Exam CIPM All QuestionsBrowse all questions from this exam
Go to Exam
Question 82

SCENARIO -

Please use the following to answer the next question:

Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts.

Penny’s colleague in Marketing is excited by the new sales and the company’s plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her “I heard someone in the breakroom talking about some new privacy laws but I really don’t think it affects us. We’re just a small company. I mean we just sell accessories online, so what’s the real risk?” He has also told her that he works with a number of small companies that help him get projects completed in a hurry. “We’ve got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don’t have.”

In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny’s colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team “didn’t know what to do or who should do what. We hadn’t been trained on it but we’re a small team though, so it worked out OK in the end.” Penny is concerned that these issues will compromise Ace Space’s privacy and data protection.

Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data “shake up”. Her mission is to cultivate a strong privacy culture within the company.

Penny has a meeting with Ace Space’s CEO today and has been asked to give her first impressions and an overview of her next steps.

To help Penny and her CEO with their objectives, what would be the most helpful approach to address her IT concerns?

    Correct Answer: B

    Given the scenario, the main issue identified by Penny in the IT team is the lack of preparedness and clear protocols during security incidents, such as the phishing attack and the loss of the USB key. Undertaking a tabletop exercise allows the team to simulate a realistic scenario, which helps identify response gaps, provides necessary training, and builds confidence in handling real-world incidents. This approach directly addresses the IT team's unpreparedness and clarifies roles and responsibilities, making it the most helpful step to improve their security posture.

Discussion
[Removed]Option: B

Should be B

c4c7b78Option: C

A is the least likely to have an effect. A tabletop exercise will only be effective if there are proper procedures defined (“we don’t know what to do or who should do what”). As a manager I would lean toward D but the most likely correct answer is C.

MaritzTeeOption: B

This approach will help the IT team simulate a real-world scenario, such as a data breach or phishing attack, and practice their response in a controlled environment. It will highlight gaps in their knowledge, response procedures, and coordination, enabling them to improve their readiness for actual incidents. Given the previous issues with phishing attacks and the loss of encrypted USB keys, this practical exercise will be invaluable in ensuring the IT team knows what to do and who should do what in case of future incidents. While the other options are beneficial, they do not directly address the immediate need for the IT team to be prepared for and effectively respond to security incidents, which is a critical concern identified by Penny.

DPRamoneOption: C

Everything starts with an up-to-date asset inventory and classification. You can't protect what you don't know you have.

SsouravOption: B

given the information provided in the scenario, undertaking a tabletop exercise would be the most effective approach for several reasons: Identifying Response Gaps: A tabletop exercise allows a company to walk through a hypothetical, but realistic, situation to determine how they would respond. This can help highlight any gaps in the response process. Training: Since Penny's IT colleague mentioned they "didn’t know what to do or who should do what" during a previous phishing attack, a tabletop exercise would serve as an effective training tool, giving the team clarity on roles, responsibilities, and actions to take during an incident. Building Confidence: By running through these simulations, the IT team can become more confident in their abilities to handle real-world situations when they arise. While the other options are valid in their own contexts, given the specific concerns Penny has learned about Ace Space's IT practices, the tabletop exercise directly addresses the identified issues and provides the most immediate benefits.

emily0922Option: B

I suggest B