CIPP-C無料試験問題と解答PDF最新問題2022年11月
最新CIPP-C試験問題集で最近更新された151問題
IAPP CIPP-C 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 74
What is one reason the European Union has enacted more comprehensive privacy laws than the United States?
- A. To allow the free movement of data between member countries
- B. To ensure adequate enforcement of existing laws
- C. To ensure there is adequate funding for enforcement
- D. To allow separate industries to set privacy standards
正解: A
質問 75
A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States. What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?
- A. Seek informed consent from company employees.
- B. Restrict camera placement to building entrances only.
- C. Retain captured footage for no more than 30 days.
- D. Have cameras recording during work hours only.
正解: A
質問 76
Which of the following best describes an employer's privacy-related responsibilities to an employee who has left the workplace?
- A. An employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.
- B. An employer has a responsibility to maintain a former employee's access to computer systems and company data needed to support claims against the company such as discrimination.
- C. An employer may consider any privacy-related responsibilities terminated, as the relationship between employer and employee is considered primarily contractual.
- D. An employer has a responsibility to permanently delete or expunge all sensitive employment records to minimize privacy risks to both the employer and former employee.
正解: D
質問 77
Which authority supervises and enforces laws regarding advertising to children via the Internet?
- A. The Office for Civil Rights
- B. The Department of Homeland Security
- C. The Federal Communications Commission
- D. The Federal Trade Commission
正解: D
質問 78
A German data subject was the victim of an embarrassing prank 20 years ago. A newspaper website published an article about the prank at the time, and the article is still available on the newspaper's website.
Unfortunately, the prank is the top search result when a user searches on the victim's name. The data subject requests that SearchCo delist this result. SearchCo agrees, and instructs its technology team to avoid scanning or indexing the article. What else must SearchCo do?
- A. Notify the newspaper that its article it is delisting the article.
- B. Identify other controllers who are processing the same information and inform them of the delisting request.
- C. Fully erase the URL to the content, as opposed to delist which is mainly based on data subject's name.
- D. Prevent the article from being listed in search results no matter what search terms are entered into the search engine.
正解: A
質問 79
SCENARIO
Please use the following to answer the next question:
Dynaroux Fashion ('Dynaroux') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Ronan is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jonas, the CEO, tells Ronan that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Ronan tells the CEO that: (a) the potential risks of such activities means that Dynaroux needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Dynaroux may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jonas tells Ronan that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Dynaroux's business plan and associated processing activities.
Which of the following facts about Dynaroux would trigger a data protection impact assessment under the GDPR?
- A. The company intends to shift their business model to rely more heavily on online shopping.
- B. The company employs approximately 650 people and will therefore be carrying out extensive processing activities.
- C. The company plans to undertake profiling of its customers through analysis of their purchasing patterns.
- D. The company will be undertaking processing activities involving sensitive data categories such as financial and children's data.
正解: C
質問 80
Which of the following is most likely to provide privacy protection to private-sector employees in the United States?
- A. The U.S. Department of Health and Human Services (HHS)
- B. Amendments one, four, and five of the U.S. Constitution
- C. State law, contract law, and tort law
- D. The Federal Trade Commission Act (FTC Act)
正解: C
質問 81
Which of the following is NOT a role of works councils?
- A. Determining what changes will affect employee working conditions.
- B. Determining the monetary fines to be levied against employers for data breach violations of employee data.
- C. Determining whether employees' personal data can be processed or not.
- D. Determining whether to approve or reject certain decisions of the employer that affect employees.
正解: C
質問 82
Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?
- A. Only where the personal data is treated by automated means in some way, such as computerized distribution or filing.
- B. Only where the personal data is produced as a physical output of specific automated processing activities, such as printing, labelling, or stamping.
- C. Only where the personal data is to be subjected to specific computerized processing, such as image scanning or optical character recognition.
- D. Only where the personal data is handled in a sufficiently structured manner so as to form part of a filing system.
正解: D
質問 83
What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?
- A. Provide consumers with the opportunity to opt out of receiving telemarketing phone calls
- B. Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter's own use
- C. Conduct annual consumer surveys regarding satisfaction with user preferences
- D. Process requests for changes to user preferences within a designated time frame
正解: B
質問 84
John, a California resident, receives notification that a major corporation with $500 million in annual revenue has experienced a data breach. John's personal information in their possession has been stolen, including his full name and social security numb. John also learns that the corporation did not have reasonable cybersecurity measures in place to safeguard his personal information.
Which of the following answers most accurately reflects John's ability to pursue a legal claim against the corporation under the California Consumer Privacy Act (CCPA)?
- A. John has no right to sue the corporation because the CCPA does not address any data breach rights.
- B. John can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm.
- C. John can sue the corporation for the data breach but only to recover monetary damages he actually suffered as a result of the data breach.
- D. John cannot sue the corporation for the data breach because only the state's Attoney General has authority to file suit under the CCPA.
正解: C
質問 85
What is a legal document approved by a judge that formalizes an agreement between a governmental agency and an adverse party called?
- A. A consent decree
- B. Stare decisis decree
- C. Common law judgment
- D. A judgment rider
正解: A
質問 86
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing.
You worry too much, but that's why you're so good at your job!"
Which is the best first step in understanding the data security practices of a potential vendor?
- A. Examining investigation records of any breaches the vendor has experienced.
- B. Conducting a penetration test of the vendor's data security structure.
- C. Conducting a physical audit of the vendor's facilities.
- D. Requiring the vendor to complete a questionaire assessing International Organization for Standardization (ISO) 27001 compliance.
正解: A
質問 87
How is the retention of communications traffic data for law enforcement purposes addressed by Canadian data protection law?
- A. The ePrivacy Directive harmonizes rules concerning such data retention.
- B. The Data Retention Directive's annulment makes such data retention now permissible.
- C. The ePrivacy Directive allows individual to engage in such data retention.
- D. The GDPR allows the retention of such data for the prevention, investigation, detection or prosecution of criminal offences only.
正解: D
質問 88
What is the main reason some supporters of the European approach to privacy are skeptical about self-regulation of privacy practices?
- A. Human rights maybe disregarded for the sake of privacy
- B. A new business owner may not understand the regulations
- C. A large amount of money may have to be sent on improved technology and security
- D. Industries may not be strict enough in the creation and enforcement of rules
正解: D
質問 89
Under the Telemarketing Sales Rule, what characteristics of consent must be in place for an organization to acquire an exception to the Do-Not-Call rules for a particular consumer?
- A. The consent must be in writing, must state the times when calls can be made to the consumer and must be signed
- B. The consent must be in writing, must contain the number to which calls can be made and must have an end date
- C. The consent must be in writing, must have an end data and must state the times when calls can be made
- D. The consent must be in writing, must contain the number to which calls can be made and must be signed
正解: B
質問 90
When is data sharing agreement MOST likely to be needed?
- A. When anonymized data is being shared.
- B. When personal data is being shared between commercial organizations acting as joint data controllers.
- C. When personal data is being proactively shared by a controller to support a police investigation.
- D. When personal data is being shared with a public authority with powers to require the personal data to be disclosed.
正解: B
質問 91
What must a data controller do in order to make personal data pseudonymous?
- A. Encrypt the data in order to prevent any unauthorized access or modification.
- B. Separately hold any information that would allow linking the data to the data subject.
- C. Use the data only in aggregated form for research purposes.
- D. Remove all indirect data identifiers and dispose of them securely.
正解: B
質問 92
SCENARIO
Please use the following to answer the next QUESTION:
You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A.
HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B.
As part of HealthCo's business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth's security measures.A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals - ones that exposed the PHI of public figures including celebrities and politicians.
During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected.
A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual's ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient's attorney has submitted a discovery request for the ePHI exposed in the breach.
What is the most effective kind of training CloudHealth could have given its employees to help prevent this type of data breach?
- A. Training on CloudHealth's HR policy regarding the role of employees involved data breaches
- B. Training on the difference between confidential and non-public information
- C. Training on the terms of the contractual agreement with HealthCo
- D. Training on techniques for identifying phishing attempts
正解: D
質問 93
What type of material is exempt from an individual's right to disclosure under the Privacy Act?
- A. Material reporting investigative efforts to prevent unlawful persecution of an individual.
- B. Material used to determine potential collaboration with foreign governments in negotiation of trade deals.
- C. Material reporting investigative efforts pertaining to the enforcement of criminal law.
- D. Material requires by statute to be maintained and used solely for research purposes.
正解: B
質問 94
......
IAPP CIPP-Cリアル2022年最新のブレーン問題集で模擬試験問題集：https://www.passtest.jp/IAPP/CIPP-C-shiken.html
CIPP-C試験問題リアルCIPP-C練習問題集：https://drive.google.com/open?id=1w2I4aKY99-UvU6DdYefLDM29ITfFHGCD