IAPP CIPM Practice Exams
Last updated on Oct 22,2026- Exam Code: CIPM
- Exam Name: Certified Information Privacy Manager (CIPM)
- Certification Provider: IAPP
- Latest update: Oct 22,2026
Which of the following best demonstrates the effectiveness of a firm’s privacy incident response process?
- A . The decrease of security breaches
- B . The decrease of notifiable breaches
- C . The increase of privacy incidents reported by users
- D . The decrease of mean time to resolve privacy incidents
Which of the following best demonstrates the effectiveness of a firm’s privacy incident response process?
- A . The decrease of security breaches
- B . The decrease of notifiable breaches
- C . The increase of privacy incidents reported by users
- D . The decrease of mean time to resolve privacy incidents
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company’s product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year’s conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It’s going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she’d been given to build the app, she outsourced the job to a local firm. "It’s just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them."
Deidre is a terrific employee with a strong track record. That’s why she’s been charged to deliver this rushed project. You’re sure she has the best interests of the company at heart, and you don’t doubt that she’s under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app’s handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I’m sure with your help we can fix any security issues if we have to, but I doubt there’ll be any. These people build apps for a living, and they know what they’re doing. You worry too much, but that’s why you’re so good at your job!"
You want to point out that normal protocols have NOT been followed in this matter.
Which process in particular has been neglected?
- A . Forensic inquiry.
- B . Data mapping.
- C . Privacy breach prevention.
- D . Vendor due diligence vetting.
What should a privacy professional keep in mind when selecting which metrics to collect?
- A . Metrics should be reported to the public.
- B . The number of metrics should be limited at first.
- C . Metrics should reveal strategies for increasing company earnings.
- D . A variety of metrics should be collected before determining their specific functions.
A Human Resources director at a company reported that a laptop containing employee payroll data was lost on the train.
Which action should the company take IMMEDIATELY?
- A . Report the theft to law enforcement
- B . Wipe the hard drive remotely
- C . Report the theft to the senior management
- D . Perform a multi-factor risk analysis
What are you doing if you succumb to "overgeneralization" when analyzing data from metrics?
- A . Using data that is too broad to capture specific meanings.
- B . Possessing too many types of data to perform a valid analysis.
- C . Using limited data in an attempt to support broad conclusions.
- D . Trying to use several measurements to gauge one aspect of a program.
When supporting the business and data privacy program expanding into a new jurisdiction, it is important to do all of the following EXCEPT?
- A . Identify the stakeholders.
- B . Appoint a new Privacy Officer (PO) for that jurisdiction.
- C . Perform an assessment of the laws applicable in that new jurisdiction.
- D . Consider culture and whether the privacy framework will need to account for changes in culture.
Which of the following is TRUE about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR)?
- A . The DPIA result must be reported to the corresponding supervisory authority.
- B . The DPIA report must be published to demonstrate the transparency of the data processing.
- C . The DPIA must include a description of the proposed processing operation and its purpose.
- D . The DPIA is required if the processing activity entails risk to the rights and freedoms of an EU individual.
Which of the following is TRUE about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR)?
- A . The DPIA result must be reported to the corresponding supervisory authority.
- B . The DPIA report must be published to demonstrate the transparency of the data processing.
- C . The DPIA must include a description of the proposed processing operation and its purpose.
- D . The DPIA is required if the processing activity entails risk to the rights and freedoms of an EU individual.
SCENARIO
Please use the following to answer the next QUESTION:
Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather’s law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office’s strategies for growth.
Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients’ personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/ printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year’s end.
Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed.
Richard needs to closely monitor the vendor in charge of creating the firm’s database mainly because of what?
- A . The vendor will be required to report any privacy violations to the appropriate authorities.
- B . The vendor may not be aware of the privacy implications involved in the project.
- C . The vendor may not be forthcoming about the vulnerabilities of the database.
- D . The vendor will be in direct contact with all of the law firm’s personal data.