Free CIPM Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CIPM Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A privacy strategy is being developed for a new analytics service. Which information best grounds the strategy in the organization's operating context?

   1. A. The privacy controls used by the largest competitor
   2. B. The business objectives, legal environment and risk tolerance
   3. C. The number of privacy notices published during the prior year
   4. D. The technical controls already purchased by the security team

   Answer: B

   Explanation: NIST requires understanding "its mission or business environment; its legal environment; its risk tolerance". These factors ground strategy; competitor choices, activity counts and purchases do not establish that context.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — p. 11, Establishing or Improving a Privacy Program — Ready

2. 2A privacy policy lists commitments but does not connect them to the laws applicable to the organization. What documentation improvement does the Canadian commissioners' guidance support?

   1. A. List applicable laws without linking them to policy commitments
   2. B. Map policy requirements to the applicable legal obligations
   3. C. Cross-reference policy titles only to other internal policy titles
   4. D. Treat policy approval as evidence that every legal obligation is covered

   Answer: B

   Explanation: Policies "should show how they connect to the applicable privacy legislation." Mapping commitments to obligations establishes that connection; a law list, internal-title links or approval status alone does not.

   Reference: Getting Accountability Right with a Privacy Management Program — Part A.2(b), Policies, p. 10

3. 3A system inventory lists applications holding personal data but does not show how information moves between them. Which artifact addresses that gap?

   1. A. An inventory of the personal-data fields held in each application
   2. B. A register of each application's approved processing purpose
   3. C. A register of each application's assigned processing owner
   4. D. A map showing data actions, elements and processing interactions

   Answer: D

   Explanation: ID.IM-P8 calls for mapping "illustrating the data actions and associated data elements" and the relevant interactions. Field lists, purposes and owner registers alone do not show information movement between applications.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Appendix A, ID.IM-P8, p. 20

4. 4A control prevents unauthorized people from viewing or receiving personal information. Which security objective does it primarily support?

   1. A. Availability
   2. B. Integrity
   3. C. Confidentiality
   4. D. Interoperability

   Answer: C

   Explanation: Confidentiality means "Preserving authorized restrictions on information access and disclosure". Integrity concerns improper changes, availability concerns timely access, and interoperability is not this objective.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Appendix B, Confidentiality, p. 28

5. 5A privacy team completed 90 of 120 access requests within the applicable statutory timescale. Using the ICO's recommended timeliness KPI, what percentage was completed on time?

   1. A. 25%
   2. B. 33.3%
   3. C. 90%
   4. D. 75%

   Answer: D

   Explanation: The ICO recommends "the percentage completed within statutory timescales." Divide the 90 on-time requests by all 120 requests and multiply by 100: 75%. The other values confuse late requests, unrelated ratios or the raw count with the percentage.

   Reference: Data protection audit framework — Breach response and monitoring — Business targets and KPI, SAR performance

6. 6A GDPR controller receives a valid rights request and no extension applies. Article 12(3) requires action information without undue delay and within what outer time limit?

   1. A. One week from receipt
   2. B. One month from receipt
   3. C. Two months from receipt
   4. D. Three months from receipt

   Answer: B

   Explanation: Article 12(3) requires response "without undue delay and in any event within one month of receipt". One month is the outer limit in the stated circumstances, not permission to delay unnecessarily.

   Reference: Regulation (EU) 2016/679 — General Data Protection Regulation — Article 12(3)

7. 7When defining privacy program scope, why should a team examine whether the organization really needs the personal information it holds?

   1. A. To replace the assessment of applicable legal obligations
   2. B. To determine whether collected information is already public
   3. C. To identify unnecessary holdings while understanding actual data use
   4. D. To assign the same retention period to every business function

   Answer: C

   Explanation: The guidance calls for knowing "what personal information it holds, how it is being used – and whether it really needs it at all." Scope discovery includes examining necessity instead of assuming all existing holdings are justified.

   Reference: Getting Accountability Right with a Privacy Management Program — Part A.2(a), Personal Information Inventory, p. 9

8. 8An organization has a standalone privacy policy, but its procurement and human resources policies ignore privacy. Which approach does the Canadian commissioners' guidance recommend?

   1. A. Treat the standalone privacy policy as making operational policy review unnecessary
   2. B. Copy every privacy clause unchanged into every departmental policy
   3. C. Incorporate relevant privacy requirements into operational policies
   4. D. Integrate privacy into IT policies while excluding procurement and HR policies

   Answer: C

   Explanation: The guidance says to "incorporate privacy compliance requirements in other policies" as appropriate, and names procurement and human resources. Relevant integration differs from either isolation or indiscriminate copying.

   Reference: Getting Accountability Right with a Privacy Management Program — Part A.2(b), Policies, p. 10

9. 9A data inventory describes record types but does not identify whose data are processed. Which NIST inventory element is missing?

   1. A. Categories of individuals, such as customers and employees
   2. B. Categories of data, such as contact and transaction information
   3. C. Categories of recipients, such as vendors and business partners
   4. D. Categories of actions, such as collection and disclosure

   Answer: A

   Explanation: ID.IM-P3 states: "Categories of individuals (e.g., customers, employees or prospective employees, consumers) whose data are being processed are inventoried." Data types, recipients and actions identify other inventory dimensions, not whose data are processed.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Appendix A, ID.IM-P3, p. 20

10. 10Which security objective concerns guarding personal information against improper modification or destruction?

    1. A. Integrity
    2. B. Availability
    3. C. Confidentiality
    4. D. Portability

    Answer: A

    Explanation: NIST defines integrity as "Guarding against improper information modification or destruction". Availability and confidentiality concern different protections; portability concerns movement or provision of data.

    Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Appendix B, Integrity, p. 29