Pass CIPP-US Exam Latest Practice Questions Updated on Sep 04, 2026 [Q104-Q119]

4.6/5 - (5 votes)

Pass CIPP-US Exam Latest Practice Questions Updated on Sep 04, 2026

IAPP CIPP-US Study Guide Archives

IAPP CIPP-US Exam Overview:

Certification Vendor:	IAPP
Exam Name:	CIPP/US Certification Exam
Exam Number:	CIPP-US
Exam Price:	$550 USD (standard registration, subject to change and region/member pricing)
Certificate Validity Period:	2 years
Real Exam Qty:	Approximately 90 multiple-choice questions
Exam Duration:	150 minutes
Exam Format:	Multiple-choice, Computer-based exam (proctored)
Related Certifications:	CIPP/E CIPP/C CIPP/A CIPM CIPT
Available Languages:	English
Passing Score:	300 (scaled score, 100–500 scale)
Recommended Training:	IAPP Body of Knowledge / Study Guide IAPP Official CIPP/US Training
Exam Registration:	Pearson VUE Exam Delivery IAPP CIPP/US Registration
Sample Questions:	IAPP CIPP-US Sample Questions
Exam Way:	Computer-based proctored exam delivered via Pearson VUE test centers or online proctoring.
Pre Condition:	No formal prerequisites required; prior privacy or legal knowledge is strongly recommended.
Official Syllabus URL:	https://iapp.org/certify/cippus/

NO.104 When does the Telemarketing Sales Rule require an entity to share a do-not-call request across its organization?

When the operational structures of its divisions are not transparent

When the goods and services sold by its divisions are very similar

When a call is not the result of an error or other unforeseen cause

When the entity manages user preferences through multiple platforms

* The Telemarketing Sales Rule (TSR) is a federal regulation that implements the Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994. The TSR aims to protect consumers from deceptive or abusive telemarketing practices, such as unwanted calls, false or misleading claims, unauthorized billing, and privacy violations1.
* The TSR requires telemarketers and sellers to comply with the National Do Not Call Registry, which is a list of phone numbers of consumers who have indicated that they do not want to receive telemarketing calls2.
* The TSR also requires telemarketers and sellers to honor the do-not-call requests of individual consumers, regardless of whether their numbers are on the National Do Not Call Registry or not2.
* A do-not-call request is a statement made by a consumer, either orally or in writing, that they do not wish to receive any more calls from a specific telemarketer or seller2.
* The TSR requires an entity to share a do-not-call request across its organization when the operational structures of its divisions are not transparent to consumers3. This means that the entity must treat the do- not-call request as if it applies to all of its affiliates and subsidiaries that engage in telemarketing, unless the consumer would reasonably expect them to be separate and distinct entities based on their names, products, or services3.
* The TSR does not require an entity to share a do-not-call request across its organization in the following situations:
* When the goods and services sold by its divisions are very similar. This is not a relevant factor for determining whether the entity must share a do-not-call request across its organization. The key factor is whether the consumers can distinguish between the different divisions based on their operational structures3.
* When a call is not the result of an error or other unforeseen cause. This is not an exception to the requirement to honor a do-not-call request. The TSR prohibits telemarketers and sellers from calling a consumer who has made a do-not-call request, unless the call falls under one of the specific exemptions, such as calls from or on behalf of tax-exempt nonprofit organizations, calls to consumers with whom the seller has an established business relationship, or calls to consumers who have given prior express written consent2.
* When the entity manages user preferences through multiple platforms. This is not an excuse for not sharing a do-not-call request across its organization. The TSR requires telemarketers and sellers to maintain an internal do-not-call list of consumers who have asked them not to call again, and to update the list at least once every 31 days2. The entity must ensure that the do-not- call request is recorded and communicated across all of its platforms that are used for telemarketing purposes3.
References: 1: Telemarketing Sales Rule 2: Q&A for Telemarketers & Sellers About DNC Provisions in TSR 3: Federal Register :: Telemarketing Sales Rule

NO.105 California’s SB 1386 was the first law of its type in the United States to do what?

Require commercial entities to disclose a security data breach concerning personal information about the state’s residents

Require notification of non-California residents of a breach that occurred in California

Require encryption of sensitive information stored on servers that are Internet connected

Require state attorney general enforcement of federal regulations against unfair and deceptive trade practices

NO.106 Which of the following is commonly required for an entity to be subject to breach notification requirements under most state laws?

The entity must conduct business in the state

The entity must have employees in the state

The entity must be registered in the state

The entity must be an information broker

NO.107 Under the EU-US Data Privacy Framework, what must participating organizations provide to individuals in regard to complaints and disputes?

An independent recourse mechanism.

A copy 01 the individual’s personal data

A description of the organization’s data processing policies

A means of communicating with the organization’s privacy team.

NO.108 Which of the following practices is NOT a key component of a data ethics framework?

Automated decision-making.

Preferability testing.

Data governance.

Auditing.

NO.109 What practice do courts commonly require in order to protect certain personal information on documents, whether paper or electronic, that is involved in litigation?

Redaction

Encryption

Deletion

Hashing

NO.110 Which of the following most accurately describes the regulatory status ot pandemic contact-tracing apps in the United States?

Contact tracing is covered exclusively under the Health Insurance Portability and Accountability Act (HIPAA).

Contact tracing is regulated by the U.S. Centers for Disease Control and Prevention (CDC).

Contact tracing is subject to a patchwork of federal and state privacy laws

Contact tracing is not regulated in the United States.

In the United States, pandemic contact-tracing apps are regulated under a patchwork of federal and state privacy laws, rather than a single, comprehensive framework. Contact-tracing initiatives often involve the collection and processing of sensitive data, including location and health information, which may fall under different legal regimes depending on the jurisdiction and type of data.
Key Regulations Affecting Contact-Tracing Apps:
* State Privacy Laws:
* States such as California (via the California Consumer Privacy Act – CCPA) and others have privacy laws that may apply to contact-tracing apps, particularly when personal data is collected or shared.
* State-level health privacy laws may also govern how health-related data is collected and used.
* HIPAA:
* HIPAA (Health Insurance Portability and Accountability Act) applies only if the app is used by or on behalf of a covered entity (e.g., healthcare providers or health plans). If the app is operated by a private company without a connection to a HIPAA-covered entity, HIPAA likely does not apply.
* Federal Guidance:
* The Federal Trade Commission (FTC) enforces general privacy protections under Section 5 of the FTC Act, which prohibits unfair or deceptive practices.
* The FTC has also issued guidance on privacy considerations for health-related apps.
* Other Federal and Sector-Specific Laws:
* If the app collects health-related data, it could also trigger obligations under laws like the Americans with Disabilities Act (ADA) or sector-specific rules.
Explanation of Options:
* A. Contact tracing is covered exclusively under the Health Insurance Portability and Accountability Act (HIPAA):This is incorrect. HIPAA applies only to covered entities and their business associates, not broadly to all contact-tracing apps or initiatives.
* B. Contact tracing is regulated by the U.S. Centers for Disease Control and Prevention (CDC):
This is incorrect. While the CDC provides guidance and recommendations for public health, it does not have regulatory authority over contact-tracing apps.
* C. Contact tracing is subject to a patchwork of federal and state privacy laws:This is correct.
Contact-tracing apps in the U.S. are governed by various federal, state, and sector-specific laws, creating a patchwork regulatory framework.
* D. Contact tracing is not regulated in the United States:This is incorrect. While there is no single regulatory framework for contact tracing, the practice is subject to multiple federal and state laws.
References from CIPP/US Materials:
* IAPP CIPP/US Certification Textbook: Discusses the application of HIPAA, state privacy laws, and federal regulations to health-related technologies, including contact-tracing apps.
* FTC Guidance on Health Apps: Details privacy considerations for app developers handling health- related data.

NO.111 What consumer service was the Fair Credit Reporting Act (FCRA) originally intended to provide?

The ability to receive reports from multiple credit reporting agencies.

The ability to appeal negative credit-based decisions.

The ability to correct inaccurate credit information.

The ability to investigate incidents of identity theft.

NO.112 What is the main purpose of the Global Privacy Enforcement Network?

To promote universal cooperation among privacy authorities

To investigate allegations of privacy violations internationally

To protect the interests of privacy consumer groups worldwide

To arbitrate disputes between countries over jurisdiction for privacy laws

NO.113 Mega Corp. is a U.S.-based business with employees in California, Virginia, and Colorado. Which of the following must Mega Corp. comply with in regard to its human resources data?

California Privacy Rights Act.

California Privacy Rights Act and Virginia Consumer Data Protection Act.

California Privacy Rights Act and Colorado Privacy Act.

California Privacy Rights Act, Virginia Consumer Data Protection Act, and Colorado Privacy Act.

Mega Corp. is a U.S.-based business with employees in California, Virginia, and Colorado.
Therefore, it must comply with the privacy laws of these three states in regard to its human resources data, unless it qualifies for an exemption under each law.
The California Privacy Rights Act (CPRA) is an amendment to the California Consumer Privacy Act (CCPA) that was approved by voters in November 2020 and will take effect on January 1,
202. The CPRA expands the rights and protections of California residents with respect to their personal information and creates a new category of sensitive personal information that includes certain employment-related data, such as Social Security numbers, driver’s license numbers, passport numbers, financial account information, biometric information, and geolocation data. The CPRA also establishes a new enforcement agency, the California Privacy Protection Agency, to oversee and enforce the law.
The Virginia Consumer Data Protection Act (VCDPA) is a comprehensive privacy law that was enacted in March 2021 and will take effect on January 1, 202. The VCDPA grants Virginia residents several rights with respect to their personal data, such as the right to access, correct, delete, port, and opt out of certain processing activities. The VCDPA also imposes various obligations on businesses that control or process personal data of Virginia residents, such as conducting data protection assessments, entering into contracts with processors, and providing privacy notices. The Colorado Privacy Act (CPA) is another comprehensive privacy law that was enacted in July 2021 and will take effect on July 1, 202. The CPA grants Colorado residents similar rights as the VCDPA, with some variations, such as the right to appeal a business’s response to a request and the right to opt out of targeted advertising, the sale of personal data, and certain profiling activities. The CPA also imposes similar obligations as the VCDPA, with some differences, such as requiring opt-in consent for the processing of sensitive data and allowing businesses to join a universal opt-out mechanism. All three laws apply to businesses that conduct business in or target consumers in the respective states and meet certain thresholds of revenue or data processing volume. However, all three laws also provide exemptions for certain types of data or entities that are subject to other federal or state laws, such as the Gramm-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), the Fair Credit Reporting Act (FCRA), and the Family Educational Rights and Privacy Act (FERPA).
One of the exemptions that may be relevant for Mega Corp. is the employee data exemption, which excludes personal data that is collected and used by an employer within the context of an employment relationship or for emergency contact or benefits administration purposes. However, this exemption is not permanent or uniform across the three laws. The CPRA’s employee data exemption is set to expire on January 1, 2023, unless extended by the legislature. The VCDPA’s employee data exemption is set to expire on January 1, 2023, unless repealed by the legislature.
The CPA’s employee data exemption does not have an expiration date, but it does not apply to the right to opt out of the sale of personal data or the right to appeal a business’s response to a request. Therefore, depending on the type and scope of the human resources data that Mega Corp. collects and processes, it may have to comply with the California Privacy Rights Act, the Virginia Consumer Data Protection Act, and the Colorado Privacy Act, unless it qualifies for another exemption under each law.

NO.114 SCENARIO
Please use the following to answer the next QUESTION:
Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer’s privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.
Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.
After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer’s personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.
Janice understood Cheryl’s concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company’s day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.
Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.
What is the best reason for Cheryl to follow Janice’s suggestion about classifying customer data?

It will help employees stay better organized

It will help the company meet a federal mandate

It will increase the security of customers’ personal information (PI)

It will prevent the company from collecting too much personal information (PI)

NO.115 A company’s employee wellness portal offers an app to track exercise activity via users’ mobile devices.
Which of the following design techniques would most effectively inform users of their data privacy rights and privileges when using the app?

Offer information about data collection and uses at key data entry points.

Publish a privacy policy written in clear, concise, and understandable language.

Present a privacy policy to users during the wellness program registration process.

Provide a link to the wellness program privacy policy at the bottom of each screen.

The design technique that would most effectively inform users of their data privacy rights and privileges when using the app is to offer information about data collection and uses at key data entry points. This technique is also known as “just-in-time” or “layered” notice, and it is recommended by the U.S. Federal Trade Commission (FTC) as a best practice for mobile app developers12 The idea behind this technique is to provide users with relevant and timely information about how their data is collected and used by the app, and what choices they have to control their data, at the moment when they are asked to provide or access their data. For example, if the app collects location data from the user’s device, it should display a pop-up notice explaining why it needs the location data, how it will use it, and how the user can opt-out or change the settings. This way, the user can make an informed decision about whether to allow or deny the app’s access to their data, and understand the consequences of their choice12 The advantage of this technique is that it avoids overwhelming the user with too much information at once, and instead provides concise and contextual information that is easy to understand and act upon. It also increases the user’s trust and confidence in the app, as they feel more in control of their data and privacy12 The other design techniques are less effective because they do not provide the user with sufficient or timely information about their data privacy rights and privileges when using the app. Publishing a privacy policy written in clear, concise, and understandable language is a good practice, but it is not enough to inform the user of their data privacy rights and privileges, as many users may not read or understand the policy, or may not be aware of where to find it. Presenting a privacy policy to users during the wellness program registration process is also a good practice, but it may not capture all the data collection and uses that the app may perform, and it may not give the user enough opportunity to review and consent to the policy. Providing a link to the wellness program privacy policy at the bottom of each screen is also a good practice, but it may not be noticeable or accessible to the user, and it may not provide the user with the specific information they need at the point of data entry or access12 References:
* Mobile Privacy Disclosures: Building Trust Through Transparency: A Federal Trade Commission Staff Report (February 2013)
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 6: Privacy Program Management, Section 6.4: Privacy by Design

NO.116 Which of the following conditions would NOT be sufficient to excuse an entity from providing breach notification under state law?

If the data involved was encrypted.

If the data involved was accessed but not exported.

If the entity was subject to the GLBA Safeguards Rule.

If the entity followed internal notification procedures compatible with state law.

NO.117 Under the California Consumer Privacy Act (as amended by the California Pnvacy Rights Act), a consumer may Initiate a civil action against a business for?

Any personal information that is subject to unauthorized access or disclosure.

A security breach of certain categories of personal information that is nonencrypted and nonredacted

Failure to implement and maintain reasonable security procedures and practices to protect the personal information held.

Failure to implement and maintain security practices set out in regulations issued by the California Privacy Protection Agency (CPPA).

NO.118 Which of the following would NOT be regulated by the Illinois Biometnc Information Pnvacy Act (BIPA)?

Photographs of local convicted felons uploaded lo a news website.

Fingerprint scans of elementary school students used to open their lockers

Security software designed to identify local convicted felons in retail stores via facial recognition.

Retina scans of elementary school students used to verify their identities for attendance purposes

NO.119 SCENARIO
Please use the following to answer the next QUESTION
Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in Californi a. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants’ postings on social media, ask Question:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.
Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle’s GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.
Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia’s concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it’s unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.
In any case, Celeste feels that all they need is common sense – like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she’s right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.
Regarding credit checks of potential employees, Celeste has a misconception regarding what?

Consent requirements.

Disclosure requirements.

Employment-at-will rules.

Records retention policies

The CIPP-US exam covers various topics related to privacy laws and regulations in the United States, including the Fair Credit Reporting Act (FCRA), the Children’s Online Privacy Protection Act (COPPA), the Health Insurance Portability and Accountability Act (HIPAA), and various state laws related to data privacy. CIPP-US exam also covers important frameworks and guidelines such as the General Data Protection Regulation (GDPR) and the Privacy Shield Framework. The CIPP-US certification is recognized as the gold standard for privacy professionals in the United States, and passing the exam demonstrates a high level of understanding and expertise in the field of privacy.

CIPP-US Questions Prepare with Learning Information: https://www.dumpleader.com/CIPP-US_exam.html

IAPP CIPP-US Exam Overview:

Leave a Reply Cancel reply