IAPP CIPM Exam - Topic 10 Question 76 Discussion

Actual exam question for IAPP's CIPM exam

Question #: 76
Topic #: 10

[All CIPM Questions]

Which of the following controls does the PCI DSS framework NOT require?

AImplement strong asset control protocols.

BImplement strong access control measures.

CMaintain an information security policy.

DMaintain a vulnerability management program.

Show Suggested Answer

Suggested Answer: A

The optimum first step to take when creating a Privacy Officer governance model is to involve senior leadership. Senior leadership plays a crucial role in establishing and supporting a privacy program within an organization. They can provide strategic direction, allocate resources, approve policies, endorse initiatives, communicate values, and demonstrate accountability. By involving senior leadership from the beginning, a Privacy Officer can ensure that the privacy program aligns with the organization's vision, mission, goals, and culture. Senior leadership can also help overcome potential barriers or resistance from other stakeholders by endorsing and promoting the privacy program.

CIPM Body of Knowledge (2021), Domain I: Privacy Program Governance, Section A: Privacy Governance Models, Subsection 1: Privacy Officer Governance Model

CIPM Study Guide (2021), Chapter 2: Privacy Governance Models, Section 2.1: Privacy Officer Governance Model

CIPM Textbook (2019), Chapter 2: Privacy Governance Models, Section 2.1: Privacy Officer Governance Model

CIPM Practice Exam (2021), Question 139

by James at Nov 14, 2024, 12:36 PM

Limited Time Offer

25%

Off

Get Premium CIPM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sena

3 months ago

Huh, I didn't know they didn't require strong asset control.

upvoted 0 times

...

Jutta

4 months ago

Definitely not A, that one is crucial!

upvoted 0 times

...

Hana

4 months ago

Wait, I thought they required all of these?

upvoted 0 times

...

Willard

4 months ago

I disagree, all of these are important!

upvoted 0 times

...

Devorah

4 months ago

Pretty sure D is the right answer.

upvoted 0 times

...

Tayna

5 months ago

I feel like the vulnerability management program is a must-have, but I can't recall if asset control is specifically mentioned in the PCI DSS.

upvoted 0 times

...

Danilo

5 months ago

I'm a bit confused; I thought all of these were important, but maybe the asset control protocols aren't explicitly required?

upvoted 0 times

...

Weldon

5 months ago

I remember practicing a question similar to this, and I feel like maintaining an information security policy is definitely required.

upvoted 0 times

...

Laticia

5 months ago

I think the PCI DSS requires strong access control measures, but I'm not sure about the asset control protocols.

upvoted 0 times

...

Virgilio

5 months ago

I've got a good feeling about this one. I'll start by eliminating the options that are clearly required by PCI DSS, then focus on the remaining choice.

upvoted 0 times

...

Launa

5 months ago

Okay, let me think this through step-by-step. The PCI DSS framework focuses on securing payment card data, so the key is to identify the control that is not directly related to that.

upvoted 0 times

...

Hollis

5 months ago

Hmm, I'm not entirely sure about this one. I'll need to review the PCI DSS requirements carefully to determine which control is not required.

upvoted 0 times

...

Shaun

5 months ago

This question seems straightforward, I'm pretty confident I know the answer based on my understanding of the PCI DSS framework.

upvoted 0 times

...

Michael

10 months ago

Wait, does this mean I can't have a pet pirate on my PCI-compliant network? Dang, there goes my weekend plans.

upvoted 0 times

...

Nan

10 months ago

Asset control? What is this, a pirate ship? The PCI DSS guys must be getting creative with their questions.

upvoted 0 times

Gayla

9 months ago

C) Maintain an information security policy.

upvoted 0 times

...

Tiera

9 months ago

B) Implement strong access control measures.

upvoted 0 times

...

Terrilyn

9 months ago

A) Implement strong asset control protocols.

upvoted 0 times

...

Yen

10 months ago

B and D sound like no-brainers, but A is throwing me off. I'll have to double-check the PCI DSS requirements on this one.

upvoted 0 times

Graham

9 months ago

C) Maintain an information security policy.

upvoted 0 times

...

Shayne

10 months ago

B) Implement strong access control measures.

upvoted 0 times

...

Jeannetta

10 months ago

A) Implement strong asset control protocols.

upvoted 0 times

...

Jesus

11 months ago

I see your point, but I still think it's A) Implement strong asset control protocols because it's not explicitly mentioned in the PCI DSS framework.

upvoted 0 times

...

Lashanda

11 months ago

I was sure it was C. A security policy is like the backbone of PCI DSS, how could that not be required?

upvoted 0 times

Goldie

10 months ago

D) Maintain a vulnerability management program.

upvoted 0 times

...

Laurel

10 months ago

B) Implement strong access control measures.

upvoted 0 times

...

Maile

10 months ago

A) Implement strong asset control protocols.

upvoted 0 times

...

Bok

11 months ago

I disagree, I believe the answer is C) Maintain an information security policy.

upvoted 0 times

...

Carma

11 months ago

Hmm, this one's tricky. PCI DSS covers a lot of ground, but I think the answer might be A. Asset control isn't specifically mentioned in the standard.

upvoted 0 times