[2025年11月04日]CIPP-US問題集PDFとテストエンジン 試験問題 [Q25-Q45]

[2025年11月04日]CIPP-US問題集PDFとテストエンジン 試験問題

検証済みのCIPP-USテスト問題集と解答で正確な228問題解答あります

CIPP-US認定は、国際プライバシー専門家協会（IAPP）によって授与されます。これは、100か国以上で50,000人以上のメンバーを持つプライバシー専門家の世界最大の協会です。 IAPPは、個人データの保護を担当する専門家に教育および認証プログラムを提供することに取り組んでいます。

CIPP-US試験は、プライバシー担当者、コンプライアンス担当者、データ保護担当者、情報セキュリティの専門家など、組織内のプライバシーとデータ保護の役割で働く個人に最適です。この試験では、プライバシー法と規制、プライバシープログラムガバナンス、データライフサイクル管理、プライバシーテクノロジーの4つの主要な分野をカバーしています。試験に合格した候補者は、プライバシー法と規制の深い理解、および個人情報を保護するためのプライバシーポリシーと手順を開発および実装する能力を示しています。 CIPP-US認定を取得することは、プライバシーとデータ保護のキャリアを促進したい専門家にとって貴重な成果です。

 

質問 # 25
If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

• A. The organization will be able to address legal discovery requests efficiently without producing more information than necessary.
• B. The organization will still be in compliance with most sector-specific privacy and security laws.
• C. Temporary employees will be able to find the data necessary to fulfill their responsibilities.
• D. The impact of an organizational data breach will be more severe than if the data had been segregated.

正解：D

解説：
Data classification is the process of categorizing data based on its sensitivity and importance to determine its level of confidentiality and protection. Data classification helps organizations apply appropriate security and compliance measures to ensure each category receives proper protection. Data classification also helps organizations identify which data is subject to specific privacy laws and regulations, such as the GDPR, HIPAA, or CCPA, and how to handle data subject requests, data breaches, or legal discovery. If an organization maintains data classified as high sensitivity, such as personal information, financial information, or health information, in the same system as data classified as low sensitivity, such as public information or internal information, it increases the risk of exposing the high sensitivity data in the event of a data breach. A data breach can result in legal consequences, reputational damage, and loss of trust from customers and stakeholders. Therefore, it is advisable to segregate data based on its classification and apply different levels of encryption, access control, and monitoring to each category. This way, the organization can minimize the impact of a data breach and protect the privacy and security of its data assets.

質問 # 26
A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than
500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?

• A. The affected individuals
• B. The local media
• C. Medical providers
• D. Department of Health and Human Services

正解：C

解説：
Explanation/Reference: https://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf (page 6)

質問 # 27
In what way does the "Red Flags Rule" under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?

• A. It does not apply because the owner is not a creditor
• B. It mandates the use of updated technology for securing credit records
• C. It requires the owner to implement an identity theft warning system
• D. It is not usually enforced in the case of a small financial institution

正解：A

解説：
The Red Flags Rule is a regulation that requires financial institutions and creditors to implement a written identity theft prevention program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account1. A creditor is any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit2. A covered account is an account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account2. A money wire service is a service that allows customers to send or receive money electronically3. The owner of a grocery store who uses a money wire service is not a creditor because he or she does not regularly extend, renew, or continue credit to customers. Therefore, the Red Flags Rule does not apply to the owner of a grocery store who uses a money wire service. References:
* 1: FTC, Red Flags Rule, https://www.ftc.gov/business-guidance/privacy-security/red-flags-rule
* 2: FTC, Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business,
https://www.ftc.gov/tips-advice/business-center/guidance/fighting-identity-theft-red-flags-rule-how-guide-
* 3: Alessa, Wire Transfer Red Flags: Understanding Money Laundering and Fraud Risks,
https://alessa.com/webinars/wire-transfer-red-flags-and-fraud-risks/

質問 # 28
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social media. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Which act would authorize Evan's undercover investigation?

• A. The Fair and Accurate Credit Transactions Act (FACTA)
• B. The Whistleblower Protection Act
• C. The National Labor Relations Act (NLRA)
• D. The Stored Communications Act (SCA)

正解：D

解説：
The Stored Communications Act (SCA) is a federal law that regulates the privacy of electronic communications that are stored by third-party service providers, such as email providers, cloud storage providers, or social media platforms. The SCA prohibits unauthorized access to or disclosure of such communications, unless authorized by law or by the consent of the user or the service provider . The SCA also provides exceptions for certain types of access or disclosure, such as those made for law enforcement purposes, for the protection of the service provider's rights or property, or for the consent of the subscriber or customer .
One of the exceptions to the SCA is where the service provider gives consent to the access or disclosure of the stored communications. This means that if a third-party service provider agrees to cooperate with an investigation or a request for information, the access or disclosure is lawful under the SCA. Consent can be express or implied, depending on the circumstances and the terms of service of the provider. For example, if a service provider has a policy that allows it to disclose user information to third parties for legitimate purposes, the provider has impliedly consented to the access or disclosure of the stored communications. However, if a service provider has a policy that prohibits such disclosure, the provider has not consented to the access or disclosure of the stored communications.
In the scenario, Evan's undercover investigation may have been authorized by the SCA if he obtained the consent of the third-party service provider that stored the electronic communications of the employee who was suspected of misconduct. For instance, if the employee used a company email account or a cloud storage service that had a policy that allowed the service provider to disclose user information to the employer or to law enforcement, Evan may have been able to access or disclose the stored communications with the consent of the service provider. However, if the employee used a personal email account or a cloud storage service that had a policy that protected user privacy and prohibited such disclosure, Evan may have violated the SCA by accessing or disclosing the stored communications without the consent of the service provider.
References: : [Stored Communications Act], 18 U.S.C. §§ 2701-2712 : [IAPP CIPP/US Study Guide], Chapter 8, Section 8.2.2. : [The Stored Communications Act: An Old Statute for Modern Problems], pp. 10-
11.

質問 # 29
Which of the following laws is NOT involved in the regulation of employee background checks?

• A. The U.S. Fair Credit Reporting Act (FCRA).
• B. The Civil Rights Act.
• C. The Gramm-Leach-Bliley Act (GLBA).
• D. The California Investigative Consumer Reporting Agencies Act (ICRAA).

正解：C

解説：
The law that is not involved in the regulation of employee background checks is B. The Gramm- Leach-Bliley Act (GLBA). The GLBA is a federal law that regulates the privacy and security of financial information collected, used, or shared by financial institutions, such as banks, insurance companies, or securities firms. The GLBA does not apply to employee background checks, unless the employer is a financial institution that obtains financial information from a consumer reporting agency for employment purposes. In that case, the employer must comply with the GLBA's notice and opt-out requirements, as well as the FCRA's requirements for using consumer reports.

質問 # 30
SuperMart is a large Nevada-based business that has recently determined it sells what constitutes "covered information" under Nevada's privacy law, Senate Bill 260. Which of the following privacy compliance steps would best help SuperMart comply with the law?

• A. Implementing internal protocols for handling access and deletion requests.
• B. Providing a mechanism for consumers to opt out of sales.
• C. Reviewing its vendor contracts to ensure that the vendors are subject to service provider restrictions.
• D. Preparing a notice of financial incentive for any loyalty programs offered to its customers.

正解：B

解説：
Nevada's privacy law, Senate Bill 260 (SB 260), is an amendment to the existing Nevada Revised Statutes (NRS) Chapter 603A that was enacted in June 2021 and will take effect on October 1, 2021. SB 260 expands the scope and definition of "covered information" under NRS 603A to include any information that identifies, relates to, describes, or is capable of being associated with a consumer, such as name, address, email, phone number, social security number, biometric data, geolocation data, and online identifiers. SB 260also grants Nevada consumers the right to opt out of the sale of their covered information by an operator of a website or online service that collects and maintains such information.
Under SB 260, an operator is defined as a person who owns or operates a website or online service for commercial purposes, collects and maintains covered information from consumers who reside in Nevada and use or visit the website or online service, and purposefully directs its activities toward Nevada. A sale is defined as the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons. However, there are some exceptions to the definition of a sale, such as:
* If the consumer has consented to the sale after being provided with clear and conspicuous notice of the sale and the opportunity to opt out.
* If the sale is to a person who processes the covered information on behalf of the operator.
* If the sale is to a person with whom the consumer has a direct relationship for the purposes of providing a product or service requested by the consumer.
* If the sale is to a person for purposes that are consistent with the reasonable expectations of the consumer considering the context in which the consumer provided the covered information to the operator.
* If the sale is to a person who is an affiliate of the operator.
* If the sale is to a person as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the person assumes control of all or part of the operator's assets.
To comply with SB 260, an operator that sells covered information must provide a designated request address through which a consumer may submit a verified request to opt out of the sale. The designated request address may be an email address, a toll-free telephone number, or an Internet website. The operator must respond to the verified request within 60 days, and may extend the response period for an additional 30 days if reasonably necessary. The operator must also provide a notice to the consumer that identifies the categories of covered information that the operator collects and the categories of third parties to whom the operator may disclose the covered information.
Therefore, the best privacy compliance step for SuperMart to comply with SB 260 is to provide a mechanism for consumers to opt out of sales, as this is the core requirement of the law. Option A is the correct answer.
Option B is incorrect, as SB 260 does not grant consumers the right to access or delete their covered information, unlike other state privacy laws such as the California Consumer Privacy Act (CCPA) or the Virginia Consumer Data Protection Act (VCDPA).
Option C is incorrect, as SB 260 does not require operators to provide a notice of financial incentive for any loyalty programs offered to their customers, unlike the CCPA.
Option D is incorrect, as SB 260 does not impose service provider restrictions on the vendors of the operators, unlike the CCPA or the VCDPA.
References:
* [IAPP CIPP/US Study Guide], Chapter 10: State Data Security Laws, pp. 229-230.
* CIPP/US Practice Questions (Sample Questions), Question 33.

質問 # 31
SCENARIO
Please use the following to answer the next QUESTION
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your homework?" Matt asked hopefully.
"No," the boy said. "I'm filling out a survey."
Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking Question:s about my opinions."
"Let me see," Matt said, and began reading the list of Question:s that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Question:s about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
Depending on where Matt lives, the marketer could be prosecuted for violating which of the following?

• A. Red Flag Rules.
• B. Investigative Consumer Reporting Agencies Act.
• C. Consumer Bill of Rights.
• D. Unfair and Deceptive Acts and Practices laws.

正解：D

質問 # 32
When does the Telemarketing Sales Rule require an entity to share a do-not-call request across its organization?

• A. When the operational structures of its divisions are not transparent
• B. When a call is not the result of an error or other unforeseen cause
• C. When the entity manages user preferences through multiple platforms
• D. When the goods and services sold by its divisions are very similar

正解：A

解説：
* The Telemarketing Sales Rule (TSR) is a federal regulation that implements the Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994. The TSR aims to protect consumers from deceptive or abusive telemarketing practices, such as unwanted calls, false or misleading claims, unauthorized billing, and privacy violations1.
* The TSR requires telemarketers and sellers to comply with the National Do Not Call Registry, which is a list of phone numbers of consumers who have indicated that they do not want to receive telemarketing calls2.
* The TSR also requires telemarketers and sellers to honor the do-not-call requests of individual consumers, regardless of whether their numbers are on the National Do Not Call Registry or not2.
* A do-not-call request is a statement made by a consumer, either orally or in writing, that they do not wish to receive any more calls from a specific telemarketer or seller2.
* The TSR requires an entity to share a do-not-call request across its organization when the operational
* structures of its divisions are not transparent to consumers3. This means that the entity must treat the do-not-call request as if it applies to all of its affiliates and subsidiaries that engage in telemarketing, unless the consumer would reasonably expect them to be separate and distinct entities based on their names, products, or services3.
* The TSR does not require an entity to share a do-not-call request across its organization in the following situations:
* When the goods and services sold by its divisions are very similar. This is not a relevant factor for determining whether the entity must share a do-not-call request across its organization. The key factor is whether the consumers can distinguish between the different divisions based on their operational structures3.
* When a call is not the result of an error or other unforeseen cause. This is not an exception to the requirement to honor a do-not-call request. The TSR prohibits telemarketers and sellers from calling a consumer who has made a do-not-call request, unless the call falls under one of the specific exemptions, such as calls from or on behalf of tax-exempt nonprofit organizations, calls to consumers with whom the seller has an established business relationship, or calls to consumers who have given prior express written consent2.
* When the entity manages user preferences through multiple platforms. This is not an excuse for not sharing a do-not-call request across its organization. The TSR requires telemarketers and sellers to maintain an internal do-not-call list of consumers who have asked them not to call again, and to update the list at least once every 31 days2. The entity must ensure that the do-not-call request is recorded and communicated across all of its platforms that are used for telemarketing purposes3.
References: 1: Telemarketing Sales Rule 2: Q&A for Telemarketers & Sellers About DNC Provisions in TSR 3: Federal Register :: Telemarketing Sales Rule

質問 # 33
The Video Privacy Protection Act of 1988 restricted which of the following?

• A. When downloading of copyrighted audio visual materials is allowed
• B. When a user's viewing of online video content can be monitored
• C. Who advertisements for videos and video games may target
• D. Which purchase records of audio visual materials may be disclosed

正解：D

解説：
Explanation/Reference: https://searchcompliance.techtarget.com/definition/Video-Privacy-Protection-Act-of-1988

質問 # 34
How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?

• A. It expanded the definition of "consumer reports" to include communications relating to employee investigations
• B. It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access
• C. It required employers to get an employee's consent in advance of requesting a consumer report for internal investigation purposes
• D. It stipulated the purpose of obtaining a consumer report can only be for a review of the employee's credit worthiness

正解：B

解説：
FACTA added a new section to the FCRA that requires any person who maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose, to properly dispose of any such information or compilation. The purpose of this provision is to reduce the risk of identity theft and other consumer harm resulting from improper disposal of consumer information. The FTC and other federal agencies have issued rules implementing this provision, which specify the reasonable measures that covered entities must take to ensure secure disposal of consumer information, such as burning, pulverizing, shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable (16 CFR ?682.3).

質問 # 35
A financial services company install "bossware" software on its employees' remote computers to monitor performance. The software logs screenshots, mouse movements, and keystrokes to determine whether an employee is being productive. The software can also enable the computer webcams to record video footage.
Which of the following would best support an employee claim for an intrusion upon seclusion tort?

• A. The webcam is enabled to record video any time the computer is turned on.
• B. The webcam records video of an employee using a company laptop to perform personal business while at a coffee shop during work hours.
• C. The company creates and saves a biometric template for each employee based upon keystroke dynamics.
• D. The software automatically sends a notification to a supervisor any time the employee's mouse is dormant for more than five minutes.

正解：A

解説：
If the camera begins recording whenever the computer is turned on, that creates a strong argument that the employer is impinging upon the the employee's right to privacy outside of work hours and in a private setting.

質問 # 36
A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the least important factor for the company to consider when selecting the vendor?

• A. The vendor's financial health
• B. The vendor's reputation
• C. The vendor's employee training program
• D. The vendor's employee retention rates

正解：D

解説：
When selecting a vendor to manage personal information, the company should consider various criteria, such as the vendor's reputation, financial health, employee training program, privacy policies, security practices, compliance record, contractual terms, and service quality. However, the vendor's employee retention rates may not be as important as the other factors, as they do not directly affect the vendor's ability to protect and process the personal information entrusted to them. While high employee turnover may indicate some issues with the vendor's management or culture, it may not necessarily impact the vendor's performance or reliability, as long as the vendor has adequate measures to ensure continuity, accountability, and confidentiality of the personal information they handle. References:
* Vendor Selection Process: a Step-by-Step Guide, section "Step 2: Define the vendor selection criteria"
* [IAPP CIPP/US Study Guide], p. 81-82, section 3.4.1
* [IAPP CIPP/US Body of Knowledge], p. 18-19, section C.2.a

質問 # 37
What type of material is exempt from an individual's right to disclosure under the Privacy Act?

• A. Material reporting investigative efforts to prevent unlawful persecution of an individual.
• B. Material used to determine potential collaboration with foreign governments in negotiation of trade deals.
• C. Material reporting investigative efforts pertaining to the enforcement of criminal law.
• D. Material requires by statute to be maintained and used solely for research purposes.

正解：A

解説：
https://www.dea.gov/foia/privacy-act-exemptions

質問 # 38
Which of the following is NOT one of three broad categories of products offered by data brokers, as identified by the U.S. Federal Trade Commission (FTC)?

• A. Research (such as information for understanding consumer trends).
• B. Location of individuals (such as identifying an individual from partial information).
• C. Risk mitigation (such as information that may reduce the risk of fraud).
• D. Marketing (such as appending data to customer information that a marketing company already has).

正解：B

解説：
Data brokers are companies that collect, analyze, and share personal information about consumers for various purposes, such as marketing, risk mitigation, and research. The U.S. Federal Trade Commission (FTC) conducted a study of nine data brokers in 2012 and published a report in 2014, titled "Data Brokers: A Call for Transparency and Accountability". In the report, the FTC identified three broad categories of products offered by data brokers, based on the primary purposes for which the products are used by their customers. The three categories are: 12
* Marketing products: These products help customers target potential customers, tailor marketing offers, measure the effectiveness of marketing campaigns, and improve customer relationships. Marketing products include data elements, segments, scores, lists, and analytics that are derived from consumer data. Data brokers may provide marketing products through direct marketing (such as postal mail,
* e-mail, or phone), online marketing (such as online display ads, social media, or mobile apps), or marketing analytics (such as measuring consumer behavior, preferences, and trends)12
* Risk mitigation products: These products help customers verify and authenticate consumers' identities, prevent fraud, and comply with legal obligations. Risk mitigation products include identity verification, identity authentication, fraud prevention, and compliance products that are based on consumer data. Data brokers may provide risk mitigation products through various methods, such as matching consumer-providedinformation with data broker records, generating questions or challenges based on consumer data, or providing scores or indicators of fraud risk or compliance status12
* Research products: These products help customers understand consumer behavior, preferences, and trends, as well as market conditions, industry developments, and economic factors. Research products include reports, studies, statistics, and insights that are derived from consumer data. Data brokers may provide research products through various formats, such as online portals, dashboards, newsletters, or custom reports12 The FTC report did not include location of individuals as one of the three broad categories of products offered by data brokers. Location of individuals may be a specific type of product or service that some data brokers provide, but it is not a primary purpose for which data brokers use consumer data. Therefore, the correct answer is C. Location of individuals (such as identifying an individual from partial information).
References:
* Data Brokers: A Call For Transparency and Accountability: A Report of the Federal Trade Commission (May 2014)
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 5: State Privacy Laws, Section 5.3: Data Broker Laws

質問 # 39
What is an exception to the Electronic Communications Privacy Act of 1986 ban on interception of wire, oral and electronic communications?

• A. Where state law permits such interception
• B. If an organization intercepts an employee's purely personal call
• C. Where one of the parties has given consent
• D. Only if all parties have given consent

正解：C

解説：
The Electronic Communications Privacy Act of 1986 (ECPA) is a federal law that regulates the privacy of wire, oral, and electronic communications. The ECPA prohibits the intentional interception, use, or disclosure of such communications, unless authorized by law or by the consent of one of the parties to the communication12. The ECPA also provides exceptions for certain types of communications, such as those made in the normal course of business, those made for law enforcement purposes, or those made for foreign intelligence purposes12.
One of the exceptions to the ECPA ban on interception is where one of the parties has given consent. This means that if a person who is a party to a communication agrees to have it intercepted, the interception is lawful under the ECPA. Consent can be express or implied, depending on the circumstances and the expectations of the parties3. For example, if a person calls a customer service line and hears a recorded message that the call may be monitored or recorded, the person has impliedly consented to the interception of the call. However, if a person calls a friend and does not know that the friend has a third party listening in on the call, the person has not consented to the interception of the call.
References: 1: Electronic Communications Privacy Act of 1986, 18 U.S.C. §§ 2510-2523 2: [IAPP CIPP/US Study Guide], Chapter 8, Section 8.2.1. 3: [Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations], pp. 77-78.

質問 # 40
Which of the following federal agencies does NOT have regulatory authority related to privacy?

• A. Federal Reserve
• B. U.S. Department of Commerce.
• C. U.S. Department of Transportation.
• D. Consumer Financial Protection Bureau.

正解：B

解説：
The U.S. Department of Commerce (DOC) is a federal agency that promotes economic growth, trade, and innovation, but does not have regulatory authority related to privacy. The DOC administers several voluntary privacy frameworks, such as the Privacy Shield, the APEC Cross-Border Privacy Rules, and the NIST Privacy Framework, but these are not legally binding or enforceable by the DOC12. The DOC also participates in international privacy negotiations and dialogues, but does not have the power to issue rules or regulations on privacy matters3.
The other three options are examples of federal agencies that do have regulatory authority related to privacy. The Consumer Financial Protection Bureau (CFPB) is an independent agency that enforces consumer protection laws, such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the Dodd-Frank Act, which contain privacy and data security provisions4. The U.S. Department of Transportation (DOT) is a federal agency that regulates transportation safety, security, and infrastructure, and has issued privacy rules for airlines, motor carriers, and railroads. The FederalReserve (FRB) is an independent agency that oversees the nation's monetary policy, banking system, and financial stability, and has issued privacy rules for financial institutions under its jurisdiction. References: 1: Privacy Shield Program Overview | International Trade Administration 2: NIST Privacy Framework | NIST 3: Privacy and Data Security | U.S. Department of Commerce 4: Consumer Financial Protection Bureau - Wikipedia : [Privacy | US Department of Transportation] : [Privacy - Federal Reserve Board]

質問 # 41
The Family Educational Rights and Privacy Act (FERPA) requires schools to do all of the following EXCEPT?

• A. Verify the identity of students who make requests for access to their records.
• B. Respond to all reasonable student requests regarding explanation of their records.
• C. Obtain student authorization before releasing directory information in their records.
• D. Provide students with access to their records within a specified amount of time.

正解：D

質問 # 42
One of the most significant elements of Senate Bill No. 260 relating to Internet privacy is the introduction of what term into Nevada law?

• A. Transfer Mechanism
• B. Data Ethics
• C. Artificial Intelligence.
• D. Data Brokers

正解：D

解説：
One of the most significant changes introduced by Nevada Senate Bill 260 (SB 260) is the inclusion of the term "Data Brokers" into Nevada privacy law. The bill requires data brokers to register with the Nevada Secretary of State and comply with new privacy requirements, such as responding to consumer opt-out requests. This addition aligns Nevada's privacy framework more closely with laws like Vermont's data broker law.
Key Provisions of SB 260:
Definition of Data Brokers:
A data broker is defined as a company that collects, sells, or licenses consumer data and does not have a direct relationship with the consumer.
Registration Requirements:
Data brokers must register annually with the Nevada Secretary of State.
Consumer Rights:
Consumers are granted the right to opt out of the sale of their personal information, extending the scope of Nevada's existing privacy law.

質問 # 43
In a case of civil litigation, what might a defendant who is being sued for distributing an employee's private information face?

• A. Probation.
• B. A jail sentence.
• C. Criminal fines.
• D. An injunction.

正解：D

解説：
An injunction is a court order that requires a party to stop or refrain from doing something. In a case of civil litigation, a defendant who is being sued for distributing an employee's private information might face an injunction that prohibits them from further disclosing or using the employee's private information. An injunction is a form of equitable relief that aims to prevent or remedy harm that cannot be adequately compensated by monetary damages. Probation, criminal fines, and jail sentences are forms of criminal sanctions that are not applicable in civil litigation, unless the defendant is also charged with a criminal offense related to the distribution of the employee's private information.

質問 # 44
What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

• A. The truncation of account numbers on credit card receipts
• B. The right to request removal from e-mail lists
• C. Consumer notice when third-party data is used to make an adverse decision
• D. The ability for the consumer to correct inaccurate credit report information

正解：A

解説：
The Fair and Accurate Credit Transactions Act (FACTA) is an amendment to the Fair Credit Reporting Act (FCRA) that was enacted in 200. FACTA aims to enhance consumer protection against identity theft and fraud by requiring various measures, such as free annual credit reports, fraud alerts, and identity theft prevention programs. One of the consumer protections that FACTA requires is the truncation of account numbers on credit card receipts. This means that only the last four or five digits of the account number can be printed on the receipt, while the rest must be masked or deleted. This reduces the risk of unauthorized access or use of the account number by third parties who may obtain the receipt.

質問 # 45
......

IAPP CIPP-USテストエンジンPDFで完全版無料問題集：https://www.goshiken.com/IAPP/CIPP-US-mondaishu.html

最新をゲットせよ！CIPP-US認定有効な試験問題集解答：https://drive.google.com/open?id=1xIvD0rjsRICJC9aNovSaQTRSkBTKu0Mo