[Mar 05, 2026] Valid CIPP-US Test Answers & IAPP CIPP-US Exam PDF [Q90-Q105]

Rate this post

[Mar 05, 2026] Valid CIPP-US Test Answers & IAPP CIPP-US Exam PDF

Realistic CIPP-US Exam Dumps with Accurate & Updated Questions

IAPP CIPP-US Exam is a rigorous and challenging exam that requires extensive knowledge and expertise in the field of privacy. Individuals who wish to take the exam must have a good understanding of the basic principles of data protection and privacy laws in the US. They must also be familiar with the latest developments in the field and be able to apply this knowledge to real-world scenarios.

The IAPP CIPP-US exam is a measure of how well a specialist is conversant with data protection laws in the US. The associated certification called the CIPP-US stands for the Certified Information Privacy Professional-US. It has accreditation from ANSI/ISO and is continually updated to ensure that the candidate only gets tested for the most current concepts in the industry. The questions in the official exam assess varying areas of the US data protection policies and a candidate needs to know how to apply and manage them in their daily work.

IAPP CIPP-US (Certified Information Privacy Professional/United States) exam is a highly respected certification for professionals in the field of data privacy. Certified Information Privacy Professional/United States (CIPP/US) certification is awarded by the International Association of Privacy Professionals (IAPP), which is the largest and most respected global association for privacy professionals. The CIPP-US exam is designed to test a candidate’s knowledge of privacy laws and regulations in the United States, as well as their ability to implement and manage privacy programs in organizations.

NO.90 Which law provides employee benefits, but often mandates the collection of medical information?

The Occupational Safety and Health Act.

The Americans with Disabilities Act.

The Employee Medical Security Act.

The Family and Medical Leave Act.

The Family and Medical Leave Act (FMLA) is a federal law that provides eligible employees with up to 12 weeks of unpaid, job-protected leave per year for certain family and medical reasons, such as the birth or adoption of a child,the serious health condition of the employee or a family member, or a qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty or call to covered active duty status in the Armed Forces. The FMLA also provides eligible employees with up to 26 weeks of unpaid, job-protected leave per year to care for a covered service member with a serious injury or illness if the employee is the spouse, child, parent, or next of kin of the service member. The FMLA applies to all public agencies, including state, local, and federal employers, and local education agencies (schools), and to private sector employers who employ 50 or more employees for at least 20 workweeks in the current or preceding calendar year.
The FMLA often requires employers to collect medical information from employees who request FMLA leave or from their health care providers to certify the need for leave, the duration of leave, and the employee’s ability to return to work. The FMLA regulations specify the type and amount of information that employers may request and require for different types of FMLA leave, such as:
* Basic medical facts, such as the diagnosis, symptoms, hospitalization, doctor visits, whether medication has been prescribed, and any referrals for evaluation or treatment, for the employee’s own serious health condition or that of a family member.
* Information on the medical necessity of intermittent leave or reduced schedule leave and the expected frequency and duration of such leave, for the employee’s own serious health condition or that of a family member, or for planned medical treatment.
* A statement of the facts regarding the qualifying exigency, such as the type of military duty, the dates of the covered active duty, and the contact information of the military member, for leave due to a qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty or call to covered active duty status in the Armed Forces.
* Information on the medical condition, treatment, and recovery of the covered service member, such as the date of injury or onset of illness, the current medical status, the prognosis, and the estimated time of treatment, for leave to care for a covered service member with a serious injury or illness.
The FMLA also imposes certain obligations on employers to protect the privacy and security of the medical information they collect from employees or their health care providers. For example, employers must:
* Maintain records and documents relating to medical certifications, recertifications, or medical histories of employees or employees’ family members as confidential medical records in separate files/records from the usual personnel files, and if the Americans with Disabilities Act (ADA) applies, such records
* must be maintained in conformance with ADA confidentiality requirements.
* Ensure that any electronic systems used to maintain such records meet the confidentiality requirements of the FMLA and the ADA, and that only authorized persons have access to such records.
* Limit the disclosure of such records to supervisors and managers who need to know about an employee’s FMLA leave, first aid and safety personnel when an employee’s medical condition might require emergency treatment, and government officials investigating compliance with the FMLA.
* Comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule when requesting medical information from an employee’s health care provider, such as obtaining a valid authorization from the employee or using a HIPAA-compliant certification form.
* Refrain from requesting more information than allowed by the FMLA regulations, such as asking for an employee’s complete medical records or information unrelated to the FMLA leave request.
* Respect the employee’s right to revoke a medical authorization or challenge a medical certification, and follow the procedures for resolving disputes over the validity or sufficiency of such documents.
References:
* The Family and Medical Leave Act (FMLA)
* FMLA Employee Guide
* FMLA Employer Guide
* FMLA Regulations
* FMLA Forms

NO.91 Which federal law or regulation preempts state law?

Health Insurance Portability and Accountability Act

Controlling the Assault of Non-Solicited Pornography and Marketing Act

Telemarketing Sales Rule

Electronic Communications Privacy Act of 1986

NO.92 SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son’s bedroom one evening and found him stretched out on his bed typing on his laptop.
“Doing your network?” Matt asked hopefully.
“No,” the boy said. “I’m filling out a survey.”
Matt looked over his son’s shoulder at his computer screen. “What kind of survey?” “It’s asking Questions about my opinions.”
“Let me see,” Matt said, and began reading the list of Questions that his son had already answered. “It’s asking your opinions about the government and citizenship. That’s a little odd. You’re only ten.” Matt wondered how the web link to the survey had ended up in his son’s email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son’s inbox, and he decided it was time to report the incident to the proper authorities.
How does Matt come to the decision to report the marketer’s activities?

The marketer failed to make an adequate attempt to provide Matt with information

The marketer did not provide evidence that the prize books were appropriate for children

The marketer seems to have distributed his son’s information without Matt’s permission

The marketer failed to identify himself and indicate the purpose of the messages

Matt’s decision to report the marketer’s activities is based on his suspicion that the marketer violated the Children’s Online Privacy Protection Act (COPPA), which is a federal law that regulates the online collection, use, and disclosure of personal information from children under 13 years of age1. According to COPPA, operators of websites or online services that are directed to children or knowingly collect personal information from children must:
* Provide notice to parents about their information practices and obtain verifiable parental consent before collecting, using, or disclosing personal information from children12.
* Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties (unless disclosure is integral to the site or service, in which case, this must be made clear to parents)12.
* Provide parents access to their child’s personal information to review and/or have the information deleted and give parents the opportunity to prevent further use or online collection of a child’s personal information12.
* Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security12.
* Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use12.
* Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children12.
In Matt’s case, he did not receive any notice from the marketer about the survey or the contest, nor did he give his consent for the collection or disclosure of his son’s personal information. He also did not have any access or control over his son’s information or the ability to prevent further use or collection. Moreover, he noticed that his son’s information seemed to have been shared with other marketers, as evidenced by the commercial emails in his son’s inbox. These actions indicate that the marketer did not comply with COPPA’s requirements and may have exposed his son’s information to unauthorized or inappropriate parties. Therefore, Matt decided to report the marketer’s activities to the proper authorities, such as the Federal Trade Commission (FTC), which enforces COPPA and can impose civil penalties for violations13. References: 1:
Children’s Online Privacy Protection Act | Federal Trade Commission, 1. 2: 16 CFR Part 312 – Children’s Online Privacy Protection Rule, 3. 3: Children’s Online Privacy Protection Act – Wikipedia, 2.

NO.93 When developing a company privacy program, which of the following relationships will most help a privacy professional develop useful guidance for the organization?

Relationships with individuals within the privacy professional community who are able to share expertise and leading practices for different industries.

Relationships with clients, vendors, and customers whose data will be primarily collected and used throughout the organizational program.

Relationships with company leaders responsible for approving, implementing, and periodically reviewing the corporate privacy program.

Relationships with individuals across company departments and at different levels in the organization’s hierarchy.

NO.94 Robert has been having some arguments with another boy at school. The other boy has posted a picture semi-nude picture of Robert on social media that he took in the boy’s locker room after football practice. Along with the picture the boy identified Robert by first and last name and what school they attend. Regarding privacy law, what course of action would you recommend to Don in this situation?

Contact the social media website to have the content removed.

Report the incident to the FTC since they have specific authority for COPPA.

Have Robert do the same thing to the other boy

Attempt to contact the boy’s parents and make them remove the picture and information.

NO.95 What is the main reason some supporters of the European approach to privacy are skeptical about self- regulation of privacy practices?

A large amount of money may have to be sent on improved technology and security

Industries may not be strict enough in the creation and enforcement of rules

A new business owner may not understand the regulations

Human rights may be disregarded for the sake of privacy

The European approach to privacy is based on the recognition of privacy as a fundamental human right that requires strong legal protection and oversight. The EU has adopted comprehensive and binding privacy laws, such as the General Data Protection Regulation (GDPR) and the ePrivacy Directive, that apply to all sectors and activities involving personal data. The EU also has independent data protection authorities (DPAs) that monitor and enforce compliance with the privacy laws, and a European Data Protection Board (EDPB) that issues guidance and opinions on privacy matters. The EU also requires adequate levels of privacy protection for personal data transferred to third countries or international organizations.
In contrast, the U.S. approach to privacy is based on a sectoral and self-regulatory model that relies on a combination of federal and state laws, industry codes of conduct, consumer education, and market forces. The
U.S. does not have a single, comprehensive, and enforceable federal privacy law that covers all sectors and activities involving personal data. Instead, the U.S. has a patchwork of federal and state laws that address specific issues or sectors, such as health, financial, children’s, and electronic communications privacy. The U.
S. also has various federal and state agencies that share jurisdiction over privacy matters, such as the Federal Trade Commission (FTC), the Federal Communications Commission (FCC), and the Department of Health and Human Services (HHS). The U.S. also relies on self-regulation by industries that develop and adhere to voluntary codes of conduct, standards, and best practices for privacy. The U.S. also allows personal data to be transferred to third countries or international organizations without requiring adequate levels of privacy protection, as long as the data subjects have given their consent or the transfer is covered by a mechanism such as the Privacy Shield or the Standard Contractual Clauses.
Some supporters of the European approach to privacy are skeptical about self-regulation of privacy practices because they believe that self-regulation is not effective, consistent, or accountable enough to protect the rights and interests of data subjects. They argue that self-regulation may not provide sufficient incentives or sanctions for industries to comply with privacy rules, or to adopt privacy-enhancing technologies and practices. They also contend that self-regulation may not reflect the views and expectations of data subjects, or address the emerging and complex privacy challenges posed by new technologies and business models.
They also question the transparency and legitimacy of self-regulation, and the ability of data subjects to exercise their rights and seek redress for privacy violations. References:
* IAPP CIPP/US Study Guide, Chapter 1: Introduction to the U.S. Privacy Environment, pp. 9-10, 16-17
* IAPP website, CIPP/US Certification
* NICCS website, Certified Information Privacy Professional/United States (CIPP/US) Training

NO.96 Global Manufacturing Co’s Human Resources department recently purchased a new software tool. This tool helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and what is said about them. This provides the HR department with an automated “360 review” that lets them know how the candidate thinks and operates, what their peers and direct reports say about them, and how well they interact with each other.
What is the most important step for the Human Resources Department to take when implementing this new software?

Making sure that the software does not unintentionally discriminate against protected groups.

Ensuring that the software contains a privacy notice explaining that employees have no right to privacy as long as they are running this software on organization systems to scan email systems.

Confirming that employees have read and signed the employee handbook where they have been advised that they have no right to privacy as long as they are using the organization’s systems, regardless of the protected group or laws enforced by EEOC.

Providing notice to employees that their emails will be scanned by the software and creating automated profiles.

NO.97 Which statement is FALSE regarding the provisions of the Employee Polygraph Protection Act of 1988 (EPPA)?

The EPPA requires that employers post essential information about the Act in a conspicuous location.

The EPPA includes an exception that allows polygraph tests in professions in which employee honesty is necessary for public safety.

Employers are prohibited from administering psychological testing based on personality traits such as honesty, preferences or habits.

Employers involved in the manufacture of controlled substances may terminate employees based on polygraph results if other evidence exists.

NO.98 One of the most significant elements of Senate Bill No. 260 relating to Internet privacy is the introduction of what term into Nevada law?

Data Ethics

Data Brokers

Artificial Intelligence.

Transfer Mechanism

NO.99 SCENARIO
Please use the following to answer the next QUESTION:
You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A.
HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B.
As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures.
A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI of public figures including celebrities and politicians.
During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected.
A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach.
Of the safeguards required by the HIPAA Security Rule, which of the following is NOT at issue due to HealthCo’s actions?

Administrative Safeguards

Technical Safeguards

Physical Safeguards

Security Safeguards

NO.100 In what way does the “Red Flags Rule” under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?

It mandates the use of updated technology for securing credit records

It requires the owner to implement an identity theft warning system

It is not usually enforced in the case of a small financial institution

It does not apply because the owner is not a creditor

NO.101 In what way does the “Red Flags Rule” under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?

It mandates the use of updated technology for securing credit records

It requires the owner to implement an identity theft warning system

It is not usually enforced in the case of a small financial institution

It does not apply because the owner is not a creditor

NO.102 In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?

Scanning emails sent to and received by students

Making student education records publicly available

Relying on verbal consent for a disclosure of education records

Disclosing education records without obtaining required consent

NO.103 Which of the following is most likely to provide privacy protection to private-sector employees in the United States?

State law, contract law, and tort law

The Federal Trade Commission Act (FTC Act)

Amendments one, four, and five of the U.S. Constitution

The U.S. Department of Health and Human Services (HHS)

NO.104 SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son’s bedroom one evening and found him stretched out on his bed typing on his laptop. “Doing your network?” Matt asked hopefully.
“No,” the boy said. “I’m filling out a survey.”
Matt looked over his son’s shoulder at his computer screen. “What kind of survey?” “It’s asking Questions about my opinions.”
“Let me see,” Matt said, and began reading the list of Questions that his son had already answered. “It’s asking your opinions about the government and citizenship. That’s a little odd. You’re only ten.” Matt wondered how the web link to the survey had ended up in his son’s email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son’s inbox, and he decided it was time to report the incident to the proper authorities.
How does Matt come to the decision to report the marketer’s activities?

The marketer failed to make an adequate attempt to provide Matt with information

The marketer did not provide evidence that the prize books were appropriate for children

The marketer seems to have distributed his son’s information without Matt’s permission

The marketer failed to identify himself and indicate the purpose of the messages

NO.105 Don understands that some location-based services simply enhance the user experience. Others, such as daily fantasy sports applications that allow sports betting, require that location-based services be activated to function at all. Given Don’s concern over his children’s safety, which of the following best practices would you recommend to Don?

Do not allow the children to use location-based services at all.

Allow the children to turn on location-based services on their smart phones, but not their gaming consoles.

Allow the children to turn on location-based services on their gaming consoles, but not their smart phones.

Allow the children to turn on location-based services on all their devices.