CGRC Third-Party Risk 4

Question 1

Which document should be established with a cloud service provider to define how the organization's data is protected, processed, and retained?

Accepted Answer

Data Processing Agreement (DPA)

Answer

A DPA contractually defines how the cloud provider processes, stores, and protects personal data on behalf of the organization.

Question 2

Which risk treatment option is most appropriate when a critical vendor cannot remediate a significant control gap but no alternative vendor exists?

Accepted Answer

Risk acceptance with enhanced monitoring and compensating controls

Answer

When avoidance is not feasible, accepting the risk while implementing compensating controls and heightened monitoring is the pragmatic treatment option.

Question 3

What is the purpose of a vendor inventory or vendor registry in a TPRM program?

Accepted Answer

To maintain a centralized record of all vendors, their risk tiers, and contract statuses

Answer

A vendor registry provides a single authoritative source of truth for all third-party relationships, risk classifications, and contractual details.

Question 4

An organization outsources its payroll processing. Which risk category is MOST relevant if the payroll vendor suffers a ransomware attack?

Accepted Answer

Operational risk

Answer

A ransomware attack disrupting payroll processing represents operational risk, as it impairs a critical business function delivered by a third party.

Question 5

Which element distinguishes a SOC 2 Type II report from a SOC 2 Type I report?

Accepted Answer

Type II evaluates control effectiveness over a period of time, while Type I is point-in-time

Answer

A SOC 2 Type II report tests whether controls operated effectively over a specified review period (typically 6–12 months), whereas Type I only assesses whether controls are suitably designed at a single point in time.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Third-Party Risk 4