IAPP CIPP/US Exam Practice Questions, practice question pack
IAPP · CIPP/US

IAPP CIPP/US Exam Practice Questions

272 questionsPDF by emailUpdated September 2026

US$39

Try 10 questions free

Card, Apple Pay or Google Pay. Your PDF is sent by email as soon as you check out.

Pass or your money backFail the exam after using this pack and we refund it. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 272 questions in this pack

Question 1

Which jurisdiction must courts have in order to hear a particular case?

  1. Subject matter jurisdiction and regulatory jurisdiction
  2. Subject matter jurisdiction and professional jurisdiction
  3. Personal jurisdiction and subject matter jurisdiction
  4. Personal jurisdiction and professional jurisdiction
Show answer and explanation

Correct answer: C. Personal jurisdiction and subject matter jurisdiction

Courts must have both personal jurisdiction (authority over the defendant or property) and subject matter jurisdiction (authority over the type of case) to hear a case. Personal jurisdiction ensures the court can exercise power over the parties involved, while subject matter jurisdiction ensures the court has the legal authority to decide cases of that particular type.

Why the other options are wrong

  • A. Regulatory jurisdiction is not a foundational requirement for courts to hear cases; only personal and subject matter jurisdiction are required.
  • B. Professional jurisdiction is not a recognized legal requirement for courts to hear cases.
  • D. Professional jurisdiction is not a standard legal requirement for court authority.

Question 2

Which authority supervises and enforces laws regarding advertising to children via the Internet?

  1. The Office for Civil Rights
  2. The Federal Trade Commission
  3. The Federal Communications Commission
  4. The Department of Homeland Security
Show answer and explanation

Correct answer: B. The Federal Trade Commission

The Federal Trade Commission (FTC) is the primary federal authority responsible for supervising and enforcing laws regarding advertising to children, including Internet advertising. This authority is exercised through enforcement of the Children's Online Privacy Protection Act (COPPA) and the FTC Act.

Why the other options are wrong

  • A. The Office for Civil Rights focuses on civil rights enforcement, not advertising regulation.
  • C. The Federal Communications Commission regulates broadcast and telecommunications, not primarily Internet advertising practices.
  • D. The Department of Homeland Security focuses on national security and border protection, not consumer advertising enforcement.

Question 3

According to Section 5 of the FTC Act, self-regulation primarily involves a company’s right to do what?

  1. Determine which bodies will be involved in adjudication
  2. Decide if any enforcement actions are justified
  3. Adhere to its industry’s code of conduct
  4. Appeal decisions made against it
Show answer and explanation

Correct answer: C. Adhere to its industry’s code of conduct

Section 5 of the FTC Act recognizes self-regulation as a company's ability and responsibility to adhere to its industry's code of conduct. Self-regulation allows companies to establish and follow standards developed by their industry rather than relying solely on government enforcement, provided these standards are enforceable and protect consumers.

Why the other options are wrong

  • A. Determining which bodies conduct adjudication is not the primary focus of self- regulation under Section 5.
  • B. Companies do not have the right to decide unilaterally whether enforcement actions are justified; this remains an FTC responsibility.
  • D. The ability to appeal decisions is a procedural right, not the primary purpose of self- regulation under Section 5.

See all 10 free questions Get the full pack, US$39

272 practice questions for IAPP Certified Information Privacy Professional/United States (CIPP/US), with full explanations.

Every question comes with the correct answer, the reasoning behind it, and a short note on why each wrong option is wrong. Work through it once with the answers, then again with the questions-only copy under exam conditions.

  • 272 questions mapped to the CIPP/US Body of Knowledge and exam blueprint
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A CIPP/US attempt costs US$550 (US$375 for a retake). This pack is US$39, paid once.

Try 10 questions free before you buy.

Last updated September 2026 · 272 questions

What makes the CIPP/US hard

The Body of Knowledge that took effect on 1 September 2026 made the biggest single change in the exam’s history: state comprehensive privacy laws jumped from around six to eight questions to between thirteen and seventeen, close to a fifth of the paper. Material built on the older Body of Knowledge underweights the topic that now decides the exam.

The format is 90 questions in 150 minutes with an optional 15 minute break, 75 scored and 15 unscored pilot items that cannot be identified, and a pass mark of 300 on IAPP’s 100 to 500 scale. The largest legal block is limits on private sector collection and use of data: HIPAA and HITECH, GLBA, FCRA and FACTA, COPPA, CAN-SPAM, TCPA, the FTC Act, breach notification and data security obligations. State privacy laws cover the comprehensive statutes led by the CCPA and CPRA, the Virginia, Colorado, Connecticut and Utah models and their successors, data broker and biometric laws, and how state and federal law interact.

Most questions are scenario based and ask which law applies or what a company must do, so knowing which statute governs which data type matters more than reciting section numbers.

About the exam

CIPP/US is IAPP’s US privacy law certification. It covers the US privacy environment, limits on private sector collection and use of data, government and court access to private sector information, workplace privacy, and state privacy laws. There are no prerequisites. The Body of Knowledge took effect 1 September 2026.

Exam domains

  • Introduction to the US Privacy Environment
  • Limits on Private-sector Collection and Use of Data
  • Government and Court Access to Private-sector Information
  • Workplace Privacy
  • State Privacy Laws

IAPP publishes a question range per domain rather than percentages; State Privacy Laws is now 13 to 17 questions.

90 multiple-choice questions (75 scored), 150 minutes plus an optional 15-minute break, pass mark 300 on a 100 to 500 scale, US$550 per attempt (US$375 for a retake), Pearson VUE test centre or OnVUE online, maintained with 20 CPE credits per two-year term.

Reviews

There are no reviews yet.

Only logged in customers who have purchased this product may leave a review.

Questions before you buy

What do I get when I buy the IAPP CIPP/US pack?

272 practice questions as a PDF, each with the correct answer, a full explanation and a note on why the other options are wrong, plus a separate questions-only PDF for timed practice.

How quickly do I receive it?

Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.

Is there a free sample?

Yes. Ten questions from this pack, with answers and explanations, are free on this page and as a PDF, so you can judge the quality before you pay.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products