CIPP-US practice questions 191–200

1. Question 191 · 236 in bank

   Which of the following practices is NOT a key component of a data ethics framework?

   • AAutomated decision-making.
   • BPreferability testing.
   • CData governance.
   • DAuditing.

   Show answer

   Answer: B

   Next question

2. Question 192 · 236 in bank

   Under the Driver’s Privacy Protection Act (DPPA), which of the following parties would require consent of an individual in order to obtain his or her Department of Motor Vehicle information?

   • ALaw enforcement agencies performing investigations.
   • BInsurance companies needing to investigate claims.
   • CAttorneys gathering information related to lawsuits.
   • DMarketers wishing to distribute bulk materials.

   Show answer

   Answer: D

   Next question

3. Question 193 · 236 in bank

   As a result of the Schrems II decision and CJEU opinion, what would the preferred course of action be if a Section 702 disclosure related to a foreign entity is required?

   • AEnsure that the most recent SCC from the European Commission is being executed as a valid method of adequacy.
   • BProvide 30 days notice to affected parties to allow the opportunity for filing a motion to quash with the court.
   • CSeek redress from the court pursuing a protective order, since the consumer is unable to file a motion to quash.
   • DSeek the advice of outside counsel and conduct a transfer impact assessment.

   Show answer

   Answer: D

   Next question

4. Question 194 · 236 in bank

   Which of the following conditions would NOT be sufficient to excuse an entity from providing breach notification under state law?

   • AIf the data involved was encrypted.
   • BIf the data involved was accessed but not exported.
   • CIf the entity was subject to the GLBA Safeguards Rule.
   • DIf the entity followed internal notification procedures compatible with state law.

   Show answer

   Answer: C

   Next question

5. Question 195 · 236 in bank

   The CFO of a pharmaceutical company is duped by a phishing email and discloses many of the company’s employee personnel files to an online predator. The files include employee contact information, job applications, performance reviews, discipline records, and job descriptions. Which of the following state laws would be an affected employee’s best recourse against the employer?

   • AThe state social security number confidentiality statute.
   • BThe state personnel record review statute.
   • CThe state data destruction statute.
   • DThe state UDAP statute.

   Show answer

   Answer: B

   Next question

6. Question 196 · 236 in bank

   SuperMart is a large Nevada-based business that has recently determined it sells what constitutes “covered information” under Nevada’s privacy law, Senate Bill 260. Which of the following privacy compliance steps would best help SuperMart comply with the law?

   • AProviding a mechanism for consumers to opt out of sales.
   • BImplementing internal protocols for handling access and deletion requests.
   • CPreparing a notice of financial incentive for any loyalty programs offered to its customers.
   • DReviewing its vendor contracts to ensure that the vendors are subject to service provider restrictions.

   Show answer

   Answer: A

   Next question

7. Question 197 · 236 in bank

   Which of the following privacy rights is NOT available under the Colorado Privacy Act?

   • AThe right to access sensitive data.
   • BThe right to correct sensitive data.
   • CThe right to delete sensitive data.
   • DThe right to limit the use of sensitive data.

   Show answer

   Answer: D

   Next question

8. Question 198 · 236 in bank

   The California Privacy Rights Act (CPRA) expands upon a number of topics previously introduced in the California Consumer Privacy Act (CCPA). Which of the following was already part of the CCPA?

   • ARisk assessments.
   • BCybersecurity audits.
   • CPrivate right of action.
   • DAutomated decision-making.

   Show answer

   Answer: C

   Next question

9. Question 199 · 236 in bank

   Under GLBA, which of these organizations would not be required to provide its customers with an annual privacy notice?

   • AAn insurance company that has no privacy department.
   • BAn auction house that also acts as a financial institution.
   • CA credit union that has made changes to its privacy notice from last year.
   • DA credit union that has not made changes to its privacy notice from last year.

   Show answer

   Answer: D

   Next question

10. Question 200 · 236 in bank

    The concept of data portability refers to what?

    • AThe practice of disclosing all the data sources one organization uses to enhance data collection from different social media platforms.
    • BThe technical measures organizations use to empower consumers’ control in case data is being transferred to service providers.
    • CThe ability of individuals to obtain and reuse their personal data for their own purposes across different services.
    • DThe ability of individuals to easily change to another similar service provider if fees are unlawfully being raised.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-US practice, question 191. 236 questions available.