be rewarded with a promotion for preventing negative consequences resulting from the company's outdated policies and procedures.
For example, Albert has learned about the AICPA (American Institute of Certified Public Accountans)/CICA (Canadian Institute of Chartered Accountants) Privacy Maturity Model (PMM). Albert thinks the model is a useful way to measure Treasure Box's ability to protect personal data. Albert has noticed that Treasure Box fails to meet the requirements of the highest level of maturity of this model; at his interview, Albert will pledge to assist the company with meeting this level in order to provide customers with the most rigorous security available.
Albert does want to show a positive outlook during his interview. He intends to praise the company's commitment to the security of customer and employee personal data against external threats. However, Albert worries about the high turnover rate within the company, particularly in the area of direct phone marketing. He sees many unfamiliar faces every day who are hired to do the marketing, and he often hears complaints in the lunch room regarding long hours and low pay, as well as what seems to be flagrant disregard for company procedures.
In addition, Treasure Box has had two recent security incidents. The company has responded to the incidents with internal audits and updates to security safeguards. However, profits still seem to be affected and anecdotal evidence indicates that many people still harbor mistrust. Albert wants to help the company recover.
He knows there is at least one incident the public in unaware of, although Albert does not know the details. He believes the company's insistence on keeping the incident a secret could be a further detriment to its reputation. One further way that Albert wants to help Treasure Box regain its stature is by creating a toll-free number for customers, as well as a more efficient procedure for responding to customer concerns by postal mail.
In addition to his suggestions for improvement, Albert believes that his knowledge of the company's recent business maneuvers will also impress the interviewers. For example, Albert is aware of the company's intention to acquire a medical supply company in the coming weeks.
With his forward thinking, Albert hopes to convince the managers who will be interviewing him that he is right for the job.
Based on Albert's observations, executive leadership should most likely pay closer attention to what?
答案：D
問題 #117
In addition to regulatory requirements and business practices, what important factors must a global privacy strategy consider?
答案：C
解題說明：
In addition to regulatory requirements and business practices, an important factor that a global privacy strategy must consider is cultural norms. Different cultures may have different expectations and preferences regarding privacy, such as what constitutes personal information, how consent is obtained and expressed, how data is used and shared, and how privacy rights are enforced. A global privacy strategy should respect and accommodate these cultural differences and ensure that the organization's privacy practices are transparent, fair, and consistent across different regions. References: [IAPP CIPM Study Guide], page 81-82; [Cultural Differences in Privacy Expectations]
問題 #118
......
CIPM考古題: https://www.kaoguti.com/CIPM_exam-pdf.html
P.S. KaoGuTi在Google Drive上分享了免費的、最新的CIPM考試題庫：https://drive.google.com/open?id=1mnloTaZF1O_ug9fKxlmWtIXbSaB5y7O6