CIPP-US Exam Questions
225 real CIPP-US exam questions with expert-verified answers and explanations. Page 1 of 5.
- Question #1Legal, Risk, and Compliance
In which situation would a policy of "no consumer choice" or "no option" be expected?
consumer choicegovernment data requestsprivacy lawopt-out - Question #2Governance
What is the main challenge financial institutions face when managing user preferences?
user preferencesprivacy compliancefinancial institutionscross-channel data - Question #3Supply Chain Management
A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the least important factor for the company to consider when selecting the v...
vendor managementpersonal informationthird-party risksupply chain - Question #4Legal, Risk, and Compliance
SCENARIO Please use the following to answer the next question: Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your...
COPPAchildren's privacyself-regulatory programsconsent - Question #5Legal, Risk, and Compliance
What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)...
HITECHelectronic health recordshealthcare complianceEHR - Question #6Legal, Risk, and Compliance
All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?
HIPAAcovered entitieshealthcare providerspharmaceutical - Question #7Legal, Risk, and Compliance
A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the fol...
HIPAAbreach notificationransomwarePHI reporting - Question #8Legal, Risk, and Compliance
What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?
FACTAcredit card truncationconsumer protectionfinancial privacy - Question #9Legal, Risk, and Compliance
Who has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA)?
FCRAFACTACFPBregulatory authority - Question #10Health, Financial & Marketing Privacy
Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?
FACTADisposal Rulecredit reportsdata destruction - Question #11Health, Financial & Marketing Privacy
When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?
GLBAopt-outnon-affiliated third partiesinformation sharing - Question #12Health, Financial & Marketing Privacy
What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?
GLBAopt-outunaffiliated third partiesPI sharing - Question #13Health, Financial & Marketing Privacy
SCENARIO Please use the following to answer the next question: Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also star...
HIPAAPHIresearch authorizationcovered entity - Question #14Health, Financial & Marketing Privacy
SCENARIO Please use the following to answer the next question: Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also star...
HIPAANotice of Privacy Practicespatient rightsprivacy notice - Question #15Health, Financial & Marketing Privacy
SCENARIO Please use the following to answer the next question: Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also star...
HIPAAbusiness associate agreementBAAPHI security - Question #16Health, Financial & Marketing Privacy
Which entities must comply with the Telemarketing Sales Rule?
Telemarketing Sales Rulecharitable solicitationsfor-profitcompliance scope - Question #17Health, Financial & Marketing Privacy
Under the Telemarketing Sales Rule, what characteristics of consent must be in place for an organization to acquire an exception to the Do-Not-Call rules for a particular consumer?
Telemarketing Sales RuleDo-Not-Callwritten consentexception requirements - Question #18Health, Financial & Marketing Privacy
When does the Telemarketing Sales Rule require an entity to share a do-not-call request across its organization?
Telemarketing Sales RuleDo-Not-Callorganizational structureDNC sharing - Question #19Health, Financial & Marketing Privacy
Within what time period must a commercial message sender remove a recipient's address once they have asked to stop receiving future e-mail?
CAN-SPAMopt-outemail marketingremoval timeframe - Question #20Sector-Specific Laws
A student has left high school and is attending a public postsecondary institution. Under what condition may a school legally disclose educational records to the parents of the stu...
FERPAparental access rightstax dependentpostsecondary records - Question #21Health, Financial & Marketing Privacy
In what way does the "Red Flags Rule" under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?
FACTARed Flags Rulecreditor definitionidentity theft - Question #22Health, Financial & Marketing Privacy
Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer Protection Act?
Dodd-Frankconsumer protectionfinancial servicesCFPB - Question #23Sector-Specific Laws
Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?
FERPAeducational recordsthird-party vendorsstudent privacy - Question #24Sector-Specific Laws
According to FERPA, when can a school disclose records without a student's consent?
FERPAconsent exceptionseducational recordsschool transfer - Question #25Health, Financial & Marketing Privacy
What is the main purpose of the CAN-SPAM Act?
CAN-SPAMemail marketingindividual rightsFTC authority - Question #26Sector-Specific Laws
The Video Privacy Protection Act of 1988 restricted which of the following?
Video Privacy Protection Actaudiovisual recordsdisclosure restrictionspurchase records - Question #27Sector-Specific Laws
The Cable Communications Policy Act of 1984 requires which activity?
Cable Communications Policy Actsubscriber informationannual noticecable privacy - Question #28Health, Financial & Marketing Privacy
What is the main purpose of requiring marketers to use the Wireless Domain Registry?
Wireless Domain Registrymobile marketingCAN-SPAMemail opt-out - Question #29Data Breaches
SCENARIO Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in statea. HealthCo is a HIPAA-c...
HIPAAbusiness associate agreementdue diligenceePHI breach liability - Question #30Health, Financial & Marketing Privacy
SCENARIO Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in statea. HealthCo is a HIPAA-c...
HIPAAbusiness associate agreementsecurity trainingphishing - Question #31Health, Financial & Marketing Privacy
SCENARIO Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in statea. HealthCo is a HIPAA-c...
HIPAA Security RuleePHIsafeguardscloud computing - Question #32Government and Court Access to Private-Sector Information
SCENARIO Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in statea. HealthCo is a HIPAA-c...
HIPAAlitigation disclosurequalified protective orderPHI subpoena - Question #33Government and Court Access to Private-Sector Information
Which of the following types of information would an organization generally NOT be required to disclose to law enforcement?
HIPAA Privacy Rulelaw enforcement disclosuremandatory reportingPHI exemption - Question #34Government and Court Access to Private-Sector Information
A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously...
CALEAtelecommunicationslaw enforcement accessencryption - Question #35Government and Court Access to Private-Sector Information
What practice do courts commonly require in order to protect certain personal information on documents, whether paper or electronic, that is involved in litigation?
redactionlitigationcourt documentspersonal information - Question #36Government and Court Access to Private-Sector Information
What is an exception to the Electronic Communications Privacy Act of 1986 ban on interception of wire, oral and electronic communications?
ECPAwiretapone-party consentinterception exception - Question #37Government and Court Access to Private-Sector Information
What was the original purpose of the Foreign Intelligence Surveillance Act?
FISAnational securitywiretap authorizationexecutive branch - Question #38Government and Court Access to Private-Sector Information
What practice does the USA FREEDOM Act NOT authorize?
USA FREEDOM Actbulk data collectiontelephone metadatasurveillance limits - Question #39Government and Court Access to Private-Sector Information
Why was the Privacy Protection Act of 1980 drafted?
Privacy Protection Act 1980press freedompolice searchesnewspaper facilities - Question #40Government and Court Access to Private-Sector Information
The rules for "e-discovery" mainly prevent which of the following?
e-discoverydata retentionlitigation holdtechnological safeguards - Question #41Workplace Privacy
What do the Civil Rights Act, Pregnancy Discrimination Act, Americans with Disabilities Act, Age Discrimination Act, and Equal Pay Act all have in common?
employment discriminationADACivil Rights Actemployee privacy - Question #42Workplace Privacy
Which is an exception to the general prohibitions on telephone monitoring that exist under the U.S.Wiretap Act?
Wiretap Acttelephone monitoringordinary course of businessworkplace exception - Question #43Limits on Private-Sector Collection and Use of Data
SCENARIO Please use the following to answer the next question: Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his...
Do Not Calltelemarketingfederal preemptionstate DNC law - Question #44Limits on Private-Sector Collection and Use of Data
SCENARIO Please use the following to answer the next question: Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his...
telemarketingconsumer discriminationtort lawDo Not Call - Question #45Workplace Privacy
SCENARIO Please use the following to answer the next question: Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his...
Stored Communications Actelectronic monitoringworkplace emailSCA - Question #46Limits on Private-Sector Collection and Use of Data
SCENARIO Please use the following to answer the next question: Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his...
Do Not Callcallback recordsconsumer opt-outtelemarketing compliance - Question #47Workplace Privacy
Which of the following best describes private-sector workplace monitoring in the United States?
workplace monitoringemployer authorityprivate-sector employmentelectronic surveillance - Question #48Workplace Privacy
Which of the following is most likely to provide privacy protection to private-sector employees in the United States?
employee privacystate lawcontract lawtort law - Question #49Workplace Privacy
What role does the U.S. Constitution play in the area of workplace privacy?
Fourth AmendmentConstitutional privacygovernment employeesprivate-sector limitations - Question #50Data Breaches
Most states with data breach notification laws indicate that notice to affected individuals must be sent in the "most expeditious time possible without unreasonable delay." By cont...
breach notificationnotification timelineFloridastate-specific deadlines