CIPM practice question 2 of 30

SCENARIO Please use the following to answer the next QUESTIO N: Richard McAdams recently graduated law school and decided to return to the small town…

Full set: 242 questions

Domain Privacy Program Operational Life Cycle

SCENARIO Please use the following to answer the next QUESTIO N: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal dat a. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/ printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. Richard believes that a transition from the use of fax machine to Internet faxing provides all of the following security benefits EXCEPT?
Answer options
A: Greater accessibility to the faxes at an off-site location. Correct answer
B: The ability to encrypt the transmitted faxes through a secure server.
C: Reduction of the risk of data being seen or copied by unauthorized personnel.
D: The ability to store faxes electronically, either on the user's PC or a password-protected network server.
Correct Answer:
A. Greater accessibility to the faxes at an off-site location.
Explanation

The question asks to identify the option that is NOT a security benefit of transitioning to internet faxing. While greater accessibility from an off-site location is a benefit of internet faxing, it is primarily an operational or convenience benefit, not a security one. In fact, increased accessibility can introduce new security risks if not managed with strong access controls. The other options—encryption, reduction of unauthorized physical access, and secure electronic storage with password protection—are all direct security enhancements that protect the confidentiality and integrity of the personal data contained in the faxes.

Why Incorrect

B: The ability to encrypt faxes during transmission is a core security benefit, protecting data from interception, which is not a feature of traditional analog faxing. C: Internet faxing delivers documents to a specific user's secure inbox, eliminating the risk of papers being left on a communal machine for anyone to see or take. D: Storing faxes on a password-protected server allows for robust access controls, audit trails, and secure lifecycle management, which are significant security upgrades from physical file cabinets.

References

1. IAPP

Privacy Program Management: Tools for Managing Privacy Within Your Organization

3rd ed.

2019

by Russell Densmore

CIPP/US

CIPT

FIP.

Chapter 5: Privacy and Security. This chapter discusses the implementation of technical controls to protect personal information. It emphasizes that controls like encryption (related to option B)

access control (related to options C and D)

and secure storage are fundamental to data security. The text distinguishes between security controls and operational features

implicitly supporting that remote accessibility (option A) is an operational feature whose security depends on the implementation of other controls.

2. National Institute of Standards and Technology (NIST)

Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations

2020.

AC (Access Control) Family: This control family details the necessity of limiting information system access to authorized users. This directly relates to options C and D

where internet faxing enables better electronic access control than a communal physical machine.

SC (System and Communications Protection) Family

specifically SC-8 (Transmission Confidentiality and Integrity) and SC-13 (Cryptographic Protection): These controls advocate for protecting information during transmission

which aligns with the encryption benefit described in option B. The standard does not list "greater accessibility" as a security control; rather

it is a factor that security controls must manage.

3. Al-Haj

A.

& Al-Roubaiey

A. A. (2011). Security of Internet Faxing. International Journal of Network Security & Its Applications

3(1)

115–126. https://doi.org/10.5121/ijnsa.2011.3110

Section 3

"Security in Internet Faxing": This academic paper explicitly outlines the security advantages of Internet faxing over traditional PSTN-based faxing. It highlights encryption (TLS/SSL)

authentication

and secure storage as key security benefits. It discusses accessibility as a functional advantage but frames the security challenge as one of ensuring that this increased access is properly controlled and authenticated

confirming that accessibility itself is not the security benefit.

Keep practicing

Take the free CIPM practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other CIPM practice questions

Scroll to Top