2021 Realistic VCE4Plus CIPP-US Dumps PDF - 100% Passing Guarantee
Free IAPP CIPP-US Exam Questions & Answer
Target Audience
This evaluation is designed for data protection officials in the US or those who wish to obtain awareness of how such policies work in the US. The exam, in particular, tests their knowledge and understanding in the field and helps them determine the areas they have to work on. It is also ideal for specialists who want to get the affiliated designation.
NEW QUESTION 45
When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?
- A. After disclosing marketing practices to customers and after giving them an opportunity to opt in.
- B. After disclosing marketing practices to customers and after giving them an opportunity to opt out.
- C. After disclosing information-sharing practices to customers and after giving them an opportunity to opt out.
- D. After disclosing information-sharing practices to customers and after giving them an opportunity to opt in.
Answer: C
NEW QUESTION 46
In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?
- A. Making student education records publicly available
- B. Scanning emails sent to and received by students
- C. Disclosing education records without obtaining required consent
- D. Relying on verbal consent for a disclosure of education records
Answer: B
NEW QUESTION 47
Which federal agency plays a role in privacy policy, but does NOT have regulatory authority?
- A. The Office of the Comptroller of the Currency.
- B. The Federal Communications Commission.
- C. The Department of Transportation.
- D. The Department of Commerce.
Answer: C
NEW QUESTION 48
SCENARIO
Please use the following to answer the next QUESTION:
Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer's privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.
Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.
After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer's personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.
Janice understood Cheryl's concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company's day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.
Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.
What is the main problem with Cheryl's suggested method of communicating the new privacy policy?
- A. The policy would not be considered valid if not communicated in full.
- B. Employees would not be comfortable with a policy that is put into action over time.
- C. The policy might not be implemented consistency across departments.
- D. Employees might not understand how the documents relate to the policy as a whole.
Answer: C
NEW QUESTION 49
Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely to default will receive frequent payment reminder calls, while those who are less likely to default will not receive payment reminders.
Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using artificial intelligence in this manner?
- A. If the algorithm makes automated decisions based on risk factors and public information, Acme need not determine if the algorithm has a disparate impact on protected classes.
- B. If the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.
- C. If the algorithm uses information about protected classes to make automated decisions, Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.
- D. If the algorithm's methodology is disclosed to consumers, then it is acceptable for Acme to have a disparate impact on protected classes.
Answer: A
Explanation:
Explanation/Reference: https://www.ftc.gov/news-events/blogs/business-blog/2020/04/using-artificial-intelligence-algorithms
NEW QUESTION 50
Read this notice:
Our website uses cookies. Cookies allow us to identify the computer or device you're using to access the site, but they don't identify you personally. For instructions on setting your Web browser to refuse cookies, click here.
What type of legal choice does not notice provide?
- A. Opt-in
- B. Mandatory
- C. Implied consent
- D. Opt-out
Answer: C
NEW QUESTION 51
Which of the following is most likely to provide privacy protection to private-sector employees in the United States?
- A. Amendments one, four, and five of the U.S. Constitution
- B. State law, contract law, and tort law
- C. The U.S. Department of Health and Human Services (HHS)
- D. The Federal Trade Commission Act (FTC Act)
Answer: B
Explanation:
Explanation/Reference: https://corporate.findlaw.com/law-library/right-to-privacy-in-the-workplace-in-the-information- age.html
NEW QUESTION 52
Which of the following statements is most accurate in regard to data breach notifications under federal and state laws:
- A. You must notify the Federal Trade Commission (FTC) in addition to affected individuals if over 500 individuals are receiving notice.
- B. When you are required to provide an individual with notice of a data breach under any state's law, you must provide the individual with an offer for free credit monitoring.
- C. The only obligations to provide data breach notification are under state law because currently there is no federal law or regulation requiring notice for the breach of personal information.
- D. When providing an individual with required notice of a data breach, you must identify what personal information was actually or likely compromised.
Answer: D
NEW QUESTION 53
The U.S. Supreme Court has recognized an individual's right to privacy over personal issues, such as contraception, by acknowledging which of the following?
- A. Federal preemption of state constitutions that expressly recognize an individual right to privacy.
- B. A "penumbra" of unenumerated constitutional rights as well as more general protections of due process of law.
- C. An interpretation of the U.S. Constitution's explicit definition of privacy that extends to personal issues.
- D. The doctrine of stare decisis, which allows the U.S. Supreme Court to follow the precedent of previously decided case law.
Answer: B
NEW QUESTION 54
Which jurisdiction must courts have in order to hear a particular case?
- A. Subject matter jurisdiction and professional jurisdiction
- B. Personal jurisdiction and subject matter jurisdiction
- C. Personal jurisdiction and professional jurisdiction
- D. Subject matter jurisdiction and regulatory jurisdiction
Answer: B
Explanation:
Reference:
~klett/chapter%25202%2520bl281%2520judicial%2520review%2520new.htm
+&cd=1&hl=en&ct=clnk&gl=pk&client=firefox-b-e
NEW QUESTION 55
SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your network?" Matt asked hopefully.
"No," the boy said. "I'm filling out a survey."
Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking Questions about my opinions."
"Let me see," Matt said, and began reading the list of Questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
How could the marketer have best changed its privacy management program to meet COPPA "Safe Harbor" requirements?
- A. By making a COPPA privacy notice available on website
- B. By participating in an approved self-regulatory program
- C. By regularly assessing the security risks to consumer privacy
- D. By receiving FTC approval for the content of its emails
Answer: D
NEW QUESTION 56
Under the Telemarketing Sales Rule, what characteristics of consent must be in place for an organization to acquire an exception to the Do-Not-Call rules for a particular consumer?
- A. The consent must be in writing, must contain the number to which calls can be made and must be signed
- B. The consent must be in writing, must state the times when calls can be made to the consumer and must be signed
- C. The consent must be in writing, must have an end data and must state the times when calls can be made
- D. The consent must be in writing, must contain the number to which calls can be made and must have an end date
Answer: D
NEW QUESTION 57
SCENARIO
Please use the following to answer the next question:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients' Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital's use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients' care.
On his first day Declan became familiar with all areas of the hospital's large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan's concern about this issue, he was amazed by the hospital's effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan's day ended with many questions, he was pleased about his new position.
How can the radiology department address Declan's concern about paper waste and still comply with the Health Insurance Portability and Accountability Act (HIPAA)?
- A. Direct patients to the correct area of the hospital website
- B. Confirm that patients are given the privacy notice on their first visit
- C. Post the privacy notice in a prominent location instead
- D. State the privacy policy to the patient verbally
Answer: A
NEW QUESTION 58
Which of the following is NOT one of three broad categories of products offered by data brokers, as identified by the U.S. Federal Trade Commission (FTC)?
- A. Marketing (such as appending data to customer information that a marketing company already has).
- B. Risk mitigation (such as information that may reduce the risk of fraud).
- C. Location of individuals (such as identifying an individual from partial information).
- D. Research (such as information for understanding consumer trends).
Answer: C
NEW QUESTION 59
SCENARIO
Please use the following to answer the next QUESTION
When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated dat a. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.
Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.
When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.
Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.
Based on the problems with the company's privacy security that Roberta identifies, what is the most likely cause of the breach?
- A. Lost company property such as a computer or flash drive.
- B. Fraud involving credit card theft at point-of-service terminals.
- C. Unintended disclosure of information shared with a third party.
- D. Mishandling of information caused by lack of access controls.
Answer: D
NEW QUESTION 60
SCENARIO
Please use the following to answer the next question:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop.
"Doing your network?" Matt asked hopefully.
"No," the boy said. "I'm filling out a survey."
Matt looked over his son's shoulder at his computer screen. "What kind of survey?"
"It's asking questions about my opinions."
"Let me see," Matt said, and began reading the list of questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
Based on the incident, the FTC's enforcement actions against the marketer would most likely include what violation?
- A. Disregarding the privacy policy of the children's marketing industry.
- B. Collecting information from a child under the age of thirteen.
- C. Failing to notify of a breach of children's private information.
- D. Intruding upon the privacy of a family with young children.
Answer: A
Explanation:
Explanation/Reference: https://www.ftc.gov/system/files/2012-31341.pdf
NEW QUESTION 61
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
In what area does Larry have a misconception about private-sector employee rights?
- A. The enforceability of local law
- B. The applicability of federal law
- C. The strict nature of state law
- D. The definition of tort law
Answer: B
NEW QUESTION 62
In 2012, the White House and the FTC both issued reports advocating a new approach to privacy enforcement that can best be described as what?
- A. Comprehensive.
- B. Harm-based.
- C. Notice and choice.
- D. Self-regulatory.
Answer: D
NEW QUESTION 63
Most states with data breach notification laws indicate that notice to affected individuals must be sent in the "most expeditious time possible without unreasonable delay." By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?
- A. Maine
- B. California
- C. New York
- D. Florida
Answer: D
NEW QUESTION 64
SCENARIO
Please use the following to answer the next QUESTION:
A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.
The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal dat a. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: "Please act immediately by identifying all personal data received from our company." This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.
As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.
Under the General Data Protection Regulation (GDPR), how would the U.S.-based startup company most likely be classified?
- A. As a data supervisor
- B. As a data manager
- C. As a data controller
- D. As a data processor
Answer: A
NEW QUESTION 65
Which federal act does NOT contain provisions for preempting stricter state laws?
- A. The Fair and Accurate Credit Transactions Act (FACTA)
- B. The CAN-SPAM Act
- C. The Telemarketing Consumer Protection and Fraud Prevention Act
- D. The Children's Online Privacy Protection Act (COPPA)
Answer: C
Explanation:
Explanation
NEW QUESTION 66
When does the Telemarketing Sales Rule require an entity to share a do-not-call request across its organization?
- A. When a call is not the result of an error or other unforeseen cause
- B. When the goods and services sold by its divisions are very similar
- C. When the operational structures of its divisions are not transparent
- D. When the entity manages user preferences through multiple platforms
Answer: A
NEW QUESTION 67
Why was the Privacy Protection Act of 1980 drafted?
- A. To assist prosecutors in civil litigation against newspaper companies
- B. To protect individuals from personal privacy invasion by the police
- C. To respond to police searches of newspaper facilities
- D. To assist in the prosecution of white-collar crimes
Answer: B
NEW QUESTION 68
According to FERPA, when can a school disclose records without a student's consent?
- A. If the disclosure is to provide transcripts to a school where a student intends to enroll
- B. If the disclosure would not reveal a student's student identification number
- C. If the disclosure is to practitioners who are involved in a student's health care
- D. If the disclosure is not to be conducted through email to the third party
Answer: A
Explanation:
Explanation/Reference: https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html
NEW QUESTION 69
......
Verified CIPP-US dumps Q&As Latest CIPP-US Download: https://www.vce4plus.com/IAPP/CIPP-US-valid-vce-dumps.html
Updated 100% Cover Real CIPP-US Exam Questions - 100% Pass Guarantee: https://drive.google.com/open?id=13Bn6UqrHTKJHBQV0vY_vBIGzeR2atxJd