Course 2026 CIPP-US Test Prep Training Practice Exam Download [Q86-Q103]

Course 2026 CIPP-US Test Prep Training Practice Exam Download

CIPP-US Exam Info and Free Practice Test Professional Quiz Study Materials

The CIPP-US certification is designed for individuals who work with data privacy laws and regulations in the United States, including lawyers, privacy officers, compliance professionals, and others in related fields. Certified Information Privacy Professional/United States (CIPP/US) certification covers a wide range of topics related to data privacy, including US privacy laws and regulations, data breach notification requirements, and best practices for protecting personal data.

To obtain the CIPP-US certification, candidates must pass a rigorous exam that covers all of the key topics related to data privacy in the United States. CIPP-US exam is designed to test candidates' knowledge of privacy laws and regulations, as well as their understanding of best practices for protecting personal data and responding to data breaches.

 

NEW QUESTION # 86
What is the most likely reason that states have adopted their own data breach notification laws?

• A. Many large businesses have intentionally breached the personal information of their customers
• B. Many lawmakers believe that federal enforcement of current laws has not been effective
• C. Many states have unique types of businesses that require specific legislation
• D. Many types of organizations are not currently subject to federal laws regarding breaches

Answer: B

NEW QUESTION # 87
The concept of data portability refers to what?

• A. The technical measures organizations use to empower consumers' control in case data is being transferred to service providers
• B. The practice of disclosing all the data sources one organization uses to enhance data collection from different social media platforms
• C. The ability of individuals to obtain and reuse their personal data for their own purposes across different services.
• D. The ability of individuals to easily change to another similar service provider if fees are unlawfully being raised

Answer: C

Explanation:
The concept of data portability refers to an individual's right to access and transfer their personal data from one organization to another. It enables individuals to obtain and reuse their personal data for their own purposes across different services. For example, an individual can request their data from one service provider and transfer it to another provider, facilitating competition and giving consumers more control over their data.
This right is commonly associated with General Data Protection Regulation (GDPR) but is becoming more widely discussed in U.S. privacy contexts, such as under the California Consumer Privacy Act (CCPA) and similar state laws. Although the CCPA does not explicitly mention "data portability," the concept aligns with its provision that grants individuals the right to access their data in a portable and usable format.

NEW QUESTION # 88
Which of these organizations would be required to provide its customers with an annual privacy notice?

• A. The Golden Gavel Auction House.
• B. The Four Winds Tribal College.
• C. The Breezy City Housing Commission.
• D. The King County Savings and Loan.

Answer: D

Explanation:
The annual privacy notice requirement under the Gramm-Leach-Bliley Act (GLBA) applies to financial institutions that collect nonpublic personal information from customers and disclose it to nonaffiliated third parties, unless they qualify for an exception. A financial institution is any entity that engages in activities that are financial in nature or incidental to such activities, as defined by section 4(k) of the Bank Holding Company Act of 1956. The King County Savings and Loan is a financial institution under this definition, as it engages in lending money and accepting deposits. Therefore, it is required to provide its customers with an annual privacy notice, unless it meets the conditions for an exception. The Four Winds Tribal College, the Golden Gavel Auction House, and the Breezy City Housing Commission are not financial institutions under the GLBA, as they do not engage in activities that are financial in nature or incidental to such activities.
Therefore, they are not required to provide their customers with an annual privacy notice under the GLBA. References:
* Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act, section I.
Background, paragraph 2.
* 17 CFR § 248.5 - Annual privacy notice to customers required., paragraph (a) (1).
* IAPP CIPP/US Study Guide, page 65.

NEW QUESTION # 89
What information did the Red Flag Program Clarification Act of 2010 add to the original Red Flags rule?

• A. The components of an identity theft detection program.
• B. The definition of what constitutes a creditor.
• C. The process for proper disposal of sensitive data.
• D. The most common methods of identity theft.

Answer: B

NEW QUESTION # 90
Which of the following conditions would NOT be sufficient to excuse an entity from providing breach notification under state law?

• A. If the entity followed internal notification procedures compatible with state law.
• B. If the entity was subject to the GLBA Safeguards Rule.
• C. If the data involved was accessed but not exported.
• D. If the data involved was encrypted.

Answer: C

Explanation:
Most state breach notification laws require entities to notify affected individuals and/or regulators when there is unauthorized access to or acquisition of personal information that compromises its security, confidentiality, or integrity. However, some states provide exceptions to this requirement under certain conditions, such as:
* If the data involved was encrypted or otherwise rendered unreadable or unusable, and the encryption key or other means of access was not compromised. This is based on the assumption that encrypted data is not accessible to unauthorized parties, even if they obtain the data.
* If the entity was subject to and complied with another federal or state law that provides similar or greater protection and notification requirements, such as the GLBA Safeguards Rule or the HIPAA Breach Notification Rule. This is to avoid duplication or inconsistency of obligations for entities that are already regulated by other laws.
* If the entity conducted a risk assessment and determined that there is no reasonable likelihood of harm to the affected individuals, based on factors such as the nature and extent of the data, the circumstances of the breach, the evidence of misuse, and the ability to mitigate the risk. This is to allow entities to exercise some discretion and judgment in evaluating the potential impact of the breach.
However, none of the state laws provide an exception for the mere access of data without exportation. Access alone is considered a breach that triggers the notification requirement, unless one of the other conditions applies. Therefore, option B is not a sufficient excuse for not providing breach notification under state law.
References:
* [IAPP CIPP/US Study Guide], Chapter 9: State Data Security Laws, pp. 209-211.
* CIPP/US Practice Questions (Sample Questions), Question 29.

NEW QUESTION # 91
Which of the following privacy rights is NOT available under the Colorado Privacy Act?

• A. The right to limit the use of sensitive data.
• B. The right to access sensitive data.
• C. The right to correct sensitive data.
• D. The right to delete sensitive data.

Answer: A

Explanation:
"The CPA grants Colorado Consumers new rights with respect to their personal data, including the right to access, delete, and correct their personal data as well as the right to opt out of the sale of their personal data or its use for targeted advertising or certain kinds of profiling."
https://coag.gov/resources/colorado-privacy-act/
Even without knowing for certain the answer, one can reason that it should be D. It would be administratively difficult for businesses to adhere to varying limitation requests for each consumer... Therefore such a right would not make sense from a public policy perspective.

NEW QUESTION # 92
Which of the following is an example of federal preemption?

• A. The U.S. Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act prohibiting states from passing laws that impose greater obligations on senders of email marketing.
• B. The California Consumer Privacy Act (CCPA) regulating businesses that have no physical brick-and-mortal presence in California, but which do business there.
• C. The U.S. Federal Trade Commission's (FTC) ability to enforce against unfair and deceptive trade practices across sectors and industries.
• D. The Payment Card Industry's (PCI) ability to self-regulate and enforce data security standards for payment card data.

Answer: A

NEW QUESTION # 93
SCENARIO
Please use the following to answer the next question:
You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in statea.
HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo.
CloudHealth stores the data in state B. As part of HealthCo's business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth's security measures.
A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals ?ones that exposed the PHI of public figures including celebrities and politicians.
During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected.
A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual's ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient's attorney has submitted a discovery request for the ePHI exposed in the breach.
What is the most effective kind of training CloudHealth could have given its employees to help prevent this type of data breach?

• A. Training on the terms of the contractual agreement with HealthCo
• B. Training on CloudHealth's HR policy regarding the role of employees involved data breaches
• C. Training on techniques for identifying phishing attempts
• D. Training on the difference between confidential and non-public information

Answer: C

Explanation:
Phishing is a form of social engineering that involves sending fraudulent emails or other messages that appear to come from a legitimate source, but are designed to trick recipients into revealing sensitive information, such as passwords, account numbers, or personal identifiers.
Phishing is one of the most common and effective methods of cyberattacks, and it can lead to data breaches, identity theft, ransomware infections, or other serious consequences. Therefore, training on how to recognize and avoid phishing attempts is crucial for any organization that handles sensitive data, especially ePHI, which is subject to strict regulations under HIPAA.

NEW QUESTION # 94
Global Manufacturing Co's Human Resources department recently purchased a new software tool. This tool helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and what is said about them. This provides the HR department with an automated "360 review" that lets them know how the candidate thinks and operates, what their peers and direct reports say about them, and how well they interact with each other.
What is the most important step for the Human Resources Department to take when implementing this new software?

• A. Ensuring that the software contains a privacy notice explaining that employees have no right to privacy as long as they are running this software on organization systems to scan email systems.
• B. Making sure that the software does not unintentionally discriminate against protected groups.
• C. Confirming that employees have read and signed the employee handbook where they have been advised that they have no right to privacy as long as they are using the organization's systems, regardless of the protected group or laws enforced by EEOC.
• D. Providing notice to employees that their emails will be scanned by the software and creating automated profiles.

Answer: B

Explanation:
Explanation/Reference: https://www.beckage.com/tag/artificial-intelligence/

NEW QUESTION # 95
Which entities must comply with the Telemarketing Sales Rule?

• A. For-profit organizations and for-profit telefunders regarding charitable solicitations
• B. For-profit and not-for-profit organizations when selling additional services to establish customers
• C. Nonprofit organizations calling on their own behalf
• D. For-profit organizations calling businesses when a binding contract exists between them

Answer: B

Explanation:
Explanation/Reference: https://www.ftc.gov/tips-advice/business-center/guidance/complying-telemarketing-sales-rule

NEW QUESTION # 96
Which of the following laws is NOT involved in the regulation of employee background checks?

• A. The Gramm-Leach-Bliley Act (GLBA).
• B. The Civil Rights Act.
• C. The California Investigative Consumer Reporting Agencies Act (ICRAA).
• D. The U.S. Fair Credit Reporting Act (FCRA).

Answer: A

Explanation:
The law that is not involved in the regulation of employee background checks is B. The Gramm-Leach-Bliley Act (GLBA). The GLBA is a federal law that regulates the privacy and security of financial information collected, used, or shared by financial institutions, such as banks, insurance companies, or securities firms. The GLBA does not apply to employee background checks, unless the employer is a financial institution that obtains financial information from a consumer reporting agency for employment purposes. In that case, the employer must comply with the GLBA's notice and opt-out requirements, as well as the FCRA's requirements for using consumer reports. References:
* [IAPP CIPP/US Study Guide], Chapter 4: Workplace Privacy, pp. 113-114.
* IAPP CIPP/US Body of Knowledge, Section IV: Workplace Privacy, Subsection A: Employee Privacy Expectations, Topic 3: Background Checks.
* IAPP CIPP/US Practice Questions, Question 150.

NEW QUESTION # 97
Which of the following is not a legal requirement when a potential employer is using information in a consumer report to determine employment eligibility?

• A. The candidate must receive written notice that a report will be requested.
• B. Permissible purpose must exist for the report information.
• C. The candidate must give written consent before the report is obtained.
• D. The candidate must receive notice whether adverse action was taken or not.

Answer: D

NEW QUESTION # 98
More than half of U.S. states require telemarketers to?

• A. Provide written contracts for customer transactions
• B. Obtain written consent from potential customers
• C. Identify themselves at the beginning of a call
• D. Register with the state before conducting business

Answer: D

Explanation:
According to the IAPP CIPP/US Study Guide, more than half of U.S. states require telemarketers to register with the state before conducting business within the state. This registration requirement may involve paying a fee, posting a bond, or providing information about the telemarketer's identity, location, and business practices. The purpose of this requirement is to protect consumers from fraudulent or deceptive telemarketing calls and to facilitate the enforcement of state laws and regulations.

NEW QUESTION # 99
In a case of civil litigation, what might a defendant who is being sued for distributing an employee's private information face?

• A. An injunction.
• B. A jail sentence.
• C. Criminal fines.
• D. Probation.

Answer: A

Explanation:
An injunction is a court order that requires a party to stop or refrain from doing something. In a case of civil litigation, a defendant who is being sued for distributing an employee's private information might face an injunction that prohibits them from further disclosing or using the employee's private information. An injunction is a form of equitable relief that aims to prevent or remedy harm that cannot be adequately compensated by monetary damages. Probation, criminal fines, and jail sentences are forms of criminal sanctions that are not applicable in civil litigation, unless the defendant is also charged with a criminal offense related to the distribution of the employee's private information.

NEW QUESTION # 100
What is a key way that the Gramm-Leach-Bliley Act (GLBA) prevents unauthorized access into a person's back account?

• A. By requiring the amount of customer personal information printed on paper.
• B. By restricting the disclosure of customer account numbers by financial institutions.
• C. By requiring the financial institutions limit the collection of personal information.
• D. By requiring immediate public disclosure after a suspected security breach.

Answer: B

Explanation:
The GLBA prohibits financial institutions from disclosing a consumer's account number or similar form of access number or access code to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer. This restriction is intended to prevent unauthorized access to a person's bank account by third parties who may use the account number to initiate fraudulent transactions or identity theft. The GLBA also requires financial institutions to implement safeguards to protect the security, confidentiality, and integrity of customer information, and to notify customers and regulators in the event of a security breach involving such information.

NEW QUESTION # 101
SCENARIO
Please use the following to answer the next question:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S.
Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social media. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
In regard to telemarketing practices, Evan the supervisor has a misconception regarding?

• A. The right to monitor calls for quality assurance
• B. The wishes of recipients who request callbacks
• C. The relationship of state law to federal law
• D. The conditions under which recipients can opt out

Answer: B

NEW QUESTION # 102
The Family Educational Rights and Privacy Act (FERPA) requires schools to do all of the following EXCEPT?

• A. Respond to all reasonable student requests regarding explanation of their records.
• B. Provide students with access to their records within a specified amount of time.
• C. Obtain student authorization before releasing directory information in their records.
• D. Verify the identity of students who make requests for access to their records.

Answer: C

Explanation:
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records and gives parents or eligible students the right to access, amend, and control the disclosure of their records. FERPA applies to all educational agencies and institutions that receive funds under any program administered by the U.S. Department of Education12 FERPA requires schools to do all of the following:
* Verify the identity of students who make requests for access to their records. Schools must use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom they disclose education records12
* Provide students with access to their records within a specified amount of time. Schools must provide parents or eligible students with an opportunity to inspect and review the student's education records within 45 days of receiving a request. Schoolsare not required to provide copies of records unless it is impossible for parents or eligible students to review the records at the school12
* Respond to all reasonable student requests regarding explanation of their records. Schools must provide parents or eligible students with an opportunity to request the amendment of the student's education records that they believe are inaccurate, misleading, or otherwise in violation of the student's privacy rights. Schools must consider the request and decide whether to amend the records within a reasonable time. If the school decides not to amend the records, it must inform the parent or eligible student of their right to a hearing on the matter12 FERPA does not require schools to do the following:
* Obtain student authorization before releasing directory information in their records. Directory information is information contained in a student's education record that would not generally be considered harmful or an invasion of privacy if disclosed. Examples of directory information include the student's name, address, phone number, e-mail address, date and place of birth, major field of study, participation in sports and activities, dates of attendance, degrees and awards received, and most recent school attended. Schools may disclose directory information without consent unless the parent or eligible student has opted out of such disclosure. Schools must notify parents and eligible students of the types of information they designate as directory information and of their right to opt out of directory information disclosure12 Therefore, the correct answer is D. Obtain student authorization before releasing directory information in their records.
References:
* Family Educational Rights and Privacy Act (FERPA)
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 4: Federal Privacy Laws, Section 4.3: The Family Educational Rights and Privacy Act (FERPA)

NEW QUESTION # 103
......

IAPP CIPP-US certification exam covers various topics, including privacy program governance, risk management, and incident management. It tests proficiency in applying privacy laws to the collection, use, retention, and disclosure of personal information. Privacy professionals who hold the CIPP/US certification are well-equipped to handle the increasing demand for privacy compliance in the digital age. Attaining this certification showcases a commitment to the privacy field and sets the individual apart as a subject matter expert in the industry.

 

Get 100% Authentic IAPP CIPP-US Dumps with Correct Answers: https://www.examcost.com/CIPP-US-practice-exam.html

Accurate Hot Selling CIPP-US Exam Dumps 2026 Newly Released: https://drive.google.com/open?id=1YMUiJu11TjqauHCTkZVVkNNgFRNaNAf7