Updated CTPRP Exam Questions from CTPRP Dumps (V9.02) – Helping You Prepare for the Certified Third-Party Risk Professional (CTPRP) Certification Exam

1. Which of the following would be a component of an arganization’s Ethics and Code of Conduct Program?

2. Once a vendor questionnaire is received from a vendor what is the MOST important next step when evaluating the responses?

3. Which statement is FALSE regarding the risk factors an organization may include when defining TPRM compliance requirements?

4. Which statement is NOT a method of securing web applications?

5. All of the following processes are components of controls evaluation in the Third Party Risk Assessment process EXCEPT:

6. Your organization has recently acquired a set of new global third party relationships due to M&A. You must define your risk assessment process based on your due diligence standards.

Which risk factor is LEAST important in defining your requirements?

7. Which factor describes the concept of criticality of a service provider relationship when determining vendor classification?

8. Which of the following statements is TRUE regarding the accountabilities in a three lines of defense model?

9. When conducting an assessment of a third party's physical security controls, which of the following represents the innermost layer in a ‘Defense in Depth’ model?

10. Which factor in patch management is MOST important when conducting postcybersecurity incident analysis related to systems and applications?

11. Which cloud deployment model is primarily focused on the application layer?

12. When defining due diligence requirements for the set of vendors that host web applications which of the following is typically NOT part of evaluating the vendor's patch management controls?

13. You are reviewing assessment results of workstation and endpoint security.

Which result should trigger more investigation due to greater risk potential?

14. Which of the following changes to the production environment is typically NOT subject to the change control process?

15. Which of the following factors is LEAST likely to trigger notification obligations in incident response?

16. Which of the following actions is an early step when triggering an Information Security Incident Response Program?

17. When evaluating compliance artifacts for change management, a robust process should include the following attributes:

18. Which of the following topics is LEAST important when evaluating a service provider's Security and Privacy Awareness Program?

19. Which capability is LEAST likely to be included in the annual testing activities for Business Continuity or Disaster Recovery plans?

20. Upon completion of a third party assessment, a meeting should be scheduled with which of the following resources prior to sharing findings with the vendor/service provider to approve remediation plans:

21. At which level of reporting are changes in TPRM program metrics rare and exceptional?

22. Which of the following BEST describes the distinction between a regulation and a standard?

23. Which type of contract termination is MOST likely to occur after failure to remediate assessment findings?

24. Your company has been alerted that an IT vendor began utilizing a subcontractor located in a country restricted by company policy.

What is the BEST approach to handle this situation?

25. Which factor is the LEAST important attribute when classifying personal data?

26. Which of the following statements BEST represent the relationship between incident response and incident notification plans?

27. The BEST way to manage Fourth-Nth Party risk is:

28. When updating TPRM vendor classification requirements with a focus on availability, which risk rating factors provide the greatest impact to the analysis?

29. Which statement is FALSE regarding problem or issue management?

30. Which statement is FALSE when describing the third party risk assessors’ role when conducting a controls evaluation using an industry framework?

31. Which of the following is NOT a key component of TPRM requirements in the software development life cycle (SDLC)?

32. Which of the following data types would be classified as low risk data?

33. For services with system-to-system access, which change management requirement MOST effectively reduces the risk of business disruption to the outsourcer?

34. Which statement provides the BEST description of inherent risk?

35. Which statement is TRUE regarding a vendor's approach to Environmental, Social, and Governance (ESG) programs?

36. A set of principles for software development that address the top application security risks and industry web requirements is known as:

37. Which of the following components is NOT typically included in external continuous monitoring solutions?

38. Which statement is FALSE regarding analyzing results from a vendor risk assessment?

39. An organization has experienced an unrecoverable data loss event after restoring a system.

This is an example of:

40. Which of the following is LEAST likely to be included in an organization's mobile device policy?

41. Which of the following is a positive aspect of adhering to a secure SDLC?

42. Which statement BEST represents the primary objective of a third party risk assessment:

43. Which statement is FALSE regarding the different types of contracts and agreements between outsourcers and service providers?

44. Which of the following is typically NOT included within the scape of an organization's network access policy?

45. Which statement is FALSE regarding background check requirements for vendors or service providers?

46. The BEST time in the SDLC process for an application service provider to perform Threat Modeling analysis is:

47. Which of the following components are typically NOT part of a cloud hosting vendor assessment program?

48. An IT change management approval process includes all of the following components EXCEPT:

49. Which of the following statements is FALSE about Data Loss Prevention Programs?

50. You are updating program requirements due to shift in use of technologies by vendors to enable hybrid work.

Which statement is LEAST likely to represent components of an Asset Management Program?