CTPRP (Certified Third-Party Risk Professional) Exam — Questions and Answers

Question 1: Which element of a vendor contract specifically addresses the legal responsibilities and obligations each party assumes if a third party suffers harm due to the vendor's actions?

Non-solicitation clause
Governing law clause
Indemnification clause (Correct answer)
Confidentiality provisions

Correct answer: Indemnification clause

An indemnification clause defines which party bears the financial responsibility for losses, claims, or damages caused by their actions or negligence, including third-party claims.

Question 2: How often must CPTRP certification be renewed?

Every three years (Correct answer)
Annually
Every five years
Every two years

Correct answer: Every three years

To ensure that CTPRP-certified professionals remain current with evolving industry standards, best practices, and regulatory changes, the certification requires renewal periodically. A three-year renewal cycle is a common standard for professional certifications, balancing the need for ongoing competence with a reasonable timeframe for accumulating continuing education.

Question 3: What is 'contract risk concentration' in third-party risk management?

Having multiple contracts with the same legal counsel
Over-reliance on a single vendor for a critical service, increasing exposure if that vendor fails (Correct answer)
Concentrating all contract negotiations in one quarter
Requiring all vendors to carry the same insurance policy

Correct answer: Over-reliance on a single vendor for a critical service, increasing exposure if that vendor fails

Contract risk concentration occurs when an organization relies heavily on one vendor for a critical service, creating a single point of failure that can be catastrophic if the vendor experiences an outage or failure.

Question 4: Which regulatory framework specifically requires financial institutions to maintain a comprehensive inventory of critical third-party service providers?

FFIEC IT Examination Handbook on Third-Party Risk (Correct answer)
Sarbanes-Oxley Act (SOX) Section 404
Payment Card Industry Data Security Standard (PCI DSS)
Health Insurance Portability and Accountability Act (HIPAA)

Correct answer: FFIEC IT Examination Handbook on Third-Party Risk

The FFIEC IT Examination Handbook provides guidance requiring financial institutions to maintain inventories of third-party relationships, particularly those involving critical services.

Question 5: What does a risk register typically include in third-party risk management?

Vendor onboarding details
Identified risks and mitigation plans (Correct answer)
Legal contracts with vendors
Operational performance metrics

Correct answer: Identified risks and mitigation plans

A risk register serves as a central repository for documenting all identified risks within a third-party relationship. For each risk, it typically outlines its description, potential impact, likelihood, and crucially, the specific strategies and actions planned to mitigate or address it. This systematic approach helps in tracking and managing the risk landscape effectively.

Question 6: What is the purpose of a 'vendor exit strategy' or 'termination plan' in TPRM?

To document the vendor's offboarding checklist for regulatory audits only
To establish penalties the vendor must pay for early contract termination
To ensure continuity of operations and secure data return or destruction if the vendor relationship ends (Correct answer)
To give vendors advance notice of intent to switch to a competitor

Correct answer: To ensure continuity of operations and secure data return or destruction if the vendor relationship ends

A vendor exit strategy ensures the organization can transition services smoothly, recover its data, and maintain business continuity regardless of why the relationship ends.

Question 7: How many Continuing Professional Education (CPE) credits must a CTPRP holder earn per renewal cycle?

30 CPE credits
10 CPE credits
40 CPE credits
20 CPE credits (Correct answer)

Correct answer: 20 CPE credits

CTPRP holders must earn 20 CPE credits per two-year renewal cycle to maintain their certification.

Question 8: Which US federal law requires covered entities and their business associates to safeguard protected health information (PHI) shared with vendors?

GLBA
FCRA
SOX
HIPAA (Correct answer)

Correct answer: HIPAA

HIPAA requires covered entities to enter into Business Associate Agreements (BAAs) with vendors that access or process PHI, establishing mutual data protection obligations.

Question 9: How can CPTRP certification enhance a professional's career?

Enhances credibility and career opportunities. (Correct answer)
Provides negotiation skills for contracts.
Improves financial budgeting for vendors.
Simplifies vendor marketing strategies.

Correct answer: Enhances credibility and career opportunities.

Earning CTPRP certification validates a professional's expertise in a specialized and critical field. This recognized credential significantly boosts their credibility within the industry, demonstrating a commitment to best practices and a high level of skill. Consequently, it opens doors to advanced roles, promotions, and broader career opportunities in third-party risk management.

Question 10: When should an organization's own Business Impact Analysis (BIA) inform its third-party risk program?

Only when a vendor has already experienced a disruption
Only for vendors located in geographic regions prone to natural disasters
To identify which vendor services are critical and require stronger BCP/DR scrutiny (Correct answer)
To set vendor pricing negotiations based on service criticality

Correct answer: To identify which vendor services are critical and require stronger BCP/DR scrutiny

An internal BIA identifies which business processes are most critical and time-sensitive. Those findings directly inform third-party risk management by flagging which vendor services support critical processes — and therefore which vendor BCP/DR capabilities deserve the most rigorous scrutiny and the tightest RTO/RPO requirements.

Question 11: How does CPTRP certification impact vendor relationships?

Limits the number of vendor contracts.
Reduces financial investments in vendors.
Increases vendor recruitment speed.
Facilitates better communication and trust. (Correct answer)

Correct answer: Facilitates better communication and trust.

CTPRP-certified professionals understand the importance of clear communication, due diligence, and transparent risk management practices with vendors. This expertise allows them to establish structured engagement models, articulate expectations clearly, and build a foundation of trust. Stronger relationships lead to more collaborative risk mitigation and overall better outcomes.

Question 12: What is the primary risk management objective of requiring vendors to carry cyber liability insurance?

To satisfy ISO 27001 certification requirements
To transfer a portion of financial risk from a vendor-caused breach to the vendor's insurer (Correct answer)
To guarantee the vendor will never have a data breach
To reduce the need for any contractual data protection clauses

Correct answer: To transfer a portion of financial risk from a vendor-caused breach to the vendor's insurer

Requiring cyber liability insurance ensures that if a vendor causes a data breach, there is an insurance mechanism to cover associated financial losses, partially transferring that risk away from your organization.

Question 13: Why is adherence to technical standards important in CTPRP practice?

It ensures consistency, safety, and interoperability across the industry (Correct answer)
It limits innovation and creativity
It is required only for government contracts
It is only important for documentation purposes

Correct answer: It ensures consistency, safety, and interoperability across the industry

Technical standards ensure that work products are consistent, safe, and compatible across different practitioners and organizations.

Question 14: Why is continuous monitoring crucial in third-party risk management?

To identify emerging risks promptly. (Correct answer)
To streamline third-party onboarding processes.
To reduce dependency on third parties.
To comply with financial regulations only.

Correct answer: To identify emerging risks promptly.

Third-party relationships are dynamic, and new risks can arise due to changes in the vendor's operations, market conditions, or regulatory landscape. Continuous monitoring allows organizations to detect these emerging risks in real-time, enabling proactive mitigation strategies. This ongoing vigilance is crucial for maintaining a strong and resilient third-party risk management program.

Question 15: When a vendor is classified as 'critical,' what additional oversight is typically required beyond standard due diligence?

Only an annual questionnaire review
Enhanced monitoring, executive engagement, and contingency planning (Correct answer)
A credit check and insurance verification
Monthly marketing meetings

Correct answer: Enhanced monitoring, executive engagement, and contingency planning

Critical vendors receive heightened oversight including more frequent assessments, senior-level relationship management, and tested contingency or exit plans due to their impact on business operations.

Question 16: Which of the following best describes a 'most favored nation' (MFN) clause in a vendor contract?

A clause requiring the vendor to prioritize the organization's orders above all others
A clause allowing the organization to exit the contract if a competitor receives better terms
A clause restricting the vendor from serving competitors in other countries
A clause guaranteeing the organization receives pricing no worse than the vendor's best offered price to comparable customers (Correct answer)

Correct answer: A clause guaranteeing the organization receives pricing no worse than the vendor's best offered price to comparable customers

An MFN clause ensures the organization always benefits from the vendor's best pricing offered to similarly situated customers, preventing the organization from being disadvantaged commercially.

Question 17: Which element is MOST critical when conducting vendor due diligence for a cloud service provider handling regulated data?

The vendor's physical office locations
The vendor's SOC 2 Type II report and data residency controls (Correct answer)
The vendor's marketing materials and client testimonials
The number of years the vendor has been in business

Correct answer: The vendor's SOC 2 Type II report and data residency controls

A SOC 2 Type II report provides evidence of operational effectiveness of security controls over time, while data residency controls confirm compliance with data sovereignty regulations.

Question 18: Under GDPR, which role does a vendor typically hold when processing personal data on behalf of a US-based company serving EU residents?

Data Processor (Correct answer)
Data Subject
Data Custodian
Data Controller

Correct answer: Data Processor

Under GDPR, a vendor processing personal data solely under the instructions of a client organization is classified as a Data Processor, with specific obligations under Article 28.

Question 19: When assessing a vendor's information security posture, which document provides the MOST comprehensive view of their control environment?

A single-page attestation letter signed by the vendor's CEO
The vendor's ISO 9001 quality management certificate
The vendor's marketing brochure describing their security features
A completed Standardized Information Gathering (SIG) questionnaire with supporting evidence (Correct answer)

Correct answer: A completed Standardized Information Gathering (SIG) questionnaire with supporting evidence

The SIG (developed by Shared Assessments) is the industry-standard questionnaire for third-party information security assessments. It covers dozens of control domains and is designed to be accompanied by supporting evidence. A marketing brochure is promotional, a CEO attestation lacks depth, and ISO 9001 covers quality management — not information security.

Question 20: Which key performance indicator (KPI) is most relevant to monitoring a vendor's operational risk in an outsourced IT service?

Vendor's annual revenue growth rate
System uptime and availability percentage against contracted SLAs (Correct answer)
Vendor employee satisfaction scores
Number of vendor sales representatives assigned to the account

Correct answer: System uptime and availability percentage against contracted SLAs

System uptime and availability measured against SLA thresholds directly reflects operational risk and ensures the vendor is delivering the contractually agreed service levels.

Question 21: What is a key requirement for third-party risk professionals under CPTRP certification?

Budget management skills
Software development expertise
Sales and negotiation techniques
Risk assessment methodologies (Correct answer)

Correct answer: Risk assessment methodologies

The CTPRP certification focuses on managing risks associated with third-party relationships. Therefore, a core competency for certified professionals is the ability to effectively identify, analyze, and evaluate these risks using established methodologies. This ensures a systematic approach to understanding potential threats and vulnerabilities introduced by third parties.

Question 22: Who is typically responsible for ensuring compliance with technical standards?

Only the quality control department
All professionals involved, from design through implementation (Correct answer)
Only the client or end user
Only senior management

Correct answer: All professionals involved, from design through implementation

Compliance with technical standards is a shared responsibility across all stages of a project.

Question 23: Which principle of information security is most directly threatened when a vendor shares an organization's data with unauthorized subcontractors?

Non-repudiation
Integrity
Confidentiality (Correct answer)
Availability

Correct answer: Confidentiality

Unauthorized disclosure of data to subcontractors violates confidentiality, the principle requiring that information is accessible only to those authorized to access it.

Question 24: What is calibration in the context of technical standards?

Training new employees on procedures
Comparing measurements to a known standard to ensure accuracy (Correct answer)
Balancing project budgets
Adjusting schedules to meet deadlines

Correct answer: Comparing measurements to a known standard to ensure accuracy

Calibration ensures measuring instruments provide accurate readings by comparing them against reference standards.

Question 25: The principle of 'data minimization' in the context of third-party risk management means:

Risk assessments should be limited to no more than ten questions
Vendors should store data in the smallest physical data centers possible
Vendors must compress all files to reduce storage costs
Organizations should share only the minimum amount of personal data with vendors that is necessary to fulfill the service (Correct answer)

Correct answer: Organizations should share only the minimum amount of personal data with vendors that is necessary to fulfill the service

Data minimization is a privacy principle enshrined in GDPR and other regulations requiring that only data strictly necessary for the specified purpose be collected or shared. When applied to third-party relationships, it limits the amount of sensitive data exposed to vendor environments, directly reducing privacy and security risk.

Question 26: Why is understanding theory important for practical application?

Theory is only important for teaching others
It provides the foundation for informed decision-making and creative expression (Correct answer)
It replaces the need for practical experience
Theory is purely academic with no practical value

Correct answer: It provides the foundation for informed decision-making and creative expression

Theoretical understanding enables practitioners to make informed choices, solve problems, and innovate in their field.

Question 27: When assessing a cloud service provider's data segregation practices, which technical control confirms that one client's data cannot be accessed by another?

Shared credential vaulting
Single sign-on (SSO) integration
Unified audit log retention
Multi-tenant logical isolation with virtual private clouds (Correct answer)

Correct answer: Multi-tenant logical isolation with virtual private clouds

Logical isolation using virtual private clouds or similar segmentation ensures tenant data is separated and inaccessible across the shared infrastructure.

Question 28: A vendor stores client data on servers located in a country with weak data privacy laws. What technical control best mitigates this risk?

Contractual data residency clauses only
Periodic on-site audits
Requiring the vendor to purchase cyber insurance
End-to-end encryption with client-managed keys (Correct answer)

Correct answer: End-to-end encryption with client-managed keys

End-to-end encryption with client-managed keys ensures data remains protected even if the host country's legal environment allows government access.

Question 29: Which of the following best describes the purpose of the CTPRP CPE requirement?

To align the CTPRP with unrelated financial services regulations
To generate revenue for the certifying organization
To ensure credential holders stay current with evolving third-party risk practices (Correct answer)
To discourage professionals from maintaining the credential long-term

Correct answer: To ensure credential holders stay current with evolving third-party risk practices

CPE requirements ensure that CTPRP holders continuously update their knowledge as the third-party risk landscape changes.

Question 30: When evaluating a fourth-party (subcontractor of a vendor), the MOST appropriate first step is to:

Conduct a direct on-site audit of the fourth party
Require the fourth party to complete your standard due diligence questionnaire
Exclude fourth parties unless they are explicitly named in the contract
Review the vendor's own third-party risk program and subcontractor inventory (Correct answer)

Correct answer: Review the vendor's own third-party risk program and subcontractor inventory

Reviewing the vendor's own TPRM program and subcontractor inventory establishes concentration risk visibility before deciding if direct engagement is warranted.

Question 31: A CTPRP candidate has extensive compliance experience but no formal vendor management role. What is the most important step before registering for the exam?

Complete a master's degree in risk management
Obtain a co-sponsorship from two CTPRP holders
Pass a prerequisite entry exam first
Review the CTPRP exam blueprint and assess knowledge gaps (Correct answer)

Correct answer: Review the CTPRP exam blueprint and assess knowledge gaps

Reviewing the official exam blueprint helps candidates identify knowledge gaps before committing to the exam.

Question 32: What is a significant outcome of hiring CPTRP-certified professionals?

Improves office management workflows.
Streamlines project timelines.
Increases organizational profit margins.
Reduces third-party risks and enhances compliance. (Correct answer)

Correct answer: Reduces third-party risks and enhances compliance.

CTPRP-certified professionals are specifically trained to identify, assess, and mitigate the diverse risks associated with third-party engagements. Their expertise ensures that organizations can proactively address potential vulnerabilities, comply with regulatory mandates, and protect their assets and reputation. This directly translates to a more secure and compliant operational environment.

Question 33: Under FFIEC guidance, what must banks document as part of ongoing third-party relationship management?

Performance reviews, risk reassessments, and any material changes to the vendor relationship (Correct answer)
The vendor's office lease agreements
The vendor's employee benefits packages
The vendor's quarterly advertising spend

Correct answer: Performance reviews, risk reassessments, and any material changes to the vendor relationship

FFIEC guidance requires banks to document ongoing vendor performance, periodic risk reassessments, and any changes that could affect the risk profile of the third-party relationship.

Question 34: A CTPRP candidate is preparing study materials. Which resource published by Shared Assessments is most directly useful?

ISO 27001 implementation guide
NIST SP 800-53 control catalog
The CTPRP study guide and official exam prep materials (Correct answer)
PCI DSS Self-Assessment Questionnaire

Correct answer: The CTPRP study guide and official exam prep materials

Shared Assessments publishes official CTPRP study guides aligned directly with exam domain content.

Question 35: What is the purpose of maintaining CPTRP certification?

To reduce exam costs for recertification.
To eliminate the need for professional development.
To gain access to online forums.
To remain compliant with industry standards. (Correct answer)

Correct answer: To remain compliant with industry standards.

The field of third-party risk management is constantly evolving with new threats, technologies, and regulatory changes. Maintaining CTPRP certification through renewal ensures that professionals stay current with these advancements and continue to apply the latest best practices. This ongoing commitment helps organizations remain compliant and effectively manage emerging risks.

Question 36: Which risk category is most relevant when evaluating data security with third parties?

Operational risk
Compliance risk
Cybersecurity risk (Correct answer)
Reputational risk

Correct answer: Cybersecurity risk

When evaluating data security with third parties, the primary concern is the protection of sensitive information from unauthorized access, breaches, or cyberattacks. Cybersecurity risk directly addresses these threats, encompassing vulnerabilities in systems, networks, and data handling practices that could compromise data integrity and confidentiality. Other risks, while related, are broader or secondary to the direct threat to data security.

Question 37: What is a key requirement for CPTRP certification renewal?

Publishing research papers
Earning continuing education credits (Correct answer)
Attending vendor management workshops
Completing financial analysis training

Correct answer: Earning continuing education credits

Certification renewal programs are designed to ensure that professionals maintain and update their knowledge and skills. Earning continuing education credits (CECs) through approved activities like workshops, seminars, or relevant coursework demonstrates ongoing professional development. This requirement ensures that CTPRP holders remain competent and current in the dynamic field of third-party risk management.

Question 38: Which key area is evaluated in the CPTRP practical assessment?

Implementing risk mitigation strategies (Correct answer)
Drafting vendor contracts
Developing marketing plans
Designing financial models

Correct answer: Implementing risk mitigation strategies

The CTPRP practical assessment evaluates a candidate's ability to apply theoretical knowledge to real-world scenarios. A key aspect of third-party risk management is not just identifying risks, but also effectively putting in place plans and actions to reduce their impact or likelihood. Therefore, demonstrating the practical implementation of risk mitigation strategies is crucial for this assessment.

Question 39: A financial institution discovers a vendor is subcontracting a critical function to a fourth party without notification. Which regulatory requirement does this MOST likely violate?

Contract provisions requiring prior approval of subcontracting arrangements (Correct answer)
Equal Credit Opportunity Act (ECOA) requirements
Anti-money laundering (AML) provisions
Community Reinvestment Act (CRA) obligations

Correct answer: Contract provisions requiring prior approval of subcontracting arrangements

Most regulatory frameworks require vendors to obtain prior approval before subcontracting critical functions, and contracts should contain provisions explicitly addressing fourth-party arrangements.

Question 40: The CTPRP body of knowledge places significant emphasis on which phase of the third-party risk lifecycle?

Corporate merger and acquisition integration
Continuous monitoring of vendors post-onboarding (Correct answer)
Internal employee performance reviews
Product manufacturing and quality control

Correct answer: Continuous monitoring of vendors post-onboarding

Ongoing monitoring of vendors after onboarding is a critical and heavily emphasized phase in the CTPRP curriculum.

Question 41: How do interdisciplinary connections enhance understanding of fundamentals?

They reveal patterns and principles that transcend individual disciplines (Correct answer)
Interdisciplinary study is only for advanced learners
Each discipline should be studied in complete isolation
Mixing disciplines creates confusion

Correct answer: They reveal patterns and principles that transcend individual disciplines

Cross-disciplinary connections reveal universal principles and enrich understanding through multiple perspectives.

Question 42: When a business unit 'inherits' responsibility for a vendor previously managed by another team, which step is MOST critical from a TPRM perspective?

Verifying the vendor's current risk assessment is up to date and transferring formal risk ownership (Correct answer)
Issuing a press release announcing the new internal ownership structure
Immediately terminating the vendor to start fresh with a new procurement process
Renegotiating the vendor's pricing to reflect the new business unit's budget

Correct answer: Verifying the vendor's current risk assessment is up to date and transferring formal risk ownership

When vendor relationship ownership transfers, the TPRM program must ensure that risk ownership — and accountability for monitoring and remediation — formally transfers as well. The incoming team must confirm the vendor's risk documentation is current and that they understand any open issues. Without this handoff, vendors can fall into monitoring gaps.

Question 43: A TPRM analyst is reviewing a vendor's patch management policy. What is the most critical metric to evaluate?

Vendor's annual revenue growth
Mean time to patch critical vulnerabilities (Correct answer)
Number of software products the vendor sells
Number of employees in the IT department

Correct answer: Mean time to patch critical vulnerabilities

Mean time to patch critical vulnerabilities directly measures the vendor's ability to reduce exposure windows after a CVE is published.

Question 44: Which of the following is a key output of a vendor's penetration test that a third-party risk professional should review?

The vendor's full source code submitted for review
A list of all employees who participated in the test
The total cost billed by the penetration testing firm
An executive summary of vulnerabilities found, their severity ratings, and remediation status (Correct answer)

Correct answer: An executive summary of vulnerabilities found, their severity ratings, and remediation status

The risk-relevant output of a penetration test is the findings report — specifically the vulnerabilities discovered, their CVSS or similar severity ratings, and whether they have been remediated or mitigated. This allows the third-party risk professional to assess whether the vendor has addressed material weaknesses. Employee lists, invoices, and source code are not standard assessment artifacts.

Question 45: What role does critical analysis play in understanding theory?

It is only needed for academic papers
Analysis should be avoided to prevent overthinking
It enables deeper comprehension and the ability to evaluate and apply concepts (Correct answer)
Critical analysis complicates simple ideas unnecessarily

Correct answer: It enables deeper comprehension and the ability to evaluate and apply concepts

Critical analysis develops deeper understanding, enabling practitioners to evaluate, adapt, and apply theoretical concepts effectively.

Question 46: Which body provides the CTPRP certification and sets the professional standards for third-party risk professionals in the US?

ISC2
ISACA
CompTIA
Shared Assessments (Correct answer)

Correct answer: Shared Assessments

Shared Assessments is the organization that administers the CTPRP certification and develops the tools and standards used by third-party risk professionals globally.

Question 47: Which contract clause specifically grants the organization the legal right to inspect a vendor's operational processes, financial records, and security controls?

Limitation of liability clause
Force majeure clause
Right-to-audit clause (Correct answer)
Indemnification clause

Correct answer: Right-to-audit clause

A right-to-audit clause explicitly authorizes the contracting organization to examine vendor operations, finances, and controls to verify compliance.

Question 48: A vendor contract includes a limitation of liability clause capping damages at one year's contract fees. During an incident, actual damages total five times the annual fee. What is the MOST significant implication for the organization?

The vendor must provide additional insurance to cover the gap
The limitation of liability clause is automatically unenforceable in cases of gross negligence
The organization can sue for the full amount regardless of the contract cap
The organization can only recover up to the capped amount, leaving it exposed to the remaining loss (Correct answer)

Correct answer: The organization can only recover up to the capped amount, leaving it exposed to the remaining loss

Contractual liability caps are generally enforceable, meaning the organization bears any losses exceeding the cap unless specific carve-outs for gross negligence or willful misconduct apply.

Question 49: In TPRM, what is the role of a 'key risk indicator' (KRI)?

A metric that confirms a risk event has already occurred
A contractual threshold that triggers automatic vendor penalties
A regulatory benchmark used to compare vendor performance across the industry
A forward-looking metric that signals increasing risk before an adverse event happens (Correct answer)

Correct answer: A forward-looking metric that signals increasing risk before an adverse event happens

KRIs are leading indicators that provide early warning signals of rising risk exposure, enabling proactive intervention before risks materialize into losses.

Question 50: What does 'risk appetite' mean in the context of a TPRM program?

The number of vendors an organization is willing to onboard per year
The level of third-party risk an organization is willing to accept in pursuit of its objectives (Correct answer)
The vendor's tolerance for audit requests from the client
The budget allocated to vendor risk management tools

Correct answer: The level of third-party risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines the boundaries within which an organization is willing to operate regarding third-party risk, guiding decisions about which vendors to engage and what risk levels are acceptable.

Question 51: Which framework is most commonly used to assess the cybersecurity posture of third-party vendors in the US financial sector?

COBIT 5
NIST Cybersecurity Framework (Correct answer)
ISO 9001
PMBOK

Correct answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework is widely adopted in the US financial sector to evaluate and communicate cybersecurity risk with third-party vendors.

Question 52: What is the relationship between theory and practice?

Theory always takes priority over practical experience
They are completely separate domains
Practice is always more important than theory
Theory informs practice, and practice tests and refines theory (Correct answer)

Correct answer: Theory informs practice, and practice tests and refines theory

Theory and practice have a reciprocal relationship: theory guides practice, and practical experience validates and improves theory.

Question 53: Which of the following scenarios best illustrates 'operational risk' arising from a third-party relationship?

A vendor's CEO faces criminal charges unrelated to the contracted services
A vendor's data center outage causes the organization's customer-facing systems to go offline (Correct answer)
A vendor's stock price drops, reducing its market valuation
A vendor raises its service fees above the contracted rate

Correct answer: A vendor's data center outage causes the organization's customer-facing systems to go offline

Operational risk from third parties manifests when vendor failures in processes, systems, or people directly disrupt the organization's own operations.

Question 54: What is the primary distinction between a 'questionnaire-based assessment' and an 'on-site assessment' in vendor due diligence?

Questionnaires rely on vendor self-attestation; on-site assessments allow direct verification of controls (Correct answer)
Questionnaires measure financial risk; on-site assessments measure operational risk exclusively
On-site assessments are required only for international vendors; questionnaires cover domestic vendors
Questionnaires are legally binding; on-site assessments are advisory only

Correct answer: Questionnaires rely on vendor self-attestation; on-site assessments allow direct verification of controls

Questionnaires depend on the vendor's own representations, while on-site assessments enable direct observation and testing of whether stated controls actually exist and function.

Question 55: How should fundamental concepts be prioritized in learning?

Fundamentals are only for beginners
Learn everything simultaneously
Skip basics and focus on advanced material
Master basics before advancing to complex topics (Correct answer)

Correct answer: Master basics before advancing to complex topics

Strong fundamentals provide the foundation upon which all advanced knowledge and skills are built.

Question 56: Which body within an organization typically has ULTIMATE accountability for the third-party risk management program?

The individual business lines that sponsor each vendor relationship
The IT department, because most vendor risk is technology-related
The Board of Directors or a delegated committee such as the Risk Committee (Correct answer)
The procurement department, because it owns vendor contracts

Correct answer: The Board of Directors or a delegated committee such as the Risk Committee

Governance accountability for enterprise risk programs — including TPRM — rests at the Board or its delegated committee (e.g., Audit and Risk Committee). The Board sets risk appetite and expects management to report on TPRM program effectiveness. Procurement, IT, and business lines have operational roles, but ultimate accountability is at the governance level.

Question 57: Which contract element addresses what happens to an organization's data and assets when the vendor relationship is terminated?

Data return and destruction clauses (Correct answer)
Governing law provisions
Intellectual property assignment clauses
Indemnification provisions

Correct answer: Data return and destruction clauses

Data return and destruction clauses specify how the vendor must handle the organization's data upon contract termination, ensuring sensitive information is properly returned or securely destroyed.

Question 58: Why is staying current with industry developments important for CTPRP professionals?

Current knowledge is only important for exam preparation
The field evolves and practitioners must adapt to provide quality service (Correct answer)
Developments in the field are rarely significant
Only academic researchers need to stay current

Correct answer: The field evolves and practitioners must adapt to provide quality service

Fields continuously evolve with new research, technology, and best practices that affect professional competency.

Question 59: What is the main purpose of an exit strategy or exit plan for a critical vendor?

To prepare the vendor for an acquisition by your organization
To plan the vendor's retirement from the industry
To document the vendor's succession of account managers
To ensure business continuity if the vendor fails, exits the market, or the contract is terminated (Correct answer)

Correct answer: To ensure business continuity if the vendor fails, exits the market, or the contract is terminated

An exit strategy for a critical vendor details how the organization will transition services to maintain continuity if the vendor relationship ends abruptly or is terminated for cause.

Question 60: What should a CTPRP professional do when they encounter a situation beyond their competence?

Attempt to handle it anyway
Delegate to an unlicensed assistant
Ignore the situation
Refer to a qualified specialist or seek additional training (Correct answer)

Correct answer: Refer to a qualified specialist or seek additional training

Recognizing the limits of ones competence and making appropriate referrals is a fundamental professional responsibility.

Question 61: How does CTPRP certification benefit employers?

It provides assurance of employee competence and commitment to professional standards (Correct answer)
It guarantees perfect job performance
It reduces salary requirements
It eliminates the need for on-the-job training

Correct answer: It provides assurance of employee competence and commitment to professional standards

Certified employees have demonstrated verified knowledge and dedication to their profession, reducing risk for employers.

Question 62: Which framework is commonly used for managing third-party risks?

NIST Cybersecurity Framework (Correct answer)
ISO 9001
Six Sigma
PMBOK Guide

Correct answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework is commonly used for managing third-party risks, particularly those related to information security. It provides a flexible, risk-based approach to help organizations assess, manage, and communicate cybersecurity risks, which is critical when dealing with external entities that may access sensitive data or systems. While other frameworks exist, NIST is highly recognized for its comprehensive approach to cybersecurity risk management in third-party contexts.

Question 63: Which evaluation methodology best supports continuous monitoring of a third party's control environment between annual assessments?

Full on-site audit repeated quarterly
Automated control testing and real-time risk indicator feeds (Correct answer)
Requiring the vendor to self-certify annually
Replacing ongoing monitoring with a single SOC 2 report

Correct answer: Automated control testing and real-time risk indicator feeds

Automated control testing and real-time risk indicators enable continuous visibility without the cost of repeated full audits.

Question 64: Under the OCC's third-party risk management guidance, which activity requires the MOST rigorous due diligence before engagement?

Office supply and facilities management vendors
Technology vendors providing non-core software tools
Routine administrative vendor relationships
Critical activities that could harm consumers if the third party fails (Correct answer)

Correct answer: Critical activities that could harm consumers if the third party fails

OCC guidance requires the most rigorous due diligence for third parties performing critical activities, especially those that could harm consumers or the bank if the arrangement fails.

Question 65: An organization's vendor management policy requires quarterly business reviews (QBRs) for Tier 1 vendors. What is the PRIMARY purpose of a QBR?

To assess vendor performance, discuss strategic alignment, and address emerging risks (Correct answer)
To fulfill regulatory audit requirements
To renegotiate contract pricing each quarter
To evaluate the vendor's financial statements only

Correct answer: To assess vendor performance, discuss strategic alignment, and address emerging risks

QBRs provide a structured forum to review performance against SLAs, align on strategic objectives, and proactively identify and mitigate emerging risks.

Question 66: When documenting CPE activities for CTPRP renewal, credential holders should retain supporting records for at least:

One full renewal cycle after the activities were completed (Correct answer)
The lifetime of the credential
Six months after the renewal date
Three years regardless of renewal status

Correct answer: One full renewal cycle after the activities were completed

Credential holders should retain CPE documentation for at least one renewal cycle in case of an audit by the certifying body.

Question 67: An evaluator receives a completed security questionnaire but cannot verify any of the vendor's responses. The BEST next step is to:

Accept the responses at face value to maintain the vendor relationship
Escalate immediately to the board of directors
Terminate the vendor engagement pending a full re-evaluation
Request supporting evidence such as audit reports, screenshots, or policies (Correct answer)

Correct answer: Request supporting evidence such as audit reports, screenshots, or policies

Requesting supporting evidence allows the evaluator to validate self-reported controls and ensure the questionnaire reflects actual practice.

Question 68: A CTPRP holder's certification lapses due to non-renewal. What is the correct way to reference the credential?

Use 'CTPRP (Inactive)' to show historical achievement
Stop using the designation until it is reinstated (Correct answer)
Use 'Former CTPRP' permanently on all professional materials
Continue using CTPRP since the knowledge does not expire

Correct answer: Stop using the designation until it is reinstated

Lapsed credential holders must cease using the designation until they complete the reinstatement process.

Question 69: How does 'strategic risk' from third parties differ from operational risk in TPRM?

Strategic risk relates to threats to the organization's long-term goals and competitive position from vendor decisions or failures (Correct answer)
Strategic risk only applies to publicly traded companies with investor relations concerns
Strategic risk is quantifiable in financial terms; operational risk is not measurable
Strategic risk affects daily operations; operational risk affects long-term planning

Correct answer: Strategic risk relates to threats to the organization's long-term goals and competitive position from vendor decisions or failures

Strategic risk from third parties arises when vendor choices, dependencies, or failures undermine the organization's ability to execute its long-term strategy or maintain competitive advantage.

Question 70: When a vendor contract expires and the relationship is transitioning to a new provider, which activity is MOST critical from a risk management perspective?

Assigning the contract to the new vendor without amendment
Immediately terminating the vendor's system access on contract end date
Ensuring a data return, destruction, and transition assistance clause was included in the original contract (Correct answer)
Negotiating a retroactive indemnification clause

Correct answer: Ensuring a data return, destruction, and transition assistance clause was included in the original contract

Pre-negotiated data return, destruction, and transition assistance provisions ensure a controlled offboarding that protects data and maintains service continuity.

Question 71: Which ethical obligation does a CTPRP professional have when advising a client whose third-party risk practices conflict with industry standards?

Advise the client of the risks and recommend alignment with best practices (Correct answer)
Remain silent to avoid creating conflict
Adopt the client's practices to preserve the business relationship
Immediately report the client to regulatory authorities

Correct answer: Advise the client of the risks and recommend alignment with best practices

CTPRP professionals are ethically obligated to provide honest, competent advice that serves the client's best interests including risk exposure.

Question 72: What is the significance of PCI DSS compliance for a vendor handling payment card data?

It exempts the vendor from SOC 2 audit requirements
It confirms the vendor meets security standards required to store, process, or transmit cardholder data (Correct answer)
It certifies the vendor as a preferred payment processor by Visa and Mastercard
It indicates the vendor has no prior data breaches

Correct answer: It confirms the vendor meets security standards required to store, process, or transmit cardholder data

PCI DSS compliance demonstrates that the vendor has implemented the required controls to protect cardholder data, reducing the payment-related risk to organizations that share card data with them.

Question 73: During an on-site evaluation, an assessor discovers that access control logs exist but are never reviewed. Which risk domain does this finding primarily affect?

Information security risk (Correct answer)
Strategic risk
Reputational risk
Compliance risk

Correct answer: Information security risk

Unreviewed access logs represent a detective control gap within the information security domain, leaving unauthorized access undetected.

Question 74: Which of the following best describes the 'risk universe' concept in TPRM program design?

The regulatory frameworks across all jurisdictions where vendors operate
The complete inventory of all risk categories and scenarios relevant to third-party relationships that the program must address (Correct answer)
The total number of third-party vendors an organization is permitted to engage
The aggregate financial exposure ceiling set by the board for vendor-related losses

Correct answer: The complete inventory of all risk categories and scenarios relevant to third-party relationships that the program must address

The risk universe defines the full scope of risk types—operational, financial, compliance, cyber, reputational, and others—that a TPRM program is designed to identify and manage.

Question 75: What is the primary purpose of the CTPRP certification program?

To validate professional competence and knowledge in the field (Correct answer)
To generate revenue for the certifying organization
To replace academic degrees
To limit the number of professionals

Correct answer: To validate professional competence and knowledge in the field

The CTPRP certification validates that professionals have demonstrated the knowledge and skills required for competent practice.

Question 76: Which evaluation output is MOST useful for communicating third-party risk posture to senior management?

A list of all open vendor tickets in the issue tracking system
Raw questionnaire response data exported to a spreadsheet
A detailed technical findings report from each vendor assessment
A risk-rated heat map with aggregated vendor scores and trend data (Correct answer)

Correct answer: A risk-rated heat map with aggregated vendor scores and trend data

A heat map with aggregated scores and trends translates technical findings into executive-level insight for decision-making.

Question 77: An organization discovers mid-assessment that a Tier 1 vendor subcontracts 60% of its core service delivery to an unnamed fourth party. What is the BEST immediate response?

Accept the vendor's assurance that fourth parties are managed appropriately
Terminate the relationship immediately without further investigation
Require disclosure of fourth-party identities and extend due diligence to cover material subcontractors (Correct answer)
Reduce the vendor's risk tier to Tier 2 since the work is distributed

Correct answer: Require disclosure of fourth-party identities and extend due diligence to cover material subcontractors

Material fourth-party exposure must be identified and assessed; requiring disclosure and extending due diligence preserves visibility into the full risk chain.

Question 78: Which technical skill is essential when reviewing a vendor's API security to prevent unauthorized data access?

Reviewing vendor employee training completion rates
Assessing the vendor's disaster recovery plan narrative
Analyzing vendor financial statements for liquidity
Evaluating OAuth 2.0 and token-based authentication implementations (Correct answer)

Correct answer: Evaluating OAuth 2.0 and token-based authentication implementations

OAuth 2.0 and proper token management are foundational API security controls that prevent unauthorized access to data shared between systems.

Question 79: Which of the following is a valid reason for Shared Assessments to revoke a CTPRP credential?

The holder earns an additional certification
The holder violates the CTPRP Code of Ethics (Correct answer)
The holder transitions to a different industry
The holder changes employers

Correct answer: The holder violates the CTPRP Code of Ethics

Violations of the CTPRP Code of Ethics can result in revocation of the certification by Shared Assessments.

Question 80: Which section of the CPTRP exam covers compliance requirements?

Incident response planning
Compliance requirements (Correct answer)
Risk monitoring methods
Vendor onboarding process

Correct answer: Compliance requirements

The CTPRP exam covers various domains essential for third-party risk management. One dedicated section specifically addresses the complex landscape of regulatory and legal compliance that organizations must adhere to when engaging with third parties. This ensures professionals understand their obligations and how to manage third-party activities in line with relevant laws and industry standards.

Question 81: In vendor governance, what does 'escalation path' refer to?

The vendor's internal promotion structure
The defined process for raising unresolved vendor issues to higher authority (Correct answer)
The contract renewal negotiation process
The vendor's plan to grow its business with your organization

Correct answer: The defined process for raising unresolved vendor issues to higher authority

An escalation path defines the steps and authorities involved when vendor performance issues, control failures, or contractual disputes cannot be resolved at the operational level.

Question 82: Which activity would NOT typically count toward CTPRP continuing education requirements?

Completing a general Microsoft Office skills course (Correct answer)
Publishing a peer-reviewed article on vendor risk
Speaking at a risk management industry conference
Attending a third-party risk management webinar

Correct answer: Completing a general Microsoft Office skills course

General software skills courses unrelated to third-party risk management do not qualify as relevant CE for the CTPRP credential.

Question 83: Which control domain is typically evaluated when assessing a vendor's physical security during due diligence?

Vendor's office interior design standards
Vendor's employee sick leave policies
Vendor's local zoning permits
Access controls for facilities, server rooms, and sensitive areas (Correct answer)

Correct answer: Access controls for facilities, server rooms, and sensitive areas

Physical security assessments focus on controls such as badge access, CCTV, visitor logs, and secure areas to determine whether unauthorized physical access can be prevented.

Question 84: What should be done when a conflict exists between different applicable standards?

Create a new personal standard
Ignore all conflicting standards
Identify the most stringent requirement and consult with relevant authorities (Correct answer)
Follow the least restrictive standard

Correct answer: Identify the most stringent requirement and consult with relevant authorities

When standards conflict, the most protective or stringent requirement typically takes precedence, with consultation as needed.

Question 85: Which statement about the CTPRP renewal cycle is most accurate?

CPE credits accumulated annually maintain the credential without exam retake (Correct answer)
Renewal occurs automatically upon payment of dues
Renewal requires peer endorsement letters annually
Renewal requires re-taking the full exam every three years

Correct answer: CPE credits accumulated annually maintain the credential without exam retake

CTPRP holders maintain their credential by accumulating CPE credits rather than re-sitting the exam at each renewal.

Question 86: An organization is building a vendor contract template. Which element is MOST important to include to address data privacy compliance under US state privacy laws such as CCPA?

A most-favored-nation pricing clause
A governing law clause defaulting to the vendor's home state
A data processing addendum (DPA) defining roles, processing purposes, and data subject rights obligations (Correct answer)
A non-compete clause restricting the vendor from serving competitors

Correct answer: A data processing addendum (DPA) defining roles, processing purposes, and data subject rights obligations

A DPA establishes the legal framework for data processing, aligning with CCPA and similar regulations by defining controller/processor roles and obligations.

Question 87: Which US regulatory framework requires organizations to report material cybersecurity incidents involving third parties to the SEC within four business days?

NIST SP 800-53
HIPAA Breach Notification Rule
FFIEC IT Examination Handbook
SEC Cybersecurity Disclosure Rules (2023) (Correct answer)

Correct answer: SEC Cybersecurity Disclosure Rules (2023)

The SEC's 2023 Cybersecurity Disclosure Rules require public companies to disclose material cybersecurity incidents, including those originating from third parties, within four business days.

Question 88: What is typically required to maintain CTPRP certification?

Retaking the full certification exam annually
Nothing once initial certification is obtained
Completing continuing education credits and meeting renewal requirements (Correct answer)
Paying fees without any additional requirements

Correct answer: Completing continuing education credits and meeting renewal requirements

Most certifications require ongoing professional development to ensure practitioners stay current in their field.

Question 89: What is the minimum passing score required for CPTRP certification?

80%
60%
90%
70% (Correct answer)

Correct answer: 70%

To successfully achieve CTPRP certification, candidates must demonstrate a sufficient level of knowledge and understanding across all exam domains. A minimum passing score of 70% is typically required to ensure that certified professionals possess the necessary competency to effectively manage third-party risks. This threshold helps maintain the credibility and value of the certification.

Question 90: Which standard provides a framework for information security management systems and is commonly requested from vendors in due diligence?

ISO/IEC 27001 (Correct answer)
PCI DSS
HIPAA
SOC 2 Type II

Correct answer: ISO/IEC 27001

ISO/IEC 27001 is the internationally recognized standard for information security management systems and is frequently requested as evidence of security controls during vendor due diligence.

Question 91: Which organization administers the CTPRP credential and oversees its renewal requirements?

Shared Assessments (Correct answer)
RIMS
GARP
ISACA

Correct answer: Shared Assessments

The Shared Assessments Program administers the CTPRP certification and sets its maintenance requirements.

Question 92: What is the primary purpose of a vendor's System and Organization Controls (SOC) report in TPRM due diligence?

To provide independent assurance on internal controls (Correct answer)
To confirm vendor compliance with GDPR
To replace the need for a vendor questionnaire
To verify vendor financial solvency

Correct answer: To provide independent assurance on internal controls

SOC reports provide third-party auditor assurance on the design and operating effectiveness of a vendor's internal controls.

Question 93: When a vendor experiences a data breach, which action should the contracting organization take FIRST according to best-practice vendor governance?

Invoke contractual breach notification requirements and assess exposure (Correct answer)
Transfer all vendor functions to an internal team
Immediately terminate the vendor contract
Issue a public statement distancing from the vendor

Correct answer: Invoke contractual breach notification requirements and assess exposure

The immediate priority is to invoke contractual breach notification provisions to understand the scope of exposure and coordinate the incident response according to established procedures.

Question 94: How does CTPRP certification benefit employers?

It provides assurance of employee competence and commitment to professional standards (Correct answer)
It reduces salary requirements
It eliminates the need for on-the-job training
It guarantees perfect job performance

Correct answer: It provides assurance of employee competence and commitment to professional standards

Certified employees have demonstrated verified knowledge and dedication to their profession, reducing risk for employers.

Question 95: How many continuing education (CE) hours are generally required per recertification cycle for the CTPRP credential?

20 hours
50 hours
10 hours
30 hours (Correct answer)

Correct answer: 30 hours

CTPRP holders are generally required to complete 30 continuing education hours per recertification period to maintain the credential.

Question 96: Which of the following activities would NOT typically qualify as an acceptable CPE source for CTPRP renewal?

Reading a TPRM-focused industry whitepaper
Completing a vendor risk assessment at work
Attending a third-party risk management webinar
Watching a personal finance documentary unrelated to risk (Correct answer)

Correct answer: Watching a personal finance documentary unrelated to risk

CPE activities must be relevant to third-party risk management or a related professional domain to count toward renewal.

Question 97: What is the key purpose of a right-to-audit clause in a vendor contract?

To allow the client organization to audit the vendor's controls and compliance (Correct answer)
To give the vendor the right to audit the client's financials
To authorize government regulators to inspect vendor facilities on behalf of the client
To permit third-party auditors to review the client's own employees

Correct answer: To allow the client organization to audit the vendor's controls and compliance

A right-to-audit clause contractually reserves the client's ability to conduct or commission audits of the vendor's controls, ensuring ongoing accountability beyond self-attestation.

Question 98: What is the role of a code of ethics in the CTPRP profession?

To guide professional behavior and protect the public interest (Correct answer)
To standardize pricing for services
To restrict professional freedom
To create legal liability

Correct answer: To guide professional behavior and protect the public interest

A code of ethics establishes expectations for professional conduct and serves as a guide for ethical decision-making.

Question 99: What role does CPTRP certification play in regulatory compliance?

Improves sales metrics.
Reduces tax reporting obligations.
Simplifies organizational hierarchy.
Helps meet regulatory compliance requirements. (Correct answer)

Correct answer: Helps meet regulatory compliance requirements.

Many industries, particularly financial services and healthcare, are subject to stringent regulations that mandate robust third-party risk management programs. CTPRP certification equips professionals with the knowledge to navigate these complex requirements, ensuring that an organization's third-party engagements align with legal and industry standards, thereby avoiding penalties and reputational damage.

Question 100: What is the primary role of a Third-Party Risk Management (TPRM) policy within an organization?

To list approved vendors for procurement teams
To define the organization's marketing strategy for vendor partnerships
To set employee salary guidelines for risk staff
To establish the governance framework, roles, and standards for managing vendor risk (Correct answer)

Correct answer: To establish the governance framework, roles, and standards for managing vendor risk

A TPRM policy defines the governance structure, risk appetite, roles and responsibilities, and minimum standards that guide all third-party risk management activities organization-wide.

CTPRP (Certified Third-Party Risk Professional) Exam

The CTPRP exam is administered by the Shared Assessments Program and is designed for professionals involved in third-party risk management and vendor governance. The exam covers third-party risk assessment, due diligence, regulatory compliance, vendor governance, and professional standards. Candidates must demonstrate knowledge of industry frameworks including SIG, CAIQ, and ISO 27001. The exam consists of approximately 100 questions with a passing score of 70%.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

sharedassessments.org — Test delivery, eligibility, fees, exam format, passing score, renewal, retake fee, retake policy, score release, test dates · verified Oct 2026