[Aug 17, 2022] Fully Updated Free Actual IAPP CIPP-E Exam Questions
Free CIPP-E Questions for IAPP CIPP-E Exam [Aug-2022]
Exam Topics
The content of the CIPP/E certification exam revolves around three major subject areas, including the following:
- Introduction to European Data Protection
The certification exam can have 4 to 10 questions on this topic. This domain encompasses one’s knowledge of origins and historical context of data protection law (including human rights laws, early laws & regulations, data protection rationale, the Treaty of Lisbon; the need for a harmonized European approach, a modernized framework). The candidates must also be familiar with the European Union institutions, such as the European Court of Human Rights, the Council of Europe, the European Parliament, the European Commission, the European Court of Justice European Council. Moreover, in order to answer the questions in this section, the test takers must know the legal framework. This includes their knowledge of the EU Data Protection Directive (95/46/EC), European data retention regimes, the EU Directive on Privacy and Electronic Communications (2002/58/EC), the General Data Protection Regulation (GDPR), etc.
- European Data Protection Law and Regulation
This objective covers from 42 to 69 exam questions. Here the students should demonstrate that they have a good understanding of data protection principles (personal data as well as sensitive personal data, anonymous & pseudonymous data, controller, processing, processor, data subject); territorial & material GDPR scope (establishment as well as non-establishment in the EU); data processing concepts (purpose limitation, fairness & lawfulness, storage limitation/retention, accuracy, proportionality, integrity & confidentiality); lawful processing criteria (contractual necessity, consent, legitimate interests, vital interests as well as public interest, legal obligation, special categories of processing); information provision obligations (privacy notices, transparency principle, layered notices).
Additionally, the examinees must prove that they are proficient in data subjects rights (rectification, access, restriction & objection erasure as well as the right to be forgotten, automated decision making, consent (and withdrawal of), etc.); personal data security (relevant organizational & technical measures, vendor management, breach notification, data sharing); accountability requirements (responsibility of processors & controllers, data protection by default as well as by design, data protection influence evaluation, documentation & cooperation with regulators, auditing of privacy programs, compulsory data protection officers).
Lastly, the subject also requires your understanding of international data transfers (safe jurisdictions, prohibition rationale, Binding Corporate Rules (BCRs), Safe Harbor & Privacy Shield, model contracts, derogations, codes of conduct &certifications); supervision & enforcement (supervisory authorities as well as their powers, role of the European Data Protection Supervisor (EDPS), the European Data Protection Board); consequences for GDPR violations (infringement & fines, data subject compensation, process & procedures).
- Compliance with European Data Protection Law and Regulation
This area includes 9-18 exam questions. This topic unites the aspects, such as employment relations (storage of personnel records, whistleblowing systems, workplace monitoring & data loss prevention, EU Works councils, Bring Your Own Device (BYOD) programs); surveillance activities (interception of communications, surveillance by public authorities, closed-circuit television (CCTV), facial/biometrics recognition, geolocation); direct marketing (direct marketing, telemarketing, as well as online behavioural targeting); Internet technologies & communications (web cookies, search engine marketing (SEM), Artificial Intelligence (AI), cloud computing, social networking services).
NEW QUESTION 115
Many businesses print their employees' photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?
- A. Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.
- B. Because photographs qualify as biometric data only when they undergo a "specific technical processing".
- C. Because photographic ID is a physical security measure which is "necessary for reasons of substantial public interest".
Reference https://ess.csa.canon.com/rs/206-CLL-191/images/IAPP-Top-10-Operational-Impacts-of- GDPR.pdf?TC=DM&CN=CSA_OMNIA_Partners&CS=CSA&CR=T1_Gov%20GenNonProfit (11) - D. Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.
Answer: B
NEW QUESTION 116
What is true if an employee makes an access request to his employer for any personal data held about him?
- A. The employer must supply all the information held about the employee.
- B. The employer must supply any information held about an employee unless an exemption applies.
- C. The employer can automatically decline the request if it contains personal data about a third person.
- D. The employer can decline the request if the information is only held electronically.
Answer: B
Explanation:
Explanation
NEW QUESTION 117
Which of the following is the weakest lawful basis for processing employee personal data?
- A. Processing based on legal obligation.
- B. Processing based on fulfilling an employment contract.
- C. Processing based on employee consent.
- D. Processing based on legitimate interests.
Answer: C
NEW QUESTION 118
Under the GDPR, who would be LEAST likely to be allowed to engage in the collection, use, and disclosure of a data subject's sensitive medical information without the data subject's knowledge or consent?
- A. A member of the judiciary involved in adjudicating a legal dispute involving the data subject and concerning the health of the data subject.
- B. A health professional involved in the medical care for the data subject, where the data subject's life hinges on the timely dissemination of such information.
- C. A public authority responsible for public health, where the sharing of such information is considered necessary for the protection of the general populace.
- D. A journalist writing an article relating to the medical condition in question, who believes that the publication of such information is in the public interest.
Answer: C
Explanation:
Explanation/Reference: https://www.eui.eu/Documents/ServicesAdmin/DeanOfStudies/ResearchEthics/Guide-Data- Protection-Research.pdf
NEW QUESTION 119
Article 58 of the GDPR describes the power of supervisory authorities. Which of the following is NOT among those granted?
- A. Corrective powers.
- B. Authorization and advisory powers.
- C. Investigatory powers.
- D. Legislative powers.
Answer: B
NEW QUESTION 120
SCENARIO
Please use the following to answer the next question:
Jason, a long-time customer of ABC insurance, was involved in a minor car accident a few months ago.
Although no one was hurt, Jason has been plagued by texts and calls from a company called Erbium Insurance offering to help him recover compensation for personal injury. Jason has heard about insurance companies selling customers' data to third parties, and he's convinced that Erbium must have gotten his information from ABC.
Jason has also been receiving an increased amount of marketing information from ABC, trying to sell him their full range of their insurance policies.
Perturbed by this, Jason has started looking at price comparison sites on the Internet and has been shocked to find that other insurers offer much cheaper rates than ABC, even though he has been a loyal customer for many years. When his ABC policy comes up for renewal, he decides to switch to Xentron Insurance.
In order to activate his new insurance policy, Jason needs to supply Xentron with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask ABC to transfer his information directly to Xentron. He also takes this opportunity to ask ABC to stop using his personal data for marketing purposes.
ABC supplies Jason with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Jason it cannot transfer his data directly to Xentron at this is not technically feasible. ABC also explains that Jason's contract included a provision whereby Jason agreed that his data could be used for marketing purposes; according to ABC, it is too late for Jason to change his mind about this. It angers Jason when he recalls the wording of the contract, which was filled with legal jargon and very confusing.
In the meantime, Jason is still receiving unwanted calls from Erbium Insurance. He writes to Erbium to ask for the name of the organization that supplied his details to them. He warns Erbium that he plans to complain to the data protection authority because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.
Erbium's response letter confirms Jason's suspicions. Erbium is ABC's wholly owned subsidiary, and they received information about Jason's accident from ABC shortly after Jason submitted his accident claim.
Erbium assures Jason that there has been no breach of the GDPR, as Jason's contract included a provision in which he agreed to share his information with ABC's affiliates for business purposes.
Jason is disgusted by the way in which he has been treated by ABC, and writes to them insisting that all his information be erased from their computer system.
Which statement accurately summarizes ABC's obligation in regard to Jason's data portability request?
- A. ABC has failed to comply with the duty to transfer Jason's data to Xentron because it has an obligation to develop commonly used, machine-readable and interoperable formats so that all customer data can be ported to other insurers on request.
- B. ABC has failed to comply with the duty to transfer Jason's data to Xentron because the duty applies wherever personal data are processed by automated means and necessary for the performance of a contract with the customer.
- C. ABC does not have to transfer Jason's data to Xentron because the right to data portability does not apply where personal data are processed in order to carry out tasks in the public interest.
- D. ABC does not have a duty to transfer Jason's data to Xentron if doing so is legitimately not technically feasible.
Answer: C
NEW QUESTION 121
Article 5(1)(b) of the GDPR states that personal data must be "collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes." Based on Article 5(1)(b), what is the impact of a member state's interpretation of the word "incompatible"?
- A. It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose.
- B. It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data.
- C. It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data.
- D. It dictates the level of security a processor must follow when using and storing personal data for two different purposes.
Answer: D
NEW QUESTION 122
SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
In which of the following situations would ABC Hotel Chain and XYZ Travel Agency NOT have to honor Mike's data access request?
- A. The request is to obtain access and erasure of his personal data while keeping his rewards membership.
- B. The request is to obtain access and information about the purpose of processing his personal data.
- C. The request is to obtain access and correct inaccurate personal data in his profile.
- D. The request is to obtain access and the categories of recipients who have received his personal data to process his rewards membership.
Answer: A
NEW QUESTION 123
Read the following steps:
* Discover which employees are accessing cloud services and from which devices and apps
* Lock down the data in those apps and devices
* Monitor and analyze the apps and devices for compliance
* Manage application life cycles
* Monitor data sharing
An organization should perform these steps to do which of the following?
- A. Institute a GDPR-compliant employee monitoring process.
- B. Pursue a GDPR-compliant Privacy by Design process.
- C. Maintain a secure Bring Your Own Device (BYOD) program.
- D. Ensure cloud vendors are complying with internal data use policies.
Answer: C
Explanation:
Explanation/Reference: https://www.itproportal.com/features/heading-off-the-spectre-of-gdpr-compliance-with-secure-byod/
NEW QUESTION 124
What permissions are required for a marketer to send an email marketing message to a consumer in the EU?
- A. A pre-checked box stating that the consumer agrees to receive email marketing.
- B. A prior opt-in consent for consumers unless they are already customers.
- C. No prior permission required, but an opt-out requirement on all emails sent to consumers.
- D. A notice that the consumer's email address will be used for marketing purposes.
Answer: B
NEW QUESTION 125
Which of the following is NOT recognized as being a common characteristic of cloud-computing services?
- A. The supplier allows customer data to be transferred around the infrastructure according to capacity.
- B. The supplier determines the location, security measures, and service standards applicable to the processing.
- C. The service's infrastructure is shared among the supplier's customers and can be located in a number of countries.
- D. The supplier assumes the vendor's business risk associated with data processed by the supplier.
Answer: D
NEW QUESTION 126
What type of data lies beyond the scope of the General Data Protection Regulation?
- A. Anonymized
- B. Pseudonymized
- C. Encrypted
- D. Masked
Answer: A
NEW QUESTION 127
In which of the following situations would an individual most likely to be able to withdraw her consent for processing?
- A. When she has recently changed jobs and no longer works for the same company.
- B. When she no longer wishes to be sent marketing materials from an organization.
- C. When she is leaving her bank and moving to another bank.
- D. When she disagrees with a diagnosis her doctor has recorded on her records.
Answer: B
NEW QUESTION 128
A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States. What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?
- A. Seek informed consent from company employees.
- B. Restrict camera placement to building entrances only.
- C. Have cameras recording during work hours only.
- D. Retain captured footage for no more than 30 days.
Answer: A
NEW QUESTION 129
A key component of the OECD Guidelines is the "Individual Participation Principle". What parts of the General Data Protection Regulation (GDPR) provide the closest equivalent to that principle?
- A. The information requirements set out in Articles 13 and 14
- B. The lawful processing criteria stipulated by Articles 6 to 9
- C. The rights granted to data subjects under Articles 12 to 22
- D. The breach notification requirements specified in Articles 33 and 34
Answer: C
NEW QUESTION 130
Under Article 30 of the GDPR, controllers are required to keep records of all of the following EXCEPT?
- A. Retention periods for erasure and deletion of categories of personal data.
- B. Categories of recipients to whom the personal data have been disclosed.
- C. Incidents of personal data breaches, whether disclosed or not.
- D. Data inventory or data mapping exercises that have been conducted.
Answer: A
Explanation:
Section: (none)
Explanation
NEW QUESTION 131
SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.
Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
When Ben had the company collect additional data from its customers, the most serious violation of the GDPR occurred because the processing of the data created what?
- A. A significant risk to the customers' fundamental rights and freedoms.
- B. A significant risk due to the lack of an informed consent mechanism.
- C. A potential legal liability and financial exposure from its customers.
- D. An information security risk by copying the data into a new database.
Answer: A
NEW QUESTION 132
Based on GDPR Article 35, which of the following situations would trigger the need to complete a DPIA?
- A. A company wants to use location data to track delivery trucks in order to make the routes more efficient.
- B. A company wants to combine location data with other data in order to offer more personalized service for the customer.
- C. A company wants to use location data to infer information on a person's clothes purchasing habits.
- D. A company wants to build a dating app that creates candidate profiles based on location data and data from third-party sources.
Answer: D
NEW QUESTION 133
......
Career Prospects
Obtaining the CIPP/E certification demonstrates your profound expertise in the European privacy laws and regulations, as well as your understanding of the legal requirements established for the transfer of sensitive personal data to and from the EU jurisdiction. Having this certificate under your belt opens the door to extensive career opportunities. Some of the job roles that you can apply for after getting certified include:
- Human Resource Officer
- Associate General Counsel
- Chief Privacy Officer
- Data Protection Lawyer
- General Counsel
- Legal Counsel
- Corporate Counsel
Moreover, obtaining the CIPP/E certification is highly beneficial in financial terms. According to PayScale.com, the average income of the certified professionals amounts to $128,394 per annum. Your exact remuneration will depend on multiple factors, such as your location, the type of the organization you work for, your specific job title, among others.
CIPP/E is one of three privacy and data protection certificates offered within the IAPP certification program. Most professionals who have already earned it usually want to proceed with the advanced-level options, namely Certified Information Privacy Manager (CIPM) as well as Certified Information Privacy Technologist (CIPT).
Validate your CIPP-E Exam Preparation with CIPP-E Practice Test: https://www.test4engine.com/CIPP-E_exam-latest-braindumps.html
Get all the Information About IAPP CIPP-E Exam 2022 Practice Test Questions: https://drive.google.com/open?id=1jBaoZTTC6EghU7JRmaELNOvrrSfDLrM-