2024年最新のCIPP-C試験問題集で最近更新された78問題 [Q20-Q44]

2024年最新のCIPP-C試験問題集で最近更新された78問題

IAPP CIPP-Cリアル2024年最新のブレーン問題集で模擬試験問題集

質問 # 20
According to the federal court ruling in the Eastman Case, video cameras in the workplace are considered to be collecting personal information?

• A. As soon as the data is saved to a workplace server.
  D When someone within the nrnani7atinn views the recording
• B. When a camera is on, even if it is not yet recording.
• C. At the moment a recording occurs.

正解：C

解説：
In the context of Canadian privacy law and specifically according to the principles derived from PIPEDA and relevant case law such as the Eastman case, video cameras in the workplace begin collecting personal information at the moment a recording occurs. This is because the recording captures identifiable images of individuals, thereby constituting the collection of personal information under privacy legislation. The act of recording, which captures and stores visual data, meets the definition of personal information collection since it involves storing images from which individuals can be identified. Therefore, the correct answer is A, "At the moment a recording occurs."

質問 # 21
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Based on the way he uses social media, Evan is susceptible to a lawsuit based on?

• A. Discrimination
• B. Publicity given to private life
• C. Intrusion upon seclusion
• D. Defamation

正解：A

質問 # 22
When would a data subject NOT be able to exercise the right to portability?

• A. When the processing is based on consent.
• B. When the processing is carried out pursuant to a contract with the data subject.
• C. When the data was supplied to the controller by the data subject.
• D. When the processing is necessary to perform a task in the exercise of authority vested in the controller.

正解：D

質問 # 23
Under PIPEDA, each of the following are considered to be personal information EXCEPT?

• A. A public official's salary published on a government web site.
• B. A photograph taken in public and published in a newspaper.
• C. Information about a defendant contained in court records.
• D. A person's telephone number published in a public directory.

正解：A

質問 # 24
When does the Telemarketing Sales Rule require an entity to share a do-not-call request across its organization?

• A. When the goods and services sold by its divisions are very similar
• B. When the operational structures of its divisions are not transparent
• C. When the entity manages user preferences through multiple platforms
• D. When a call is not the result of an error or other unforeseen cause

正解：D

質問 # 25
A new client is opening a Registered Retirement Savings Plan. Their investment advisor asks for their social insurance number (SIN). The advisor must tell the client that because they are opening a tax reporting product, their SIN is mandatory for tax reporting purposes and?

• A. Mandatory for secondary marketing purposes.
• B. Optional for identity verification purposes.
• C. Mandatory for identity verification purposes.
• D. Optional for secondary marketing purposes.

正解：B

解説：
When a financial institution such as a bank or an investment advisor collects a social insurance number (SIN) for tax reporting purposes, especially in contexts like opening a Registered Retirement Savings Plan (RRSP), it is mandatory because the SIN is required by law for such purposes. However, the use of the SIN for other purposes, such as identity verification, is not mandatory and should only be done with the client's consent.
Thus, the correct answer is A, "Optional for identity verification purposes," indicating that while the SIN is necessary for tax purposes, its use for verifying identity is at the client's discretion.

質問 # 26
SCENARIO
Please use the following to answer the next QUESTION
Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in Californi a. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants' postings on social media, ask Question:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.
Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle's GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.
Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia's concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it's unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.
In any case, Celeste feels that all they need is common sense - like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she's right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.
Regarding credit checks of potential employees, Celeste has a misconception regarding what?

• A. Consent requirements.
• B. Employment-at-will rules.
• C. Records retention policies
• D. Disclosure requirements.

正解：A

質問 # 27
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" What safeguard can most efficiently ensure that privacy protection is a dimension of relationships with vendors?

• A. Require that a person trained in privacy protection be part of all vendor selection teams
• B. Do business only with vendors who are members of privacy trade associations
• C. Perform a privacy audit on any vendor under consideration
• D. Include appropriate language about privacy protection in vendor contracts

正解：A

質問 # 28
Which of the following does NOT have to be included in the records most processors must maintain in relation to their data processing activities?

• A. Details of any data protection impact assessment conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting.
• B. Name and contact details of each controller on behalf of which the processor is acting.
• C. Categories of processing carried out on behalf of each controller for which the processor is acting.
• D. Details of transfers of personal data to a third country carried out on behalf of each controller for which the processor is acting.

正解：D

質問 # 29
When a third country or specified entity is said to ensure an adequate level of protection essentially equivalent to that ensured within the European Union, it is awarded a(n)?

• A. Protection designation.
• B. Equivalency designation.
• C. Attestation designation.
• D. Adequacy designation.

正解：D

質問 # 30
Which health information custodians may NOT rely on an implied consent model under Ontario's Personal Health Information Protection Act (PHIPA)?

• A. Long-term care homes.
• B. Ambulance services.
• C. Private insurance companies.
• D. Pharmacies

正解：C

解説：
Under Ontario's Personal Health Information Protection Act (PHIPA), health information custodians may rely on implied consent in situations where the information is used for the provision of healthcare unless the patient explicitly opts out. However, private insurance companies do not directly provide healthcare and typically require explicit consent to collect, use, or disclose health information. This is because their primary role involves assessing insurance claims and risk, rather than delivering healthcare services. Long-term care homes, ambulance services, and pharmacies, on the other hand, are directly involved in the provision of care and can typically operate under an implied consent model when sharing information for healthcare purposes.

質問 # 31
The Cable Communications Policy Act of 1984 requires which activity?

• A. Notice to subscribers of any investigation involving unauthorized reception of cable services
• B. Destruction of personal information a maximum of six months after it is no longer needed
• C. Delivery of an annual notice detailing how subscriber information is to be used
• D. Obtaining subscriber consent for disseminating any personal information necessary to render cable services

正解：A

質問 # 32
SCENARIO
Looking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.
You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.
Which data lifecycle phase needs the most attention at this Ontario medical center?

• A. Retention
• B. Disclosure
• C. Use
• D. Collection

正解：A

質問 # 33
Under state breach notification laws, which is NOT typically included in the definition of personal information?

• A. Social Security number
• B. Medical Information
• C. First and last name
• D. State identification number

正解：B

質問 # 34
What privacy concept grants a consumer the right to view and correct errors on his or her credit report?

• A. Notice.
• B. Access.
• C. Choice.
• D. Action.

正解：A

質問 # 35
A company wants to invest in DEI initiatives within their organization and plans to survey employees by asking for locality, age, salary, gender, ethnicity, religion, sexual orientation, physical/mental disabilities, department, and job level.
The best solution to protect the personal information collected in the survey is to?

• A. Choose a survey tool located in Canada.
• B. Encrypt the sensitive information collected and stored.
  D Adjust all survey question so that no identifying information nan he collected
• C. Use a pseudonym to identify employees.

正解：C

解説：
When conducting surveys that collect personal information, it is crucial to protect the privacy of the respondents. The best practice, according to CIPP/C guidelines, is to collect results anonymously whenever possible1. This can be achieved by using pseudonyms to identify employees, which aligns with the option A.
This method allows the company to analyze the data without exposing the personal identities of the employees.
Using a survey tool located in Canada (option B) may not necessarily protect the personal information unless the tool itself has robust privacy features that comply with Canadian privacy laws. Encryption (option C) is a strong method to secure data but does not address the issue of anonymity in the data collection process.
Adjusting the survey questions to not collect identifying information (option D) could potentially undermine the purpose of the DEI initiatives, as some demographic information may be necessary for analysis.
The International Association of Privacy Professionals (IAPP) provides a global standard for privacy laws, regulations, and frameworks, which includes the protection of personal information in surveys. The CIPP/C certification ensures that professionals understand these principles and practices within the Canadian context2. The guidelines suggest that when personal information is collected, it should be done in a way that respects the privacy of individuals, which includes minimizing the risk of identification3.
In conclusion, using pseudonyms is the best solution among the given options to protect personal information while still allowing the company to invest in DEI initiatives and gather the necessary data for analysis. This approach is in line with the principles-based framework and knowledge base in information privacy as outlined by the CIPP/C certification program2.

質問 # 36
In which of the following situations would an individual most likely to be able to withdraw her consent for processing?

• A. When she has recently changed jobs and no longer works for the same company.
• B. When she is leaving her bank and moving to another bank.
• C. When she no longer wishes to be sent marketing materials from an organization.
• D. When she disagrees with a diagnosis her doctor has recorded on her records.

正解：C

質問 # 37
Which statement is correct when considering the right to privacy under Section 7 of the Canadian Charter of Rights and Freedoms?

• A. The right to privacy protects the right to hold opinions and to receive and impart ideas without interference
• B. The right to privacy is an absolute right
• C. The right to freedom of expression under section 10 will always override the right to privacy
• D. The Supreme Court of Canada has stated that the Privacy Act has "quasi-constitutional status", and that the values and rights set out in the Act are closely linked to those set out in the Constitution as being necessary to a free and democratic society.

正解：D

解説：
Explanation
https://www.priv.gc.ca/en/about-the-opc/publications/guide_ind/

質問 # 38
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years.
Brady's business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady's company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box's chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box's home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box's Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady's business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles.
Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on the scenario, what is the main reason that Brady should be concerned with Hermes Designs' handling of customer personal data?

• A. The data is uncategorized.
• B. The data is sensitive.
• C. The data is being used for a new purpose.
• D. The data is being processed via a new means.

正解：D

質問 # 39
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
In regard to telemarketing practices, Evan the supervisor has a misconception regarding?

• A. The relationship of state law to federal law
• B. The conditions under which recipients can opt out
• C. The right to monitor calls for quality assurance
• D. The wishes of recipients who request callbacks

正解：D

質問 # 40
Under the Data Protection Law Enforcement Directive of the EU, a government can carry out covert investigations involving personal data, as long it is set forth by law and constitutes a measure that is both necessary and what?

• A. Prudent.
• B. Proportionate.
• C. Important.
• D. DPA-approved.

正解：B

質問 # 41
Of the key principles in the Personal Information Protection and Electronic Documents Act (PIPEDA), which principle in particular contributes to the increase in privacy policies in recent years?

• A. Openness.
• B. Individual Access.
• C. Accuracy
• D. Limiting Use, Disclosure, and Retention.

正解：A

質問 # 42
In which scenario is a Controller most likely required to undertake a Data Protection Impact Assessment?

• A. When the controller is required to have a Data Protection Officer.
• B. When the controller is collecting email addresses from individuals via an online registration form for marketing purposes.
• C. When personal data is being collected and combined with other personal data to profile the creditworthiness of individuals.
• D. When personal data is being transferred outside of the EEA.

正解：A

質問 # 43
Most states with data breach notification laws indicate that notice to affected individuals must be sent in the "most expeditious time possible without unreasonable delay." By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?

• A. Florida
• B. New York
• C. California
• D. Maine

正解：A

質問 # 44
......

厳密検証されたCIPP-C試験問題集と解答で無料提供のCIPP-C問題と正解付き：https://www.goshiken.com/IAPP/CIPP-C-mondaishu.html

CIPP-C試験問題 リアルCIPP-C練習問題集：https://drive.google.com/open?id=1fUztXavXIbngcjypOu4ZeHHqvmwL-Bfn