IAPP CIPP/C Exam - Topic 2 Question 42 Discussion

Actual exam question for IAPP's CIPP/C exam

Question #: 42
Topic #: 2

Which of the following incidents will require reporting to OPC?

AA sales report with aggregated information that was sent to the wrong person internally.

BA file with client ID, sales amount and sales date that was sent to the wrong processors who cannot identify the clients.

CAn organization's point-of-sale system that was subject to an attempted hack that was blocked by the organization's firewall.

DAs part of a freedom of information request, a nursing home that released an e-mail with everybody's e-mail address in the 'to' section unredacted.

Show Suggested Answer

Suggested Answer: A

by Denae at Jun 19, 2024, 05:53 AM

Limited Time Offer

25%

Off

Get Premium CIPP/C Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Teresita

4 months ago

A is just an internal mix-up, not reportable.

upvoted 0 times

...

Ellen

4 months ago

Totally agree with B, that one is serious!

upvoted 0 times

...

Quinn

4 months ago

Wait, are we sure C needs reporting? It was blocked, right?

upvoted 0 times

...

Dorothy

4 months ago

I think D is also a big deal, that's a privacy breach.

upvoted 0 times

...

Elza

4 months ago

Definitely B, that's sensitive info!

upvoted 0 times

...

Reena

5 months ago

I think option A is probably not reportable since it was just an internal mistake with aggregated data, but I could be wrong.

upvoted 0 times

...

Luisa

5 months ago

I'm a bit confused about option C. It was an attempted hack that was blocked, so does that still need to be reported?

upvoted 0 times

...

Louisa

5 months ago

I remember a practice question about data breaches, and I feel like option D could be a serious issue since it exposes personal information.

upvoted 0 times

...

Glendora

5 months ago

I think option B might require reporting since it involves client information being sent to the wrong people, but I'm not entirely sure.

upvoted 0 times

...

I'm a bit confused on this one. I know that any breach of personal information needs to be reported to OPC, but I'm not sure if all the options here would qualify. I think I'll need to re-read the question and the options carefully before deciding.

upvoted 0 times

...

Taryn

5 months ago

Okay, let me think this through. I'm pretty sure that option A, the sales report sent to the wrong person internally, doesn't require reporting to OPC since it's just internal. And C, the attempted hack that was blocked, also doesn't seem to require reporting. So I'm leaning towards B or D, but I'll have to double-check the details.

upvoted 0 times

...

Val

5 months ago

Hmm, I'm not sure about this one. I think it might be D - the nursing home that released an email with everyone's email address unredacted. But I'm not 100% certain.

upvoted 0 times

...

Evangelina

5 months ago

This one seems pretty straightforward. I'm pretty confident that the answer is B - a file with client ID, sales amount and sales date that was sent to the wrong processors.

upvoted 0 times

...

Rose

6 months ago

I've got this! I know the XML rules pretty well, so I'm confident I can identify the options that are not well-formed.

upvoted 0 times

...

Kenneth

6 months ago

Ugh, I'm a bit unsure about this one. I know the golden image needs to be updated for security reasons, but I'm not sure about the other criteria. I'll have to think it through step-by-step.

upvoted 0 times

...

Sharan

2 years ago

Haha, the attempted hack that got blocked? That's just a day in the life for most organizations these days. I doubt the OPC would care about that one.

upvoted 0 times

...

Yuki

2 years ago

Hmm, I'm not so sure. Sending a file with client information to the wrong processors seems pretty bad too. That could lead to a data breach if they can't identify the clients.

upvoted 0 times

Almeta

2 years ago

C) An organization's point-of-sale system that was subject to an attempted hack that was blocked by the organization's firewall.

upvoted 0 times

...

Salena

2 years ago

B) That's true, sending client information to the wrong processors is a serious issue.

upvoted 0 times

...

Ellen

2 years ago

B) A file with client ID, sales amount and sales date that was sent to the wrong processors who cannot identify the clients.

upvoted 0 times

...

Adell

2 years ago

A) A sales report with aggregated information that was sent to the wrong person internally.

upvoted 0 times

...

Willow

2 years ago

That's true, both B and D could potentially harm individuals if misused.

upvoted 0 times

...

Andra

2 years ago

But what about option D? Releasing everyone's email address seems like a breach too.

upvoted 0 times

...

Fatima

2 years ago

I agree, D is the only one that involves a clear privacy violation. The other incidents don't seem to have the same level of risk or impact.

upvoted 0 times

Agustin

2 years ago

B) A file with client ID, sales amount and sales date that was sent to the wrong processors who cannot identify the clients.

upvoted 0 times

...

Gabriele

2 years ago

A) A sales report with aggregated information that was sent to the wrong person internally.

upvoted 0 times

...

Avery

2 years ago

I agree with Willow, client ID and sales information is sensitive.

upvoted 0 times

...

Berry

2 years ago

Option D is clearly the correct answer here. Releasing personal information like email addresses without consent is a serious breach that needs to be reported to the OPC.

upvoted 0 times