Regular Free Updates CIPP-US Dumps Real Exam Questions Test Engine Aug 31, 2025 [Q52-Q75]

4/5 - (1 vote)

Regular Free Updates CIPP-US Dumps Real Exam Questions Test Engine Aug 31, 2025

Practice Test Questions Verified Answers As Experienced in the Actual Test!

The Certified Information Privacy Professional/United States (CIPP/US) certification exam is a globally recognized certification offered by the International Association of Privacy Professionals (IAPP). The IAPP is the largest and most comprehensive global information privacy community and resource, providing a forum for privacy professionals to share best practices, track trends, advance privacy management issues, and share knowledge and expertise.

The CIPP-US certification exam covers a wide range of topics related to privacy, including US privacy laws and regulations, data protection practices, privacy program management, and data breaches. CIPP-US exam is challenging and requires a deep understanding of the legal and regulatory framework that governs privacy in the United States. Individuals who pass the exam demonstrate their expertise in privacy matters and their commitment to maintaining the highest standards of professionalism and ethics in the field. The CIPP-US certification is highly valued by employers and clients, as it signifies a level of expertise and credibility that is recognized globally.

NO.52 SCENARIO
Please use the following to answer the next QUESTION:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients’ Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital’s use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients’ care.
On his first day Declan became familiar with all areas of the hospital’s large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan’s concern about this issue, he was amazed by the hospital’s effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan’s day ended with many Questions, he was pleased about his new position.
What is the most likely way that Declan might directly violate the Health Insurance Portability and Accountability Act (HIPAA)?

By being present when patients are checking in

By speaking to a patient without prior authorization

By ignoring the conversation about a potential breach

By following through with his plans for his upcoming paper

NO.53 In which situation would a policy of “no consumer choice” or “no option” be expected?

When a job applicant’s credit report is provided to an employer

When a customer’s financial information is requested by the government

When a patient’s health record is made available to a pharmaceutical company

When a customer’s street address is shared with a shipping company

NO.54 The U.S. Supreme Court has recognized an individual’s right to privacy over personal issues, such as contraception, by acknowledging which of the following?

Federal preemption of state constitutions that expressly recognize an individual right to privacy.

A “penumbra” of unenumerated constitutional rights as well as more general protections of due process of law.

An interpretation of the U.S. Constitution’s explicit definition of privacy that extends to personal issues.

The doctrine of stare decisis, which allows the U.S. Supreme Court to follow the precedent of previously decided case law.

NO.55 Chanel Hair Studio is a busy high-end hair salon. In an effort to maximize efficiency of its operations and reduce wait times for appointments, Chanel decides to implement artificial intelligence software that will use client profiles and history to predict which clients will likely be late for their appointments. Information used to create the client profile included appointment history, distance from the salon, and any references to being tardy pulled from the client’s social media accounts. If a client is predicted to be late, their appointment will be cancelled within 5 minutes.
Based on the details, what is the biggest potential privacy concern related to Chanel’s use of this new software?

Scanning a client’s social media accounts to use in a client profile without notice to the client.

Calculating client profile address distance from the salon to determine location from salon to help predict if the client will be late.

Using client profile information for any purpose other than setting up an appointment.

Assessing client tardiness history with the salon for predictive purposes.

NO.56 In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?

Scanning emails sent to and received by students

Making student education records publicly available

Relying on verbal consent for a disclosure of education records

Disclosing education records without obtaining required consent

NO.57 In March 2012, the FTC released a privacy report that outlined three core principles for companies handling consumer data. Which was NOT one of these principles?

Simplifying consumer choice.

Enhancing security measures.

Practicing Privacy by Design.

Providing greater transparency.

NO.58 Which of the following laws is NOT involved in the regulation of employee background checks?

The Civil Rights Act.

The Gramm-Leach-Bliley Act (GLBA).

The U.S. Fair Credit Reporting Act (FCRA).

The California Investigative Consumer Reporting Agencies Act (ICRAA).

NO.59 Which law provides employee benefits, but often mandates the collection of medical information?

The Occupational Safety and Health Act.

The Americans with Disabilities Act.

The Employee Medical Security Act.

The Family and Medical Leave Act.

The Family and Medical Leave Act (FMLA) is a federal law that provides eligible employees with up to 12 weeks of unpaid, job-protected leave per year for certain family and medical reasons, such as the birth or adoption of a child, the serious health condition of the employee or a family member, or a qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty or call to covered active duty status in the Armed Forces. The FMLA also provides eligible employees with up to 26 weeks of unpaid, job-protected leave per year to care for a covered service member with a serious injury or illness if the employee is the spouse, child, parent, or next of kin of the service member. The FMLA applies to all public agencies, including state, local, and federal employers, and local education agencies (schools), and to private sector employers who employ 50 or more employees for at least 20 workweeks in the current or preceding calendar year.
The FMLA often requires employers to collect medical information from employees who request FMLA leave or from their health care providers to certify the need for leave, the duration of leave, and the employee’ s ability to return to work. The FMLA regulations specify the type and amount of information that employers may request and require for different types of FMLA leave, such as:
* Basic medical facts, such as the diagnosis, symptoms, hospitalization, doctor visits, whether medication has been prescribed, and any referrals for evaluation or treatment, for the employee’s own serious health condition or that of a family member.
* Information on the medical necessity of intermittent leave or reduced schedule leave and the expected frequency and duration of such leave, for the employee’s own serious health condition or that of a family member, or for planned medical treatment.
* A statement of the facts regarding the qualifying exigency, such as the type of military duty, the dates of the covered active duty, and the contact information of the military member, for leave due to a qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty or call to covered active duty status in the Armed Forces.
* Information on the medical condition, treatment, and recovery of the covered service member, such as the date of injury or onset of illness, the current medical status, the prognosis, and the estimated time of treatment, for leave to care for a covered service member with a serious injury or illness.
The FMLA also imposes certain obligations on employers to protect the privacy and security of the medical information they collect from employees or their health care providers. For example, employers must:
* Maintain records and documents relating to medical certifications, recertifications, or medical histories of employees or employees’ family members as confidential medical records in separate files/records from the usual personnel files, and if the Americans with Disabilities Act (ADA) applies, such records must be maintained in conformance with ADA confidentiality requirements.
* Ensure that any electronic systems used to maintain such records meet the confidentiality requirements of the FMLA and the ADA, and that only authorized persons have access to such records.
* Limit the disclosure of such records to supervisors and managers who need to know about an employee’ s FMLA leave, first aid and safety personnel when an employee’s medical condition might require emergency treatment, and government officials investigating compliance with the FMLA.
* Comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule when requesting medical information from an employee’s health care provider, such as obtaining a valid authorization from the employee or using a HIPAA-compliant certification form.
* Refrain from requesting more information than allowed by the FMLA regulations, such as asking for an employee’s complete medical records or information unrelated to the FMLA leave request.
* Respect the employee’s right to revoke a medical authorization or challenge a medical certification, and follow the procedures for resolving disputes over the validity or sufficiency of such documents.
References:
* The Family and Medical Leave Act (FMLA)
* FMLA Employee Guide
* FMLA Employer Guide
* FMLA Regulations
* FMLA Forms

NO.60 Read this notice:
Our website uses cookies. Cookies allow us to identify the computer or device you’re using to access the site, but they don’t identify you personally. For instructions on setting your Web browser to refuse cookies, click here.
What type of legal choice does not notice provide?

Mandatory

Implied consent

Opt-in

Opt-out

NO.61 What was the original purpose of the Foreign Intelligence Surveillance Act?

To further define what information can reasonably be under surveillance in public places under the USA PATRIOT Act, such as Internet access in public libraries.

To further clarify a reasonable expectation of privacy stemming from the Katz v. United States decision.

To further define a framework for authorizing wiretaps by the executive branch for national security purposes under Article II of the Constitution.

To further clarify when a warrant is not required for a wiretap performed internally by the telephone company outside the suspect’s home, stemming from the Olmstead v. United States decision.

NO.62 Privacy Is Hiring Inc., a CA-based company, is an online specialty recruiting firm focusing on placing privacy professionals in roles at major companies. Job candidates create online profiles outlining their experience and credentials, and can pay $19.99/month via credit card to have their profiles promoted to potential employers. Privacy Is Hiring Inc. keeps all customer data at rest encrypted on its servers.
Under what circumstances would Privacy Is Hiring Inc., need to notify affected individuals in the event of a data breach?

If law enforcement has completed its investigation and has authorized Privacy Is Hiring Inc. to provide the notification to clients and applicable regulators.

If the job candidates’ credit card information and the encryption keys were among the information taken.

If Privacy Is Hiring Inc., reasonably believes that job candidates will be harmed by the data breach.

If the personal information stolen included the individuals’ names and credit card pin numbers.

NO.63 Under the Driver’s Privacy Protection Act (DPPA), which of the following parties would require consent of an individual in order to obtain his or her Department of Motor Vehicle information?

Law enforcement agencies performing investigations.

Insurance companies needing to investigate claims.

Attorneys gathering information related to lawsuits.

Marketers wishing to distribute bulk materials.

NO.64 If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

The organization will still be in compliance with most sector-specific privacy and security laws.

The impact of an organizational data breach will be more severe than if the data had been segregated.

Temporary employees will be able to find the data necessary to fulfill their responsibilities.

The organization will be able to address legal discovery requests efficiently without producing more information than necessary.

NO.65 Once a breach has been definitively established, which task should be prioritized next?

Involving law enforcement and state Attorneys General.

Determining what was responsible for the breach and neutralizing the threat.

Providing notice to the affected parties so they can take precautionary measures.

Implementing remedial measures and evaluating how to prevent future breaches.

NO.66 What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

The ability to correct inaccurate credit report information

The truncation of account numbers on credit card receipts

The right to request removal from email lists.

The issuing of notice when third-party data is used in an adverse decision

NO.67 Sarah lives in San Francisco, Californi
a. Based on a dramatic increase in unsolicited commercial emails, Sarah believes that a major social media platform with over 50 million users has collected a lot of personal information about her. The company that runs the platform is based in New York and France.
Why is Sarah entitled to ask the social media platform to delete the personal information they have collected about her?

Any company with a presence in Europe must comply with the General Data Protection Regulation globally, including in response to data subject deletion requests.

Under Section 5 of the FTC Act, the Federal Trade Commission has held that refusing to delete an individual’s personal information upon request constitutes an unfair practice.

The California Consumer Privacy Act entitles Sarah to request deletion of her personal information.

The New York “Stop Hacks and Improve Electronic Data Security” (SHIELD) Act requires that businesses under New York’s jurisdiction must delete customers’ personal information upon request.

NO.68 Which action is prohibited under the Electronic Communications Privacy Act of 1986?

Intercepting electronic communications and unauthorized access to stored communications

Monitoring all employee telephone calls

Accessing stored communications with the consent of the sender or recipient of the message

Monitoring employee telephone calls of a personal nature

NO.69 The Video Privacy Protection Act of 1988 restricted which of the following?

Which purchase records of audio visual materials may be disclosed

When downloading of copyrighted audio visual materials is allowed

When a user’s viewing of online video content can be monitored

Who advertisements for videos and video games may target

NO.70 Which of the following best describes the ASIA-Pacific Economic Cooperation (APEC) principles?

A bill of rights for individuals seeking access to their personal information.

A code of responsibilities for medical establishments to uphold privacy laws.

An international court ruling on personal information held in the commercial sector.

A baseline of marketers’ minimum responsibilities for providing opt-out mechanisms.

NO.71 Which of the following types of information would an organization generally NOT be required to disclose to law enforcement?

Information about medication errors under the Food, Drug and Cosmetic Act

Money laundering information under the Bank Secrecy Act of 1970

Information about workspace injuries under OSHA requirements

Personal health information under the HIPAA Privacy Rule

NO.72 Within what time period must a commercial message sender remove a recipient’s address once they have asked to stop receiving future e-mail?

7 days

10 days

15 days

21 days

NO.73 Which of the following federal agencies does NOT have regulatory authority related to privacy?

Consumer Financial Protection Bureau.

U.S. Department of Transportation.

U.S. Department of Commerce.

Federal Reserve

NO.74 What is the main reason some supporters of the European approach to privacy are skeptical about self- regulation of privacy practices?

A large amount of money may have to be sent on improved technology and security

Industries may not be strict enough in the creation and enforcement of rules

A new business owner may not understand the regulations

Human rights may be disregarded for the sake of privacy

The European approach to privacy is based on the recognition of privacy as a fundamental human right that requires strong legal protection and oversight. The EU has adopted comprehensive and binding privacy laws, such as the General Data Protection Regulation (GDPR) and the ePrivacy Directive, that apply to all sectors and activities involving personal data. The EU also has independent data protection authorities (DPAs) that monitor and enforce compliance with the privacy laws, and a European Data Protection Board (EDPB)that issues guidance and opinions on privacy matters. The EU also requires adequate levels of privacy protection for personal data transferred to third countries or international organizations.
In contrast, the U.S. approach to privacy is based on a sectoral and self-regulatory model that relies on a combination of federal and state laws, industry codes of conduct, consumer education, and market forces. The
U.S. does not have a single, comprehensive, and enforceable federal privacy law that covers all sectors and activities involving personal data. Instead, the U.S. has a patchwork of federal and state laws that address specific issues or sectors, such as health, financial, children’s, and electronic communications privacy. The
U.S. also has various federal and state agencies that share jurisdiction over privacy matters, such as the Federal Trade Commission (FTC), the Federal Communications Commission (FCC), and the Department of Health and Human Services (HHS). The U.S. also relies on self-regulation by industries that develop and adhere to voluntary codes of conduct, standards, and best practices for privacy. The U.S. also allows personal data to be transferred to third countries or international organizations without requiring adequate levels of privacy protection, as long as the data subjects have given their consent or the transfer is covered by a mechanism such as the Privacy Shield or the Standard Contractual Clauses.
Some supporters of the European approach to privacy are skeptical about self-regulation of privacy practices because they believe that self-regulation is not effective, consistent, or accountable enough to protect the rights and interests of data subjects. They argue that self-regulation may not provide sufficient incentives or sanctions for industries to comply with privacy rules, or to adopt privacy-enhancing technologies and practices. They also contend that self-regulation may not reflect the views and expectations of data subjects, or address the emerging and complex privacy challenges posed by new technologies and business models. They also question the transparency and legitimacy of self-regulation, and the ability of data subjects to exercise their rights and seek redress for privacy violations. References:
* IAPP CIPP/US Study Guide, Chapter 1: Introduction to the U.S. Privacy Environment, pp. 9-10, 16-17
* IAPP website, CIPP/US Certification
* NICCS website, Certified Information Privacy Professional/United States (CIPP/US) Training

NO.75 More than half of U.S. states require telemarketers to?

Identify themselves at the beginning of a call

Obtain written consent from potential customers

Provide written contracts for customer transactions

Conclusion

The CIPP-US exam is into verifying a candidate’s knowledge of the US data privacy laws and regulations. It helps to determine how well someone is fit for this field. For the ultimate success, the candidate should use the applicable guides and study course to ensure they pass it in one go.

Pass IAPP CIPP-US Exam in First Attempt Easily: https://www.examcost.com/CIPP-US-practice-exam.html