IAPP Certified Information Privacy Professional CIPP-E

무료 샘플을 먼저 확인한 뒤 구매를 결정하셔도 됩니다. Itcertkr는 CIPP-E 샘플 문제와 IAPP Certified Information Privacy Professional/Europe (CIPP/E) 학습 자료를 제공해 310 문항의 구성 방식을 미리 살펴보기 쉽게 했습니다.

IAPP CIPP-E 시험 개요:

IAPP CIPP-E 시험 요강 주제:

CIPP-E 응시자가 많이 찾는 질문

IAPP CIPP-E 인증은 무엇을 확인하는 시험인가요?

CIPP-E는 IAPP의 Certified Information Privacy Professional/Europe에 해당하는 인증 시험으로, 통과 시 Certified Information Privacy Professional 취득과 연결됩니다. 인증 등급은 Professional로 안내되어 있습니다. 연계 인증으로는 CIPM, CIPT, CIPP/US, CIPP/C, CIPP/A, CIPP/CN 등이 함께 언급됩니다.

CIPP-E 문항 수와 시험 시간은 어떻게 되나요?

총 문항 수는 90, 시험 시간은 150분로 안내됩니다. 단순히 총량만 외우기보다 전체 시간을 초반·중반·후반으로 나누어 푸는 연습이 필요하며, Itcertkr 모의고사로 제한 시간 안에 답안을 고르는 속도와 표시 후 재검토 습관을 함께 점검하시기 바랍니다. 실전에서는 애매한 문항에 오래 멈추기보다 먼저 풀 수 있는 문항을 확보하는 편이 유리합니다.

CIPP-E 합격 점수와 응시 비용은 얼마인가요?

공식 안내 기준 합격 점수는 300/500, 응시 비용은 $550 USD입니다. 불합격하면 재응시 시 비용을 다시 부담해야 하므로, 본시험 전에 Itcertkr의 310 문항으로 여러 차례 자가 진단을 해 보시고 점수 편차가 큰 영역을 보완한 뒤 응시 일정을 잡는 것이 안전합니다.

CIPP-E 응시 자격이나 사전 조건이 있나요?

사전 조건은 정식 선행 요건은 없습니다. GDPR 및 유럽 개인정보 보호법에 대한 지식이 권장됩니다.로 안내됩니다. 세부 기준은 시험 개편이나 지역 정책에 따라 달라질 수 있으므로 공식 안내 페이지에서 최신 조건을 반드시 확인하시기 바랍니다.

CIPP-E 자료를 구매하기 전에 미리 볼 수 있나요?

가능합니다. Itcertkr는 무료 샘플을 제공해 IAPP Certified Information Privacy Professional/Europe (CIPP/E) 연습문제의 문항 구성과 해설 방식을 먼저 확인하실 수 있게 했습니다. 구매 후에는 365일 무료 업데이트가 적용되며, 기간이 지난 뒤에도 50% 할인으로 업데이트를 이어 가실 수 있습니다.

CIPP-E 시험에 불합격하면 어떻게 해야 하나요?

Itcertkr는 조건을 충족한 경우 환불 보장을 제공합니다. 구매 후 60일 이내에 해당 CIPP-E 시험에 응시해 불합격한 경우에 한해 신청할 수 있으며, 구매 후 3일 이내 응시 실패, 다운로드만 하고 미응시한 경우, 무료 자료나 만료 주문은 대상이 아닙니다. 응시자 이름과 결제자 이름이 같아야 하고, 시험 후 2일 이내에 응시 등록 확인서 사본과 공식 Score Report PDF를 제출하면 접수 후 7일 이내에 처리됩니다. 환불 대신 원하시면 동일 가치의 시험 자료 두 개를 무료로 받고 기존 구매 제품의 업데이트 서비스를 유지하는 교체 방식도 선택하실 수 있습니다. 제품은 결제 후 즉시 다운로드되며 1분 이내에 이메일로도 발송되고, 2시간이 지나도 받지 못하면 고객 지원에 문의하시면 됩니다. 설치 가능한 컴퓨터 수에는 제한이 없습니다.

CIPP-E 시험 범위는 어떻게 구성되나요?

IAPP Certified Information Privacy Professional/Europe (CIPP/E)은 총 5개 영역으로 나뉘어 출제됩니다. 대표적으로 다음 영역을 우선 확인하시기 바랍니다.

• 유럽 데이터 보호의 적용 범위와 책임성
• 유럽 데이터 보호 법규 준수
• 유럽 데이터 보호 소개

전체 세부 항목과 하위 주제는 위쪽의 시험 대纲 블록에서 확인하시기 바랍니다.

최신 Certified Information Privacy Professional CIPP-E 무료샘플문제

문제 #1

SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
What would be the MOST APPROPRIATE way for Building Block to handle the situation with the employee from Italy?

A. Since the employee was not informed that the security measures would be used for other purposes such as monitoring, the company could face difficulties in applying any disciplinary measures to this employee.
B. Since the employee was the cause of a serious risk for the server performance and their data, the company would be entitled to apply disciplinary measures to this employee, including fair dismissal.
C. Since this was a serious infringement, but the employee was not appropriately informed about the consequences the new security measures, the company would be entitled to apply some disciplinary measures, but not dismissal.
D. Since the GDPR does not apply to this situation, the company would be entitled to apply any disciplinary measure authorized under Italian labor law.

문제 #2

SCENARIO
Please use the following to answer the next question:
Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn't prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the company's app, like storage and sharing of DNA information with other applications and medical providers. The company's contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers' attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn't include any technology or infrastructure; rather, it's simply a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob's laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canada. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.
If Who-R-U adopts the We-Track-U pilot plan, why is it likely to be subject to the territorial scope of the GDPR?

A. It is engaging in commercial activities conducted in the Union.
B. It is monitoring the behavior of data subjects in the Union.
C. It would be offering goods or services to data subjects in the Union.
D. Its plan would be in the context of the establishment of a controller in the Union.

문제 #3

SCENARIO
Please use the following to answer the next question:
Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B.
Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.
Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:
* Name
* Address
* Date of Birth
* Payroll number
* National Insurance number
* Sick pay entitlement
* Maternity/paternity pay entitlement
* Holiday entitlement
* Pension and benefits contributions
* Trade union contributions
Jenny is the compliance officer at Company A. She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B.
This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues.
As soon as Jenny is made aware of the breach, she notifies all affected employees.
The GDPR requires sufficient guarantees of a company's ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement?

A. Vetting companies' measures with the appropriate supervisory authority.
B. Avoiding the use of another company's data to improve their own services.
C. Requesting advice and technical support from Company A's IT team.
D. Hiring companies whose measures are consistent with recommendations of accrediting bodies.

문제 #4

SCENARIO
Please use the following to answer the next question:
Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn't prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the company's app, like storage and sharing of DNA information with other applications and medical providers. The company's contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers' attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn't include any technology or infrastructure; rather, it's simply a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob's laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canada. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.
Who-R-U is NOT required to notify the local German DPA about the laptop theft because?

A. The data isn't considered personally identifiable financial information.
B. There is no evidence that the thieves have accessed the data on the laptop.
C. The company isn't a controller established in the Union.
D. The laptop belonged to a company located in Canada.

문제 #5

A private company has establishments in France, Poland, the United Kingdom, and most prominently, Germany, where its headquarters is established. The company offers its services worldwide. Most of the services are designed in Germany and supported in the other establishments. However, one of the services, a Software as a Service (SaaS) application, was defined and implemented by the Polish establishment. It is also supported by the other establishments.
What is the lead supervisory authority for the SaaS service?

A. The supervisory authority of Germany at the regional level.
B. The supervisory authority of the Republic of Poland.
C. The supervisory authority of Germany at the federal level.
D. The supervisory authority of the European Union.

질문과 대답: