CIPM practice questions 241–247

1. Question 241 · 247 in bank

   In regards to the collection of personal data conducted by an organization, what must the data subject be allowed to do?

   • AEvaluate the qualifications of a third-party processor before any data is transferred to that processor.
   • BSet a time-limit as to how long the personal data may be stored by the organization.
   • CChallenge the authenticity of the personal data and have it corrected if needed.
   • DObtain a guarantee of prompt notification in instances involving unauthorized access of the data.

   Show answer

   Answer: C

   Next question

2. Question 242 · 247 in bank

   Which of the following information is NOT required to be provided by the data controller when complying with GDPR "right to access" requirements?

   • AThe data subject request process.
   • BThe purpose of personal data processing.
   • CThe name of the Data Protection Officer (DPO).
   • DThe type of organizations with whom personal data was shared.

   Show answer

   Answer: A

   Next question

3. Question 243 · 247 in bank

   You're managing the internal privacy mailbox and are notified that a sales team member recently sent emails to their clients that included an excel spreadsheet of their client data. They just realized that the spreadsheet only hid the data of other clients and was not deleted. How do you respond?

   • AConfirm they have deleted the spreadsheet and requested all clients to do the same.
   • BAsk what type of data was included on the spreadsheet and trigger an incident notice.
   • CAsk them to send you the spreadsheet and advise them to notify the clients' cyber security team.
   • DConfirm how many people received the spreadsheet and advise the employee to keep this issue to themselves.

   Show answer

   Answer: B

   Next question

4. Question 244 · 247 in bank

   An online retailer detects an incident involving customer shopping history but no keys have been compromised. The Privacy Office is most concerned when it also involves?

   • AInternal unique personal identifiers.
   • BPlain text personal identifiers.
   • CHashed mobile identifiers.
   • DNo personal identifiers.

   Show answer

   Answer: B

   Next question

5. Question 245 · 247 in bank

   When implementing a privacy program for your organization, it is important to first understand?

   • AThe stakeholder needs across key business units.
   • BThe company's strategic objectives.
   • CThe internal privacy policies.
   • DThe applicable laws and regulations.

   Show answer

   Answer: B

   Next question

6. Question 246 · 247 in bank

   An avionics company considering deploying an AI algorithm as part of an autopilot system should be primarily concerned with which attribute of the AI system?

   • ASecurity.
   • BTransparency.
   • CExplainability.
   • DAccountability.

   Show answer

   Answer: A

   Next question

7. Question 247 · 247 in bank

   Select 3

   Select 3 of the following 5 options. No partial credit will be given. Which of the following are technical data controls? (Choose three.)

   • AFirewall.
   • BEncryption.
   • CData minimization.
   • DPseudonymization.
   • EMultifactor authentication.

   Show answer

   Answer: ABD

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPM practice, question 241. 247 questions available.