IAPP Exam CIPM Topic 2 Question 48 Discussion

Actual exam question for IAPP's CIPM exam

Question #: 48
Topic #: 2

[All CIPM Questions]

For an organization that has just experienced a data breach, what might be the least relevant metric for a company's privacy and governance team?

AThe number of security patches applied to company devices.

BThe number of privacy rights requests that have been exercised.

CThe number of Privacy Impact Assessments that have been completed.

DThe number of employees who have completed data awareness training.

Show Suggested Answer

Suggested Answer: C

by Ruthann at Jul 07, 2023, 02:44 AM

Limited Time Offer

25%

Off

Get Premium CIPM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Corrinne

4 months ago

Haha, Option D definitely seems like a red herring. How can 'data awareness training' be the least relevant metric when the whole point is to educate employees and prevent breaches? I'm picking C as the best answer.

upvoted 0 times

Nu

2 months ago

I see your point, it's definitely a tough choice between C and D.

upvoted 0 times

...

Alease

2 months ago

True, but I still think Option C is the least relevant metric for the privacy and governance team.

upvoted 0 times

...

Temeka

2 months ago

I think Option B could also be a distraction, privacy rights requests may not directly relate to preventing breaches.

upvoted 0 times

...

Lilli

2 months ago

I agree, Option D does seem important, but maybe not the least relevant.

upvoted 0 times

...

Louvenia

2 months ago

That's a good point, maybe all the options are important in their own way.

upvoted 0 times

...

Kris

2 months ago

True, but having employees trained on data awareness is crucial for preventing breaches.

upvoted 0 times

...

Judy

3 months ago

I think Option C could be the least relevant because completing assessments doesn't necessarily prevent breaches.

upvoted 0 times

...

Carmen

3 months ago

I agree, Option D does seem important, but maybe not the least relevant.

upvoted 0 times

...

Lilli

4 months ago

But wouldn't knowing how many security patches have been applied help prevent future breaches?

upvoted 0 times

...

Cory

4 months ago

I disagree, I believe the number of employees who have completed data awareness training is the least relevant metric.

upvoted 0 times

...

Rebecka

4 months ago

I'm going with option A as the least relevant. Applying security patches is a basic security hygiene practice, and doesn't really reflect the organization's privacy and governance performance.

upvoted 0 times

Tiffiny

3 months ago

B) I agree, that seems like a routine task rather than a reflection of privacy and governance efforts.

upvoted 0 times

...

Reita

3 months ago

A) The number of security patches applied to company devices.

upvoted 0 times

...

Lilli

4 months ago

I think the least relevant metric would be the number of security patches applied to company devices.

upvoted 0 times

...

Melda

4 months ago

But wouldn't knowing the number of privacy rights requests exercised be more important for the privacy and governance team?

upvoted 0 times

...

Avery

4 months ago

I disagree, I believe the number of employees who have completed data awareness training is the least relevant.

upvoted 0 times

...

Reiko

4 months ago

I disagree with Carlene. The number of privacy rights requests could be a useful metric to assess the effectiveness of the organization's privacy and governance efforts. Option A seems the least relevant to me.

upvoted 0 times

Sharita

3 months ago

I see your point, but I still think focusing on security patches is key after a breach.

upvoted 0 times

...

Rosina

3 months ago

But what about the privacy rights requests? Shouldn't that be a priority too?

upvoted 0 times

...

Georgiana

3 months ago

I agree, keeping devices updated is important for security.

upvoted 0 times

...

Anissa

4 months ago

I think the number of security patches applied is crucial for preventing future breaches.

upvoted 0 times

...

Carlene

4 months ago

I think option B is the least relevant metric. The number of privacy rights requests is more of a reactive measure, while the organization should be focused on proactive measures to prevent future breaches.

upvoted 0 times

...

Melda

4 months ago

I think the least relevant metric would be the number of security patches applied to company devices.

upvoted 0 times

...