Use Real CIPP-US - 100% Cover Real Exam Questions [Aug-2021]
Dumps Brief Outline Of The CIPP-US Exam - ActualCollection
NEW QUESTION 91
The rules for "e-discovery" mainly prevent which of the following?
- A. A conflict between business practice and technological safeguards
- B. The loss of information due to poor data retention practices
- C. A breach of an organization's data retention program
- D. The practice of employees using personal devices for work
Answer: B
NEW QUESTION 92
Which entity within the Department of Health and Human Services (HHS) is the primary enforcer of the Health Insurance Portability and Accountability Act (HIPAA) "Privacy Rule"?
- A. Office of Inspector General.
- B. Office for Civil Rights.
- C. Office of Social Services.
- D. Office of Public Health and Safety.
Answer: B
NEW QUESTION 93
SCENARIO
Please use the following to answer the next QUESTION:
Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer's privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.
Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.
After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer's personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.
Janice understood Cheryl's concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company's day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.
Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.
What is the most likely risk of Fitness Coach, Inc. adopting Janice's first draft of the privacy policy?
- A. Not being in standard compliance with applicable laws
- B. Showing a lack of trust in the organization's privacy practices
- C. Leaving the company susceptible to violations by setting unrealistic goals
- D. Failing to meet the needs of customers who are concerned about privacy
Answer: C
NEW QUESTION 94
What is an exception to the Electronic Communications Privacy Act of 1986 ban on interception of wire, oral and electronic communications?
- A. If an organization intercepts an employee's purely personal call
- B. Where state law permits such interception
- C. Where one of the parties has given consent
- D. Only if all parties have given consent
Answer: A
Explanation:
Explanation/Reference: https://www.sciencedirect.com/topics/computer-science/electronic-communications-privacy-act
NEW QUESTION 95
An organization self-certified under Privacy Shield must, upon request by an individual, do what?
- A. Identify all personal information disclosed during a criminal investigation.
- B. Provide the identities of third and fourth parties that may potentially receive personal information.
- C. Suspend the use of all personal information collected by the organization to fulfill its original purpose.
- D. Provide the identities of third parties with whom the organization shares personal information.
Answer: D
Explanation:
Explanation/Reference: https://www.lakesidesoftware.com/sites/default/files/Privacy_Shield_Privacy_Statement.pdf
NEW QUESTION 96
SCENARIO
Please use the following to answer the next QUESTION
Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in Californi a. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants' postings on social media, ask Question:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.
Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle's GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.
Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia's concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it's unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.
In any case, Celeste feels that all they need is common sense - like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she's right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.
Which law will be most relevant to Felicia's plan to ask applicants about drug addiction?
- A. The Occupational Safety and Health Act (OSHA).
- B. The Genetic Information Nondiscrimination Act of 2008.
- C. The Health Insurance Portability and Accountability Act (HIPAA).
- D. The Americans with Disabilities Act (ADA).
Answer: D
NEW QUESTION 97
Which of the following best describes private-sector workplace monitoring in the United States?
- A. Employers have broad authority to monitor their employees
- B. Judgments in private lawsuits have severely limited the monitoring of employees
- C. Most employees are protected from workplace monitoring by the U.S. Constitution
- D. U.S. federal law restricts monitoring only to industries for which it is necessary
Answer: A
NEW QUESTION 98
SCENARIO
Please use the following to answer the next QUESTION:
A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.
The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal dat a. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: "Please act immediately by identifying all personal data received from our company." This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.
As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.
Upon review, the data privacy leader discovers that the Company's documented data inventory is obsolete. What is the data privacy leader's next best source of information to aid the investigation?
- A. Lists of all customers, sorted by country
- B. Interviews with key marketing personnel
- C. Database schemas held by the retailer
- D. Reports on recent purchase histories
Answer: A
NEW QUESTION 99
Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely to default will receive frequent payment reminder calls, while those who are less likely to default will not receive payment reminders.
Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using artificial intelligence in this manner?
- A. If the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.
- B. If the algorithm uses information about protected classes to make automated decisions, Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.
- C. If the algorithm makes automated decisions based on risk factors and public information, Acme need not determine if the algorithm has a disparate impact on protected classes.
- D. If the algorithm's methodology is disclosed to consumers, then it is acceptable for Acme to have a disparate impact on protected classes.
Answer: C
NEW QUESTION 100
All of the following common law torts are relevant to employee privacy under US law EXCEPT?
- A. Intrusion upon seclusion.
- B. Defamation
- C. Conversion.
- D. Infliction of emotional distress.
Answer: A
NEW QUESTION 101
What is the main reason some supporters of the European approach to privacy are skeptical about self- regulation of privacy practices?
- A. A new business owner may not understand the regulations
- B. Human rights may be disregarded for the sake of privacy
- C. Industries may not be strict enough in the creation and enforcement of rules
- D. A large amount of money may have to be sent on improved technology and security
Answer: C
NEW QUESTION 102
SCENARIO
Please use the following to answer the next QUESTION
When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated dat a. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.
Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.
When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.
Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.
What could the company have done differently prior to the breach to reduce their risk?
- A. Looked for any persistent threats to security that could compromise the company's network.
- B. Implemented a comprehensive policy for accessing customer information.
- C. Communicated requests for changes to users' preferences across the organization and with third parties.
- D. Honored the promise of its privacy policy to acquire information by using an opt-in method.
Answer: A
NEW QUESTION 103
Which authority supervises and enforces laws regarding advertising to children via the Internet?
- A. The Office for Civil Rights
- B. The Department of Homeland Security
- C. The Federal Trade Commission
- D. The Federal Communications Commission
Answer: C
NEW QUESTION 104
Which of the following is NOT a principle found in the APEC Privacy Framework?
- A. Preventing Harm.
- B. Integrity of Personal Information.
- C. Privacy by Design.
- D. Access and Correction.
Answer: C
NEW QUESTION 105
The U.S. Supreme Court has recognized an individual's right to privacy over personal issues, such as contraception, by acknowledging which of the following?
- A. Federal preemption of state constitutions that expressly recognize an individual right to privacy.
- B. The doctrine of stare decisis, which allows the U.S. Supreme Court to follow the precedent of previously decided case law.
- C. An interpretation of the U.S. Constitution's explicit definition of privacy that extends to personal issues.
- D. A "penumbra" of unenumerated constitutional rights as well as more general protections of due process of law.
Answer: D
NEW QUESTION 106
Federal laws establish which of the following requirements for collecting personal information of minors under the age of 13?
- A. Affirmative consent from a minor's parent or guardian before collecting the minor's personal information online.
- B. Implied consent from a minor's parent or guardian before collecting a minor's personal information online, such as when they permit the minor to use the internet.
- C. Implied consent from a minor's parent or guardian, or affirmative consent from the minor.
- D. Affirmative consent of a parent or guardian before collecting personal information of a minor offline (e.g., in person), which also satisfies any requirements for online consent.
Answer: A
NEW QUESTION 107
Which statement is FALSE regarding the provisions of the Employee Polygraph Protection Act of 1988 (EPPA)?
- A. Employers are prohibited from administering psychological testing based on personality traits such as honesty, preferences or habits.
- B. The EPPA includes an exception that allows polygraph tests in professions in which employee honesty is necessary for public safety.
- C. The EPPA requires that employers post essential information about the Act in a conspicuous location.
- D. Employers involved in the manufacture of controlled substances may terminate employees based on polygraph results if other evidence exists.
Answer: A
Explanation:
Section: (none)
Explanation
NEW QUESTION 108
A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data.
What law did ACME violate by designing the service to prevent access to the information by a law enforcement agency?
- A. SCA
- B. ECPA
- C. CALEA
- D. USA Freedom Act
Answer: C
Explanation:
Explanation
Explanation/Reference: https://www.nap.edu/read/11896/chapter/11#283
NEW QUESTION 109
Which of the following became the first state to pass a law specifically regulating the collection of biometric data?
- A. Washington.
- B. Illinois.
- C. California.
- D. Texas.
Answer: B
NEW QUESTION 110
SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your network?" Matt asked hopefully.
"No," the boy said. "I'm filling out a survey."
Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking Questions about my opinions."
"Let me see," Matt said, and began reading the list of Questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
How does Matt come to the decision to report the marketer's activities?
- A. The marketer failed to identify himself and indicate the purpose of the messages
- B. The marketer did not provide evidence that the prize books were appropriate for children
- C. The marketer seems to have distributed his son's information without Matt's permission
- D. The marketer failed to make an adequate attempt to provide Matt with information
Answer: D
NEW QUESTION 111
Who has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA)?
- A. The Federal Trade Commission
- B. State Attorneys General
- C. The Department of Commerce
- D. The Consumer Financial Protection Bureau
Answer: D
Explanation:
Explanation/Reference: https://www.ftc.gov/enforcement/statutes/fair-accurate-credit-transactions-act-2003
NEW QUESTION 112
SCENARIO
Please use the following to answer the next QUESTION
When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated dat a. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.
Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.
When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.
Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.
Based on the problems with the company's privacy security that Roberta identifies, what is the most likely cause of the breach?
- A. Fraud involving credit card theft at point-of-service terminals.
- B. Unintended disclosure of information shared with a third party.
- C. Lost company property such as a computer or flash drive.
- D. Mishandling of information caused by lack of access controls.
Answer: D
NEW QUESTION 113
Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer Protection Act?
- A. Financial institutions must cease sending e-mails and other forms of advertising to customers who opt out of direct marketing
- B. Financial institutions must avoid collecting a customer's sensitive personal information
- C. Financial institutions must use a prescribed level of encryption for most types of customer records
- D. Financial institutions must help ensure a customer's understanding of products and services
Answer: D
NEW QUESTION 114
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Which act would authorize Evan's undercover investigation?
- A. The Stored Communications Act (SCA)
- B. The Fair and Accurate Credit Transactions Act (FACTA)
- C. The National Labor Relations Act (NLRA)
- D. The Whistleblower Protection Act
Answer: C
NEW QUESTION 115
In what way does the "Red Flags Rule" under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?
- A. It does not apply because the owner is not a creditor
- B. It requires the owner to implement an identity theft warning system
- C. It mandates the use of updated technology for securing credit records
- D. It is not usually enforced in the case of a small financial institution
Answer: C
NEW QUESTION 116
......
Certification Training for CIPP-US Exam Dumps Test Engine: https://www.actualcollection.com/CIPP-US-exam-questions.html
CIPP-US Training & Certification Get Latest Certified Information Privacy Professional : https://drive.google.com/open?id=1j7gzQvVj7xx0D30DO9d-2UV8mHoKNuDB