CIPP-US practice questions 201–210

1. Question 201 · 236 in bank

   Which of the following is NOT a common challenge large organizations face when implementing data portability?

   • AThe presence of third-party data in the data to be ported.
   • BTechnically compatible systems for transmission feasibility.
   • CSecurity considerations in relation to the transfer of the data.
   • DThe technical skillsets available in the transmitting organization.

   Show answer

   Answer: D

   Next question

2. Question 202 · 236 in bank

   Under the EU-US Data Privacy Framework, what must participating organizations provide to individuals in regard to complaints and disputes?

   • AAn independent recourse mechanism.
   • BA copy of the individual’s personal data.
   • CA description of the organization’s data processing policies.
   • DA means of communicating with the organization’s privacy team.

   Show answer

   Answer: A

   Next question

3. Question 203 · 236 in bank

   SCENARIO - Please use the following to answer the next question: Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative. Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices’ branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service. Riya is the Privacy Officer at Miraculous, responsible for the practice’s compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective. Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps’ optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps. What is the most practical action Riya can take to minimize the privacy risks of using an app for telehealth appointments?

   • APrevent MedApps from using copies of the patient data.
   • BRequire MedApps to obtain consent from all patients.
   • CRequire MedApps to submit a SOC2 report.
   • DEngage in active oversight of MedApps.

   Show answer

   Answer: D

   Next question

4. Question 204 · 236 in bank

   SCENARIO - Please use the following to answer the next question: Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative. Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices’ branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service. Riya is the Privacy Officer at Miraculous, responsible for the practice’s compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective. Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps’ optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps. If MedApps receives an access request under CCPA from a California-based app user, how should it handle the request?

   • AMedApps should immediately begin deleting the user’s data.
   • BMedApps should provide the privacy notice in an easily readable format.
   • CMedApps should decline the request because MedApps is not based in California.
   • DMedApps should promptly forward the request to Miraculous for instructions on handling.

   Show answer

   Answer: D

   Next question

5. Question 205 · 236 in bank

   A software company wants to use web scraping to collect personal data from professional networking websites in order to train an artificial intelligence program to evaluate job applications. The company has identified several actions for limiting their potential legal liability regarding affected data subjects and professional networking websites. Which of the following would be the least effective action for helping them do this?

   • AFollowing the terms of use posted on professional networking websites that are scraped.
   • BAdding a notice to the company website’s terms of use disclosing the use of web scraping.
   • CLimiting the amount of the personally identifiable information they collect.
   • DDeidentifying the scraped data before selling it to any third parties.

   Show answer

   Answer: B

   Next question

6. Question 206 · 236 in bank

   Due to cookie deprecation, businesses will be required to simplify their tracking practices by doing what?

   • AEnsuring only registered users are tracked.
   • BRunning analytics only in dedicated sandboxes.
   • CPurging existing IDs that identify visitors by browser.
   • DDeleting their existing data sets of any third-party cookies

   Show answer

   Answer: B

   Next question

7. Question 207 · 236 in bank

   Which power was NOT granted to the California Privacy Protection Agency by the California Privacy Rights Act (CPRA)?

   • AAdopting and updating CCPA regulations.
   • BInvestigating possible violations of the CCPA on the agency’s own initiative.
   • COverriding decisions of the Attorney General regarding CCPA enforcement.
   • DImposing administrative fines for violations of the CCPA.

   Show answer

   Answer: C

   Next question

8. Question 208 · 236 in bank

   Which of the following data elements is most likely to be subject to comprehensive state data security and privacy laws?

   • AAccount holders’ social security numbers, maintained by a bank.
   • BUsers’ sexual orientations, maintained by a social media website.
   • CIndividual drivers’ license numbers, maintained by a state agency.
   • DContact details of individuals who report emergencies, maintained by local authorities.

   Show answer

   Answer: A

   Next question

9. Question 209 · 236 in bank

   In the U.S., it is a best practice (and in some states a requirement) to conduct a data protection assessment in which instance?

   • AWhen a background check is used as part of the hiring process.
   • BWhen any information is processed by a corporation.
   • CWhen trade secrets are shared with a third party.
   • DWhen technology is used to monitor employees.

   Show answer

   Answer: D

   Next question

10. Question 210 · 236 in bank

    What is the purpose of a cure provision in a state data privacy law?

    • ATo allow a business a limited timeframe to fix alleged violations before facing enforcement.
    • BTo allow consumers a period of time to discover their data has been mishandled.
    • CTo allow a state to initiate formal enforcement actions for a fixed time period.
    • DTo allow certain provisions of a law to expire after a defined time period.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-US practice, question 201. 236 questions available.