DOWNLOAD the newest VCEPrep CIPM PDF dumps from Cloud Storage for free: https://drive.google.com/open?id=1Skex3S_gyvDDQRzcn92RB9lrA1pavlI4
If you buy the VCEPrep's products, we will not only spare no effort to help you pass the certification exam, but also provide a free update and upgrade service. If the official change the outline of the certification exam, we will notify customers immediately. If we have any updated version of test software, it will be immediately pushed to customers. VCEPrep can promise to help you succeed to pass your first IAPP Certification CIPM Exam.
| Section | Weight | Objectives |
|---|---|---|
| Responding to Requests and Incidents | 14–18% | - Data subject rights management - Breach detection, notification and remediation - Privacy incident response plan - Regulatory interaction and reporting |
| Developing a Privacy Program Framework | 15–20% | - Program governance structure and roles - Privacy vision, strategy and objectives - Legal and regulatory requirements - Program scope and boundaries |
| Assessing Data and Privacy Risks | 17–22% | - Privacy impact assessments (PIA/DPIA) - Compliance gap analysis - Risk identification, analysis and mitigation - Data inventory and mapping |
| Establishing Program Governance | 17–22% | - Policies, procedures and standards - Training and awareness programs - Stakeholder engagement and communication - Accountability and oversight mechanisms |
| Sustaining Program Performance | 10–15% | - Continuous improvement - Monitoring, auditing and reporting - Change management - Performance metrics and KPIs |
| Protecting Personal Data | 12–18% | - Technical and organizational safeguards - Privacy by design and default - Data lifecycle management - Cross-border data transfers |
>> CIPM Dumps Free Download <<
Our CIPM training materials are compiled carefully with correct understanding of academic knowledge using the fewest words to express the most clear ideas, rather than unnecessary words expressions or sentences and try to avoid out-of-date words. And our CIPM Exam Questions are always the latest questions and answers for our customers since we keep updating them all the time to make sure our CIPM study guide is valid and the latest.
NEW QUESTION # 168
SCENARIO
Please use the following to answer the next QUESTION:
Martin Briseño is the director of human resources at the Canyon City location of the U.S. hotel chain Pacific Suites. In 1998, Briseño decided to change the hotel's on-the-job mentoring model to a standardized training program for employees who were progressing from line positions into supervisory positions. He developed a curriculum comprising a series of lessons, scenarios, and assessments, which was delivered in-person to small groups. Interest in the training increased, leading Briseño to work with corporate HR specialists and software engineers to offer the program in an online format. The online program saved the cost of a trainer and allowed participants to work through the material at their own pace.
Upon hearing about the success of Briseño's program, Pacific Suites corporate Vice President Maryanne Silva-Hayes expanded the training and offered it company-wide. Employees who completed the program received certification as a Pacific Suites Hospitality Supervisor. By 2001, the program had grown to provide industry-wide training. Personnel at hotels across the country could sign up and pay to take the course online.
As the program became increasingly profitable, Pacific Suites developed an offshoot business, Pacific Hospitality Training (PHT). The sole focus of PHT was developing and marketing a variety of online courses and course progressions providing a number of professional certifications in the hospitality industry.
By setting up a user account with PHT, course participants could access an information library, sign up for courses, and take end-of-course certification tests. When a user opened a new account, all information was saved by default, including the user's name, date of birth, contact information, credit card information, employer, and job title. The registration page offered an opt-out choice that users could click to not have their credit card numbers saved. Once a user name and password were established, users could return to check their course status, review and reprint their certifications, and sign up and pay for new courses. Between 2002 and
2008, PHT issued more than 700,000 professional certifications.
PHT's profits declined in 2009 and 2010, the victim of industry downsizing and increased competition from e- learning providers. By 2011, Pacific Suites was out of the online certification business and PHT was dissolved. The training program's systems and records remained in Pacific Suites' digital archives, un- accessed and unused. Briseño and Silva-Hayes moved on to work for other companies, and there was no plan for handling the archived data after the program ended. After PHT was dissolved, Pacific Suites executives turned their attention to crucial day-to-day operations. They planned to deal with the PHT materials once resources allowed.
In 2012, the Pacific Suites computer network was hacked. Malware installed on the online reservation system exposed the credit card information of hundreds of hotel guests. While targeting the financial data on the reservation site, hackers also discovered the archived training course data and registration accounts of Pacific Hospitality Training's customers. The result of the hack was the exfiltration of the credit card numbers of recent hotel guests and the exfiltration of the PHT database with all its contents.
A Pacific Suites systems analyst discovered the information security breach in a routine scan of activity reports. Pacific Suites quickly notified credit card companies and recent hotel guests of the breach, attempting to prevent serious harm. Technical security engineers faced a challenge in dealing with the PHT data.
PHT course administrators and the IT engineers did not have a system for tracking, cataloguing, and storing information. Pacific Suites has procedures in place for data access and storage, but those procedures were not implemented when PHT was formed. When the PHT database was acquired by Pacific Suites, it had no owner or oversight. By the time technical security engineers determined what private information was compromised, at least 8,000 credit card holders were potential victims of fraudulent activity.
In the Information Technology engineers had originally set the default for customer credit card information to
"Do Not Save," this action would have been in line with what concept?
Answer: A
NEW QUESTION # 169
SCENARIO
Please use the following to answer the next QUESTION:
You lead the privacy office for a company that handles information from individuals living in several countries throughout Europe and the Americas. You begin that morning's privacy review when a contracts officer sends you a message asking for a phone call. The message lacks clarity and detail, but you presume that data was lost.
When you contact the contracts officer, he tells you that he received a letter in the mail from a vendor stating that the vendor improperly shared information about your customers. He called the vendor and confirmed that your company recently surveyed exactly 2000 individuals about their most recent healthcare experience and sent those surveys to the vendor to transcribe it into a database, but the vendor forgot to encrypt the database as promised in the contract. As a result, the vendor has lost control of the data.
The vendor is extremely apologetic and offers to take responsibility for sending out the notifications. They tell you they set aside 2000 stamped postcards because that should reduce the time it takes to get the notice in the mail. One side is limited to their logo, but the other side is blank and they will accept whatever you want to write. You put their offer on hold and begin to develop the text around the space constraints. You are content to let the vendor's logo be associated with the notification.
The notification explains that your company recently hired a vendor to store information about their most recent experience at St. Sebastian Hospital's Clinic for Infectious Diseases. The vendor did not encrypt the information and no longer has control of it. All 2000 affected individuals are invited to sign-up for email notifications about their information. They simply need to go to your company's website and watch a quick advertisement, then provide their name, email address, and month and year of birth.
You email the incident-response council for their buy-in before 9 a.m. If anything goes wrong in this situation, you want to diffuse the blame across your colleagues. Over the next eight hours, everyone emails their comments back and forth. The consultant who leads the incident-response team notes that it is his first day with the company, but he has been in other industries for 45 years and will do his best. One of the three lawyers on the council causes the conversation to veer off course, but it eventually gets back on track. At the end of the day, they vote to proceed with the notification you wrote and use the vendor's postcards.
Shortly after the vendor mails the postcards, you learn the data was on a server that was stolen, and make the decision to have your company offer credit monitoring services. A quick internet search finds a credit monitoring company with a convincing name: Credit Under Lock and Key (CRUDLOK). Your sales rep has never handled a contract for 2000 people, but develops a proposal in about a day which says CRUDLOK will:
1.Send an enrollment invitation to everyone the day after the contract is signed.
2.Enroll someone with just their first name and the last-4 of their national identifier.
3.Monitor each enrollee's credit for two years from the date of enrollment.
4.Send a monthly email with their credit rating and offers for credit-related services at market rates.
5.Charge your company 20% of the cost of any credit restoration.
You execute the contract and the enrollment invitations are emailed to the 2000 individuals. Three days later you sit down and document all that went well and all that could have gone better. You put it in a file to reference the next time an incident occurs.
What is the most concerning limitation of the incident-response council?
Answer: C
Explanation:
Explanation
This answer is the most concerning limitation of the incident-response council, as it indicates a lack of efficiency, urgency and coordination in handling the incident. It takes eight hours of emails to come to a decision means that the council is wasting valuable time and resources in communicating and resolving the incident, which may result in delayed or inadequate actions, increased harm or impact to the affected individuals or the organization, or non-compliance with any legal or contractual obligations or deadlines.
NEW QUESTION # 170
SCENARIO
Please use the following to answer the next question:
Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry has always focused on production - not data processing - and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers. Anton knows that a single break-in could irrevocably damage the company's relationship with its loyal customers. He intends to set a goal of guaranteed zero loss of personal information.
To this end, Anton originally planned to place restrictions on who was admitted to the physical premises of the company. However, Kenneth - his uncle's vice president and longtime confidante - wants to hold off on Anton's idea in favor of converting any paper records held at the company to electronic storage. Kenneth believes this process would only take one or two years. Anton likes this idea; he envisions a password- protected system that only he and Kenneth can access.
Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job easier, but it will simplify the management of the stored data. The heads of subsidiaries like the art gallery and kitchenware store down the street will be responsible for their own information management. Then, any unneeded subsidiary data still in Anton's possession can be destroyed within the next few years.
After learning of a recent security incident, Anton realizes that another crucial step will be notifying customers. Kenneth insists that two lost hard drives in Question not cause for concern; all of the data was encrypted and not sensitive in nature. Anton does not want to take any chances, however. He intends on sending notice letters to all employees and customers to be safe.
Anton must also check for compliance with all legislative, regulatory, and market requirements related to privacy protection. Kenneth oversaw the development of the company's online presence about ten years ago, but Anton is not confident about his understanding of recent online marketing laws. Anton is assigning another trusted employee with a law background the task of the compliance assessment. After a thorough analysis, Anton knows the company should be safe for another five years, at which time he can order another check.
Documentation of this analysis will show auditors due diligence.
Anton has started down a long road toward improved management of the company, but he knows the effort is worth it. Anton wants his uncle's legacy to continue for many years to come.
What would the company's legal team most likely recommend to Anton regarding his planned communication with customers?
Answer: A
NEW QUESTION # 171
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
What should you do first to ascertain additional information about the loss of data?
Answer: D
Explanation:
This answer is the best way to ascertain additional information about the loss of data, as it allows you to gather relevant facts and details from the person who witnessed or experienced the incident. A standard protocol for interviewing the person reporting the incident should include questions such as:
When and where did the incident occur?
What type and amount of data was involved?
How was the data stored or protected on the laptop?
Who else had access to or knowledge of the laptop or the data?
What actions have been taken so far to recover or secure the laptop or the data?
How did you discover or report the incident?
Do you have any evidence or clues about who may have taken or accessed the laptop or the data?
Do you have any other information that may be relevant or helpful for the investigation? Interviewing the person reporting the incident following a standard protocol can help you to establish a clear timeline and scope of the incident, identify potential sources of evidence, assess the level of risk and harm to the individuals and the organization, and determine the next steps for responding to and resolving the incident. Reference: IAPP CIPM Study Guide, page 87; ISO/IEC 27002:2013, section 16.1.4
NEW QUESTION # 172
SCENARIO
Please use the following to answer the next QUESTION:
Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo.
A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won't listen to me," Paul says,
"but he may pay attention to an expert."
Gadgo's workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company's procedures and technologies for data protection. It's a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don't want unnecessary measures that will only slow people down and clutter their thoughts." The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A
"cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!" What would be the best kind of audit to recommend for Gadgo?
Answer: C
Explanation:
Explanation
This answer is the best kind of audit to recommend for Gadgo, as it can provide an independent and objective assessment of the company's privacy program and practices, as well as identify any gaps, weaknesses or risks that need to be addressed or improved. A third-party audit is conducted by an external auditor who has the necessary expertise, experience and credentials to evaluate the company's compliance with the applicable laws, regulations, standards and best practices for data protection. A third-party audit can also help to enhance the company's reputation and trust among its customers, partners and stakeholders, as well as demonstrate its commitment and accountability for privacy protection. References: IAPP CIPM Study Guide, page 881; ISO/IEC 27002:2013, section 18.2.1
NEW QUESTION # 173
......
If you are ready for the CIPM exam for a long time, but lack of a set of suitable CIPM learning materials, I will tell you that you are so lucky to enter this page. We are such CIPM exam questions that you can use our products to prepare the exam and obtain your dreamed CIPMcertificates. We all know that if you desire a better job post, you have to be equipped with appropriate professional quality and an attitude of keeping forging ahead. And we can give what you need!
Valid Braindumps CIPM Book: https://www.vceprep.com/CIPM-latest-vce-prep.html
BTW, DOWNLOAD part of VCEPrep CIPM dumps from Cloud Storage: https://drive.google.com/open?id=1Skex3S_gyvDDQRzcn92RB9lrA1pavlI4