Free IAPP CIPP-US Exam Questions

Become IAPP Certified with updated CIPP-US exam questions and correct answers

Page: 1 / 41

Total 201 Questions | Updated On: Dec 08, 2025

Add To Cart

Question 1

Which of the following is NOT a principle found in the APEC Privacy Framework?

A : tegrity of Personal Information.

B : cess and Correction.

C : eventing Harm

D : ivacy by Design.

Answer: D

Question 2

SCENARIO

Please use the following to answer the next question:

Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier

to the U.S. Department of Defense and other U.S. federal agencies. Jane's manager, Patrick, is a French

citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is

an insider secretly transmitting trade secrets to foreign intelligence. Unbeknownst to Patrick, the FBI has

already received a hint from anonymous whistleblower, and jointly with the National Security Agency is

investigating Jane's possible implication in a sophisticated foreign espionage campaign.

Ever since the pandemic, Jane has been working from home. To complete her daily tasks she uses her

corporate laptop, which after each login conspicuously provides notice that the equipment belongs to Jones

Labs and may be monitored according to the enacted privacy policy and employment handbook. Jane also has

a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment

contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook

are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal

iPhone that she uses for private purposes only.

Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers.

The secondary data center, managed by Amazon AWS, is physically located in the UK for disaster recovery

purposes. Jones Labs' mobile devices backup is managed by a mid-sized mobile defense company located in

Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are

securely stored in a Microsoft Office 365 data center based in Ireland. Manufacturing data of Jones Labs is

stored in Taiwan and managed by a local supplier that has no presence in the U.S.

When storing Jane's fingerprint for remote authentication. Jones Labs should consider legality issues under

which of the following?

A : Privacy Rule of the HITECH Act.

B : California IoT Security Law (SB 327).

C : applicable state law such as Illinois BIPA.

D : federal Genetic Information Nondiscrimination Act (GINA).

Answer: C

Question 3

An organization self-certified under Privacy Shield must, upon request by an individual, do what?

A : pend the use of all personal information collected by the organization to fulfill its original purpose

B : ovide the identities of third parties with whom the organization shares personal information.

C : ovide the identities of third and fourth parties that may potentially receive personal information

D : Identify all personal information disclosed during a criminal investigation

Answer: B

Question 4

The Cable Communications Policy Act of 1984 requires which activity?

A : livery of an annual notice detailing how subscriber information is to be used

B : Destruction of personal information a maximum of six months after it is no longer needed

C : tice to subscribers of any investigation involving unauthorized reception of cable services

D : taining subscriber consent for disseminating any personal information necessary to render cable services

Answer: C

Question 5

Mega Corp. is a U.S.-based business with employees in California, Virginia, and Colorado. Which of the following must Mega Corp. comply with in regard to its human resources data?

A : lifornia Privacy Rights Act.

B : lifornia Privacy Rights Act and Virginia Consumer Data Protection Act.

C : lifornia Privacy Rights Act and Colorado Privacy Act.

D : lifornia Privacy Rights Act, Virginia Consumer Data Protection Act, and Colorado Privacy Act.

Answer: D

Page: 1 / 41

Total 201 Questions | Updated On: Dec 08, 2025

Add To Cart