Certified Third-Party Risk Professional CTPRP Dumps (V8.02) Are Efficient Study Materials for Passing

1. An organization has experienced an unrecoverable data loss event after restoring a system. This is an example of:

2. Which statement is FALSE regarding the methods of measuring third party risk?

3. When measuring the operational performance of implementing a TPRM program, which example is MOST likely to provide meaningful metrics?

4. Which cloud deployment model is primarily focused on the application layer?

5. Which of the following is LEAST likely to be included in an organization's mobile device policy?

6. Which statement is TRUE regarding artifacts reviewed when assessing the Cardholder Data Environment (CDE) in payment card processing?

7. If a system requires ALL of the following for accessing its data: (1) a password, (2) a security token, and (3) a user's fingerprint, the system employs:

8. The set of shared values and beliefs that govern a company’s attitude toward risk is known as:

9. Which statement is TRUE regarding defining vendor classification or risk tiering in a TPRM program?

10. Which example BEST represents the set of restrictive areas that require an additional authentication factor for access control?

11. 1.When defining due diligence requirements for the set of vendors that host web applications which of the following is typically NOT part of evaluating the vendor's patch management controls?

12. At which level of reporting are changes in TPRM program metrics rare and exceptional?

13. You are assessing your organization's Disaster Recovery and Business Continuity (BR/BCP) requirements based on the shift to remote work.

Which statement is LEAST reflective of current practices in business resiliency?

14. Which of the following actions is an early step when triggering an Information Security Incident Response Program?

15. Which statement does NOT reflect current practice in addressing fourth party risk or subcontracting risk?

16. The BEST way to manage Fourth-Nth Party risk is:

17. Which of the following statements is TRUE regarding the accountabilities in a three lines of defense model?

18. Select the risk type that is defined as: “A third party may not be able to meet its obligations due to inadequate systems or processes”.

19. Which of the following BEST reflects components of an environmental controls testing program?

20. When evaluating compliance artifacts for change management, a robust process should include the following attributes:

21. Which of the following BEST describes the distinction between a regulation and a standard?

22. Which cloud deployment model is focused on the management of hardware equipment?

23. Which statement BEST describes the use of risk based decisioning in prioritizing gaps identified at a critical vendor when defining the corrective action plan?

24. Which statement provides the BEST example of the purpose of scoping in third party assessments?

25. Which of the following data safeguarding techniques provides the STRONGEST assurance that data does not identify an individual?

26. Which statement is FALSE regarding the risk factors an organization may include when defining TPRM compliance requirements?

27. Which statement is TRUE regarding the use of questionnaires in third party risk assessments?

28. All of the following processes are components of controls evaluation in the Third Party Risk Assessment process EXCEPT:

29. Which statement is TRUE regarding the tools used in TPRM risk analyses?

30. The primary disadvantage of Single Sign-On (SSO) access control is:

31. A contract clause that enables each party to share the amount of information security risk is known as:

32. Which of the following statements is FALSE about Data Loss Prevention Programs?

33. The following statements reflect user obligations defined in end-user device policies EXCEPT:

34. Which policy requirement is typically NOT defined in an Asset Management program?

35. Which of the following is NOT a key component of TPRM requirements in the software development life cycle (SDLC)?