Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. IAPP
  5. CIPP-US

IAPP CIPP-US Exam
Certified Information Privacy Professional/United States (CIPP/US) (Page 9 )

Updated On: 9-Feb-2026
Page 9 of 52
PDF with 251 Questions

A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?

  1. Department of Health and Human Services
  2. The affected individuals
  3. The local media
  4. Medical providers

Answer(s): D


Reference:

https://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf (page 6)



What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

  1. The ability to correct inaccurate credit report information
  2. The truncation of account numbers on credit card receipts
  3. The right to request removal from email lists
  4. The issuing of notice when third-party data is used in an adverse decision

Answer(s): B



Who has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA)?

  1. State Attorneys General
  2. The Federal Trade Commission
  3. The Department of Commerce
  4. The Consumer Financial Protection Bureau

Answer(s): D


Reference:

https://www.ftc.gov/enforcement/statutes/fair-accurate-credit-transactions-act-2003



Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?

  1. To follow the Disposal Rule by having the reports shredded
  2. To follow the Red Flags Rule by mailing the reports to customers
  3. To follow the Privacy Rule by notifying customers that the reports are being stored
  4. To follow the Safeguards Rule by transferring the reports to a secure electronic file

Answer(s): A



When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?

  1. After disclosing information-sharing practices to customers and after giving them an opportunity to opt in.
  2. After disclosing marketing practices to customers and after giving them an opportunity to opt in.
  3. After disclosing information-sharing practices to customers and after giving them an opportunity to opt out.
  4. After disclosing marketing practices to customers and after giving them an opportunity to opt out.

Answer(s): C


Reference:

https://www.ftc.gov/tips-advice/business-center/guidance/how-comply-privacy-consumer-financial- information-rule-gramm






Post your Comments and Discuss IAPP CIPP-US exam prep with other Community members:

Join the CIPP-US Discussion