Check Real IAPP CIPP-US Exam Question for Free (2022) [Q71-Q88] – Unlimited Lifetime Access Free Exams PDF

Rate this post

Check Real IAPP CIPP-US Exam Question for Free (2022)

Get Ready to Boost your Prepare for your CIPP-US Exam with 152 Questions

How much IAPP CIPP-US: Certified Information Privacy Professional/United States (CIPP/US) Exam cost

IAPP CIPP-US: Certified Information Privacy Professional/United States (CIPP/US) exam cost is $550 USD and retake fees is $375 USD, for more information please visit the official website.

NEW QUESTION 71
Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?

A local nonprofit charity’s fundraiser

An online merchant’s free shipping offer

A national bank’s no-fee checking promotion

A city bus system’s frequent rider program

NEW QUESTION 72
All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?

Healthcare information clearinghouses

Pharmaceutical companies

Healthcare providers

Health plans

NEW QUESTION 73
How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?

It expanded the definition of “consumer reports” to include communications relating to employee investigations

It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access

It stipulated the purpose of obtaining a consumer report can only be for a review of the employee’s credit worthiness

It required employers to get an employee’s consent in advance of requesting a consumer report for internal investigation purposes Section: (none) Explanation

NEW QUESTION 74
What do the Civil Rights Act, Pregnancy Discrimination Act, Americans with Disabilities Act, Age Discrimination Act, and Equal Pay Act all have in common?

They require employers not to discriminate against certain classes when employees use personal information

They require that employers provide reasonable accommodations to certain classes of employees

They afford certain classes of employees’ privacy protection by limiting inquiries concerning their personal information

They permit employers to use or disclose personal information specifically about employees who are members of certain classes

NEW QUESTION 75
What was the original purpose of the Foreign Intelligence Surveillance Act?

To further define what information can reasonably be under surveillance in public places under the USA PATRIOT Act, such as Internet access in public libraries.

To further clarify a reasonable expectation of privacy stemming from the Katz v. United States decision.

To further define a framework for authorizing wiretaps by the executive branch for national security purposes under Article II of the Constitution.

To further clarify when a warrant is not required for a wiretap performed internally by the telephone company outside the suspect’s home, stemming from the Olmstead v. United States decision.

NEW QUESTION 76
What is the most likely reason that states have adopted their own data breach notification laws?

Many states have unique types of businesses that require specific legislation

Many lawmakers believe that federal enforcement of current laws has not been effective

Many types of organizations are not currently subject to federal laws regarding breaches

Many large businesses have intentionally breached the personal information of their customers

NEW QUESTION 77
What role does the U.S. Constitution play in the area of workplace privacy?

It provides enforcement resources to large employers, but not to small businesses

It provides legal precedent for physical information security, but not for electronic security

It provides contractual protections to members of labor unions, but not to employees at will

It provides significant protections to federal and state governments, but not to private-sector employment

NEW QUESTION 78
What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

The ability for the consumer to correct inaccurate credit report information

The truncation of account numbers on credit card receipts

The right to request removal from e-mail lists

Consumer notice when third-party data is used to make an adverse decision

NEW QUESTION 79
What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?

Conduct annual consumer surveys regarding satisfaction with user preferences

Process requests for changes to user preferences within a designated time frame

Provide consumers with the opportunity to opt out of receiving telemarketing phone calls

Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter’s own use

NEW QUESTION 80
Which action is prohibited under the Electronic Communications Privacy Act of 1986?

Intercepting electronic communications and unauthorized access to stored communications

Monitoring all employee telephone calls

Accessing stored communications with the consent of the sender or recipient of the message

Monitoring employee telephone calls of a personal nature

NEW QUESTION 81
SCENARIO
Please use the following to answer the next question:
You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures.
A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI of public figures including celebrities and politicians.
During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected.
A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach.
What is the most significant reason that the U.S. Department of Health and Human Services (HHS) might impose a penalty on HealthCo?

Because HealthCo did not require CloudHealth to implement appropriate physical and administrative measures to safeguard the ePHI

Because HealthCo did not conduct due diligence to verify or monitor CloudHealth’s security measures

Because HIPAA requires the imposition of a fine if a data breach of this magnitude has occurred

Because CloudHealth violated its contract with HealthCo by not encrypting the ePHI

NEW QUESTION 82
Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network.
Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S. Department of Health and Human Services about the breach.
Which statement accurately describes SMH’s notification responsibilities?

If SMH is compliant with HIPAA, it will not have to make a separate notification to individuals in the state of New York.

If SMH has more than 500 patients in the state of New York, it will need to make separate notifications to these patients.

If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.

If SMH makes credit monitoring available to individuals who inquire, it will not have to make a separate notification to individuals in the state of New York.

NEW QUESTION 83
Which federal agency plays a role in privacy policy, but does NOT have regulatory authority?

The Office of the Comptroller of the Currency.

The Federal Communications Commission.

The Department of Transportation.

The Department of Commerce.

NEW QUESTION 84
Under the Telemarketing Sales Rule, what characteristics of consent must be in place for an organization to acquire an exception to the Do-Not-Call rules for a particular consumer?

The consent must be in writing, must state the times when calls can be made to the consumer and must be signed

The consent must be in writing, must contain the number to which calls can be made and must have an end date

The consent must be in writing, must contain the number to which calls can be made and must be signed

The consent must be in writing, must have an end data and must state the times when calls can be made

NEW QUESTION 85
What consumer service was the Fair Credit Reporting Act (FCRA) originally intended to provide?

The ability to receive reports from multiple credit reporting agencies.

The ability to appeal negative credit-based decisions.

The ability to correct inaccurate credit information.

The ability to investigate incidents of identity theft.

NEW QUESTION 86
If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

The organization will still be in compliance with most sector-specific privacy and security laws.

The impact of an organizational data breach will be more severe than if the data had been segregated.

Temporary employees will be able to find the data necessary to fulfill their responsibilities.

The organization will be able to address legal discovery requests efficiently without producing more information than necessary.

NEW QUESTION 87
Which of the following became the first state to pass a law specifically regulating the collection of biometric data?

California.

Texas.

Illinois.

Washington.

NEW QUESTION 88
An organization self-certified under Privacy Shield must, upon request by an individual, do what?

Suspend the use of all personal information collected by the organization to fulfill its original purpose.

Provide the identities of third parties with whom the organization shares personal information.

Provide the identities of third and fourth parties that may potentially receive personal information.

Identify all personal information disclosed during a criminal investigation.

For more info visit:

The IAPP CIPP-US: Certified Information Privacy Professional/United States (CIPP/US)

Use Free CIPP-US Exam Questions that Stimulates Actual EXAM : https://www.actualpdf.com/CIPP-US_exam-dumps.html

How much IAPP CIPP-US: Certified Information Privacy Professional/United States (CIPP/US) Exam cost

For more info visit:

Leave a Reply Cancel reply