Practice Examples and Dumps & Tips for 2021 Latest CIPP-US Valid Tests Dumps
Latest [Dec 09, 2021] 100% Passing Guarantee - Brilliant CIPP-US Exam Questions PDF
IAPP CIPP-US: Certified Information Privacy Professional/United States (CIPP/US) Certified Professional salary
The average salary of a IAPP CIPP-US: Certified Information Privacy Professional/United States (CIPP/US) Certified Expert in:
- United State - 70,247 USD
- Europe - 55,347 EURO
- England - 50,632 POUND
- India - 12,42,327 INR
NEW QUESTION 39
If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?
- A. Uses the transferred data for limited purposes
- B. Notifies the organization if it can no longer meet its requirements for proper data handling
- C. Enters a contract with the organization that states the third party will process data according to the consent agreement
- D. Provides the same level of privacy protection as the organization
Answer: C
Explanation:
Explanation/Reference: https://www.privacyshield.gov/Key-New-Requirements
NEW QUESTION 40
The U.S. Supreme Court has recognized an individual's right to privacy over personal issues, such as contraception, by acknowledging which of the following?
- A. The doctrine of stare decisis, which allows the U.S. Supreme Court to follow the precedent of previously decided case law.
- B. Federal preemption of state constitutions that expressly recognize an individual right to privacy.
- C. A "penumbra" of unenumerated constitutional rights as well as more general protections of due process of law.
- D. An interpretation of the U.S. Constitution's explicit definition of privacy that extends to personal issues.
Answer: C
NEW QUESTION 41
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
In what area does Larry have a misconception about private-sector employee rights?
- A. The definition of tort law
- B. The enforceability of local law
- C. The applicability of federal law
- D. The strict nature of state law
Answer: C
NEW QUESTION 42
Which of the following types of information would an organization generally NOT be required to disclose to law enforcement?
- A. Information about medication errors under the Food, Drug and Cosmetic Act
- B. Personal health information under the HIPAA Privacy Rule
- C. Money laundering information under the Bank Secrecy Act of 1970
- D. Information about workspace injuries under OSHA requirements
Answer: B
NEW QUESTION 43
SCENARIO
Please use the following to answer the next QUESTION:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients' Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital's use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients' care.
On his first day Declan became familiar with all areas of the hospital's large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan's concern about this issue, he was amazed by the hospital's effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan's day ended with many Questions, he was pleased about his new position.
What is the most likely way that Declan might directly violate the Health Insurance Portability and Accountability Act (HIPAA)?
- A. By being present when patients are checking in
- B. By ignoring the conversation about a potential breach
- C. By speaking to a patient without prior authorization
- D. By following through with his plans for his upcoming paper
Answer: B
NEW QUESTION 44
All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?
- A. Healthcare providers
- B. Healthcare information clearinghouses
- C. Pharmaceutical companies
- D. Health plans
Answer: C
NEW QUESTION 45
SCENARIO
Please use the following to answer the next QUESTION
When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated dat a. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.
Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.
When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.
Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.
Which principle of the Consumer Privacy Bill of Rights, if adopted, would best reform the company's privacy program?
- A. Consumers have a right to exercise control over how companies use their personal data.
- B. Consumers have a right to correct personal data in a manner that is appropriate to the sensitivity.
- C. Consumers have a right to easily accessible information about privacy and security practices.
- D. Consumers have a right to reasonable limits on the personal data that a company retains.
Answer: D
NEW QUESTION 46
SCENARIO
Please use the following to answer the next QUESTION:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients' Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital's use of a billing company. He Questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients' care.
On his first day Declan became familiar with all areas of the hospital's large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan's concern about this issue, he was amazed by the hospital's effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan's day ended with many Questions, he was pleased about his new position.
How can the radiology department address Declan's concern about paper waste and still comply with the Health Insurance Portability and Accountability Act (HIPAA)?
- A. Post the privacy notice in a prominent location instead
- B. Direct patients to the correct area of the hospital website
- C. Confirm that patients are given the privacy notice on their first visit Section: (none) Explanation
- D. State the privacy policy to the patient verbally
Answer: B
NEW QUESTION 47
Which of the following became the first state to pass a law specifically regulating the collection of biometric data?
- A. Texas.
- B. California.
- C. Washington.
- D. Illinois.
Answer: D
NEW QUESTION 48
SCENARIO
Please use the following to answer the next QUESTION:
A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.
The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal dat a. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: "Please act immediately by identifying all personal data received from our company." This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.
As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.
Under the General Data Protection Regulation (GDPR), how would the U.S.-based startup company most likely be classified?
- A. As a data manager
- B. As a data supervisor
- C. As a data processor
- D. As a data controller
Answer: B
NEW QUESTION 49
Which of the following best describes how federal anti-discrimination laws protect the privacy of private-sector employees in the United States?
- A. They prescribe working environments that are safe and comfortable.
- B. They limit the amount of time a potential employee can be interviewed.
- C. They limit the types of information that employers can collect about employees.
- D. They promote a workforce of employees with diverse skills and interests.
Answer: A
NEW QUESTION 50
Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?
- A. University police provide an arrest report to a student's hometown police, who suspect him of a similar crime
- B. A newspaper prints the names, grade levels, and hometowns of students who made the quarterly honor roll
- C. A university posts a public student directory that includes names, hometowns, e-mail addresses, and majors
- D. A K-12 assessment vendor obtains a student's signed essay about her hometown from her school to use as an exemplar for public release
Answer: D
NEW QUESTION 51
A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data.
What law did ACME violate by designing the service to prevent access to the information by a law enforcement agency?
- A. SCA
- B. USA Freedom Act
- C. CALEA
- D. ECPA
Answer: C
NEW QUESTION 52
According to the FTC Report of 2012, what is the main goal of Privacy by Design?
- A. Implementing a system of standardization for privacy notices
- B. Obtaining consumer consent when collecting sensitive data for certain purposes
- C. Establishing a system of self-regulatory codes for mobile-related services
- D. Incorporating privacy protections throughout the development process
Answer: D
NEW QUESTION 53
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Based on the way he uses social media, Evan is susceptible to a lawsuit based on?
- A. Publicity given to private life
- B. Intrusion upon seclusion
- C. Defamation
- D. Discrimination
Answer: D
NEW QUESTION 54
Why was the Privacy Protection Act of 1980 drafted?
- A. To assist in the prosecution of white-collar crimes
- B. To respond to police searches of newspaper facilities
- C. To protect individuals from personal privacy invasion by the police
- D. To assist prosecutors in civil litigation against newspaper companies
Answer: C
NEW QUESTION 55
SCENARIO
Please use the following to answer the next question:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop.
"Doing your network?" Matt asked hopefully.
"No," the boy said. "I'm filling out a survey."
Matt looked over his son's shoulder at his computer screen. "What kind of survey?"
"It's asking questions about my opinions."
"Let me see," Matt said, and began reading the list of questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
Based on the incident, the FTC's enforcement actions against the marketer would most likely include what violation?
- A. Disregarding the privacy policy of the children's marketing industry.
- B. Intruding upon the privacy of a family with young children.
- C. Collecting information from a child under the age of thirteen.
- D. Failing to notify of a breach of children's private information.
Answer: A
Explanation:
Explanation/Reference: https://www.ftc.gov/system/files/2012-31341.pdf
NEW QUESTION 56
What is the main purpose of the CAN-SPAM Act?
- A. To authorize the states to enforce federal privacy laws for electronic marketing
- B. To ensure that organizations respect individual rights when using electronic advertising
- C. To diminish the use of electronic messages to send sexually explicit materials
- D. To empower the FTC to create rules for messages containing sexually explicit content
Answer: B
Explanation:
Explanation/Reference: https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business
NEW QUESTION 57
Which entity within the Department of Health and Human Services (HHS) is the primary enforcer of the Health Insurance Portability and Accountability Act (HIPAA) "Privacy Rule"?
- A. Office of Inspector General.
- B. Office of Public Health and Safety.
- C. Office of Social Services.
- D. Office for Civil Rights.
Answer: D
NEW QUESTION 58
A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data.
What law did ACME violate by designing the service to prevent access to the information by a law enforcement agency?
- A. SCA
- B. USA Freedom Act
- C. CALEA
- D. ECPA
Answer: C
Explanation:
Explanation
Explanation/Reference: https://www.nap.edu/read/11896/chapter/11#283
NEW QUESTION 59
......
CIPP-US are Available for Instant Access: https://www.examboosts.com/IAPP/CIPP-US-practice-exam-dumps.html
CIPP-US Certification – Valid Exam Dumps Questions Study Guide: https://drive.google.com/open?id=1XOLGFRKTQRxExuLBx_4yqhfsieKC-YdV