CTPRP (Certified Third-Party Risk Professional) Exam — Questions and Answers

Question 1: When scoring vendor questionnaire responses, an organization uses a weighted scoring model. Which weighting approach is MOST defensible to regulators?

Assigning higher weights to controls that directly mitigate the highest inherent risks for that vendor's risk tier (Correct answer)
Weighting based solely on questionnaire question length
Weighting all questions equally regardless of control domain
Allowing vendors to self-select which questions carry the most weight

Correct answer: Assigning higher weights to controls that directly mitigate the highest inherent risks for that vendor's risk tier

Risk-aligned weighting ensures that controls most critical to mitigating a vendor's specific inherent risk profile receive proportionate scoring influence.

Question 2: What is a 'right to audit' clause in a vendor contract primarily intended to accomplish?

Grant the organization the right to inspect the vendor's controls and compliance directly (Correct answer)
Enable the organization to audit competitor pricing through the vendor
Require the vendor to provide annual financial audits to regulators
Allow the vendor to audit the organization's financial statements

Correct answer: Grant the organization the right to inspect the vendor's controls and compliance directly

A right to audit clause contractually allows the organization (or its representatives) to directly assess the vendor's processes, controls, and compliance with agreed standards.

Question 3: What is the primary purpose of data visualization?

To replace numerical analysis entirely
To hide unfavorable data
To make reports look more attractive
To communicate complex data clearly and effectively through visual representations (Correct answer)

Correct answer: To communicate complex data clearly and effectively through visual representations

Visualization transforms complex data into accessible visual formats that reveal patterns, trends, and relationships.

Question 4: Which domain is NOT typically covered by the CTPRP body of knowledge?

Personal investment portfolio management (Correct answer)
Third-party risk program governance
Vendor due diligence and oversight
Information security and privacy controls for vendors

Correct answer: Personal investment portfolio management

Personal investment management is not relevant to third-party risk and is outside the CTPRP body of knowledge.

Question 5: A vendor contract includes a limitation of liability clause capping damages at one year's contract fees. During an incident, actual damages total five times the annual fee. What is the MOST significant implication for the organization?

The organization can only recover up to the capped amount, leaving it exposed to the remaining loss (Correct answer)
The organization can sue for the full amount regardless of the contract cap
The limitation of liability clause is automatically unenforceable in cases of gross negligence
The vendor must provide additional insurance to cover the gap

Correct answer: The organization can only recover up to the capped amount, leaving it exposed to the remaining loss

Contractual liability caps are generally enforceable, meaning the organization bears any losses exceeding the cap unless specific carve-outs for gross negligence or willful misconduct apply.

Question 6: An organization discovers a critical CVE affecting software used by a key vendor. What is the FIRST technical step in the TPRM response?

Issue a contract amendment
Contact the vendor to determine if they are affected and their remediation timeline (Correct answer)
Notify regulators about the vendor's vulnerability
Immediately suspend data sharing with the vendor

Correct answer: Contact the vendor to determine if they are affected and their remediation timeline

The first step is confirming whether and how the vendor is impacted, enabling an informed risk decision before taking operational or contractual action.

Question 7: What is calibration in the context of technical standards?

Balancing project budgets
Comparing measurements to a known standard to ensure accuracy (Correct answer)
Adjusting schedules to meet deadlines
Training new employees on procedures

Correct answer: Comparing measurements to a known standard to ensure accuracy

Calibration ensures measuring instruments provide accurate readings by comparing them against reference standards.

Question 8: A CTPRP holder's certification lapses due to non-renewal. What is the correct way to reference the credential?

Use 'Former CTPRP' permanently on all professional materials
Use 'CTPRP (Inactive)' to show historical achievement
Continue using CTPRP since the knowledge does not expire
Stop using the designation until it is reinstated (Correct answer)

Correct answer: Stop using the designation until it is reinstated

Lapsed credential holders must cease using the designation until they complete the reinstatement process.

Question 9: Which scenario represents a concentration risk finding in a third-party evaluation program?

A vendor has offices in three different time zones
Sixty percent of critical business processes rely on a single cloud provider (Correct answer)
A vendor offers both SaaS and on-premise deployment options
The organization uses a different vendor for each business unit

Correct answer: Sixty percent of critical business processes rely on a single cloud provider

Over-reliance on a single provider for the majority of critical processes creates systemic exposure if that provider experiences a disruption.

Question 10: Which activity would NOT typically count toward CTPRP continuing education requirements?

Publishing a peer-reviewed article on vendor risk
Completing a general Microsoft Office skills course (Correct answer)
Attending a third-party risk management webinar
Speaking at a risk management industry conference

Correct answer: Completing a general Microsoft Office skills course

General software skills courses unrelated to third-party risk management do not qualify as relevant CE for the CTPRP credential.

Question 11: Which element is MOST critical when conducting vendor due diligence for a cloud service provider handling regulated data?

The vendor's physical office locations
The vendor's SOC 2 Type II report and data residency controls (Correct answer)
The vendor's marketing materials and client testimonials
The number of years the vendor has been in business

Correct answer: The vendor's SOC 2 Type II report and data residency controls

A SOC 2 Type II report provides evidence of operational effectiveness of security controls over time, while data residency controls confirm compliance with data sovereignty regulations.

Question 12: Why is understanding theory important for practical application?

Theory is purely academic with no practical value
It provides the foundation for informed decision-making and creative expression (Correct answer)
Theory is only important for teaching others
It replaces the need for practical experience

Correct answer: It provides the foundation for informed decision-making and creative expression

Theoretical understanding enables practitioners to make informed choices, solve problems, and innovate in their field.

Question 13: Which evaluation technique is MOST effective at uncovering undisclosed subprocessors or shadow IT within a vendor's environment?

Performing network traffic analysis and interviewing operational staff during an on-site visit (Correct answer)
Limiting the evaluation to the vendor's primary data center
Reviewing the vendor's marketing website
Asking the vendor's sales team to confirm subprocessor usage

Correct answer: Performing network traffic analysis and interviewing operational staff during an on-site visit

On-site observation combined with staff interviews surfaces operational realities that formal questionnaire responses may omit or obscure.

Question 14: Which of the following describes a 'reciprocal credit' arrangement in the context of CTPRP maintenance?

CPE credits earned for one recognized credential may partially fulfill the CTPRP renewal requirement (Correct answer)
CPE credits earned for the CTPRP automatically fulfill requirements for all other certifications
Two CTPRP holders may share CPE credits between their accounts
Reciprocal credits refer to the exchange of credits between international TPRM associations

Correct answer: CPE credits earned for one recognized credential may partially fulfill the CTPRP renewal requirement

Some credentialing bodies accept CPE credits earned for related credentials as partial fulfillment of renewal requirements, recognizing overlapping professional development.

Question 15: What distinguishes a 'critical' vendor from a 'strategic' vendor in TPRM classification?

Strategic vendors have higher spend; critical vendors have lower contract value
Critical vendors are domestic; strategic vendors are international
Critical vendors are essential to operations or compliance; strategic vendors align with long-term business goals (Correct answer)
Critical vendors provide unique services; strategic vendors are interchangeable

Correct answer: Critical vendors are essential to operations or compliance; strategic vendors align with long-term business goals

Critical vendors are those whose failure would significantly disrupt operations or violate regulatory requirements, while strategic vendors are valued for long-term business alignment.

Question 16: Which approach to vendor performance reporting is considered BEST practice in ongoing third-party oversight?

Using a combination of vendor-provided reports, independent audits, and automated monitoring for a balanced view (Correct answer)
Conducting performance reviews only when issues are escalated by end users
Relying solely on the vendor's self-reported metrics without independent verification
Limiting performance reviews to the annual contract renewal period

Correct answer: Using a combination of vendor-provided reports, independent audits, and automated monitoring for a balanced view

A multi-source approach combining vendor self-reporting with independent validation and automated monitoring provides a more accurate and complete picture of vendor performance than any single method alone.

Question 17: A CTPRP holder serves on a third-party risk committee at their organization. This type of professional involvement would most likely:

Disqualify the holder from other CPE activities in the same category
Qualify for CPE credit if it involves structured learning or advancement of TPRM knowledge (Correct answer)
Never qualify for CPE credit as it is considered regular job duties
Automatically generate the maximum allowable CPE credits for the cycle

Correct answer: Qualify for CPE credit if it involves structured learning or advancement of TPRM knowledge

Committee or professional body participation qualifies for CPE credit when it involves structured advancement of relevant professional knowledge.

Question 18: A CTPRP holder is writing a book chapter on vendor risk. May they identify themselves as CTPRP-certified in the author biography?

Yes, as long as the credential is active and accurately represented (Correct answer)
No, publication use requires separate licensing approval from the certifying body
Only for academic publications, not commercial books
Only if the publisher is accredited by the certifying organization

Correct answer: Yes, as long as the credential is active and accurately represented

CTPRP holders with an active credential may include the designation in any professional context, including published author biographies.

Question 19: Which practice is considered a technical best practice for managing vendor privileged access to your organization's systems?

Sharing service account credentials via email for ease of use
Granting vendors permanent standing admin accounts for convenience
Allowing vendors to self-manage their own access permissions
Using a Privileged Access Management (PAM) solution with just-in-time access provisioning (Correct answer)

Correct answer: Using a Privileged Access Management (PAM) solution with just-in-time access provisioning

PAM solutions with just-in-time access ensure vendor privileged access is granted only when needed, fully logged, and automatically revoked, dramatically reducing standing privilege risk.

Question 20: The historical evolution from 'vendor due diligence' to 'third-party risk management' reflects which broader organizational change?

A move from qualitative to purely quantitative risk scoring
A shift from one-time screening to an ongoing, lifecycle-based governance approach (Correct answer)
The centralization of all vendor decisions within the legal department
The replacement of legal contract review with technical security assessments

Correct answer: A shift from one-time screening to an ongoing, lifecycle-based governance approach

The terminology shift reflects a fundamental maturity evolution from performing due diligence only at contract inception to managing risk continuously across the entire vendor relationship lifecycle.

Question 21: What happens if a CTPRP holder is audited and cannot provide documentation for claimed CPE credits?

The holder receives a 90-day extension to locate the documentation
The credential is permanently revoked with no appeal process
The undocumented credits may be disallowed, potentially placing the credential in non-compliance (Correct answer)
The credits are automatically accepted based on the holder's attestation

Correct answer: The undocumented credits may be disallowed, potentially placing the credential in non-compliance

Inability to substantiate CPE credits during an audit can result in those credits being disallowed and the credential being placed in a non-compliant status.

Question 22: Which evaluation output is MOST useful for communicating third-party risk posture to senior management?

Raw questionnaire response data exported to a spreadsheet
A detailed technical findings report from each vendor assessment
A risk-rated heat map with aggregated vendor scores and trend data (Correct answer)
A list of all open vendor tickets in the issue tracking system

Correct answer: A risk-rated heat map with aggregated vendor scores and trend data

A heat map with aggregated scores and trends translates technical findings into executive-level insight for decision-making.

Question 23: Which technical skill is essential when reviewing a vendor's API security to prevent unauthorized data access?

Assessing the vendor's disaster recovery plan narrative
Reviewing vendor employee training completion rates
Analyzing vendor financial statements for liquidity
Evaluating OAuth 2.0 and token-based authentication implementations (Correct answer)

Correct answer: Evaluating OAuth 2.0 and token-based authentication implementations

OAuth 2.0 and proper token management are foundational API security controls that prevent unauthorized access to data shared between systems.

Question 24: Which of the following scenarios would most likely constitute grounds for CTPRP credential revocation?

Changing employers without notifying Shared Assessments
Taking a career break of six months during a renewal cycle
Submitting fraudulent CPE documentation during a renewal audit (Correct answer)
Failing to earn all CPE credits in the first year of a two-year cycle

Correct answer: Submitting fraudulent CPE documentation during a renewal audit

Submitting false or fraudulent documentation is an ethical violation that can result in permanent revocation of the CTPRP credential.

Question 25: What is the primary function of a vendor risk register in TPRM technical operations?

Tracking vendor invoice payment history
Centrally documenting identified risks, risk ratings, owners, and remediation status for all vendors (Correct answer)
Storing vendor marketing materials and product demos
Recording vendor employee headcount changes

Correct answer: Centrally documenting identified risks, risk ratings, owners, and remediation status for all vendors

A vendor risk register is the authoritative record for tracking all identified risks, their severity, ownership, and mitigation status across the vendor portfolio.

Question 26: How can CPTRP certification enhance a professional's career?

Enhances credibility and career opportunities. (Correct answer)
Simplifies vendor marketing strategies.
Improves financial budgeting for vendors.
Provides negotiation skills for contracts.

Correct answer: Enhances credibility and career opportunities.

Earning CTPRP certification validates a professional's expertise in a specialized and critical field. This recognized credential significantly boosts their credibility within the industry, demonstrating a commitment to best practices and a high level of skill. Consequently, it opens doors to advanced roles, promotions, and broader career opportunities in third-party risk management.

Question 27: Under the OCC's guidance on third-party risk, which phase requires the most rigorous documentation of risk assessments and due diligence?

Planning and due diligence before engagement (Correct answer)
Ongoing monitoring and reporting
Contract negotiation and execution
Termination and exit planning

Correct answer: Planning and due diligence before engagement

OCC guidance emphasizes that the planning phase—before entering a relationship—requires thorough due diligence and risk assessments documented to demonstrate sound decision-making.

Question 28: What is the primary purpose of the CTPRP designation for a professional's career?

Certifies expertise in cybersecurity penetration testing
Validates knowledge of international trade compliance
Demonstrates proficiency in third-party risk management practices (Correct answer)
Qualifies the holder to conduct financial audits

Correct answer: Demonstrates proficiency in third-party risk management practices

The CTPRP designation validates a professional's competency in managing third-party vendor risks.

Question 29: Under FFIEC guidance, what must banks document as part of ongoing third-party relationship management?

Performance reviews, risk reassessments, and any material changes to the vendor relationship (Correct answer)
The vendor's office lease agreements
The vendor's employee benefits packages
The vendor's quarterly advertising spend

Correct answer: Performance reviews, risk reassessments, and any material changes to the vendor relationship

FFIEC guidance requires banks to document ongoing vendor performance, periodic risk reassessments, and any changes that could affect the risk profile of the third-party relationship.

Question 30: Which assessment method provides the MOST independent and objective assurance of a vendor's control environment?

Contract review
Vendor self-assessment questionnaire
Vendor reference calls
Third-party audit or attestation report (e.g., SOC 2) (Correct answer)

Correct answer: Third-party audit or attestation report (e.g., SOC 2)

Attestation reports from independent auditors provide objective, verified evidence of control effectiveness rather than vendor self-reported information.

Question 31: A TPRM analyst is reviewing a vendor's patch management policy. What is the most critical metric to evaluate?

Vendor's annual revenue growth
Mean time to patch critical vulnerabilities (Correct answer)
Number of software products the vendor sells
Number of employees in the IT department

Correct answer: Mean time to patch critical vulnerabilities

Mean time to patch critical vulnerabilities directly measures the vendor's ability to reduce exposure windows after a CVE is published.

Question 32: A vendor governance framework should include 'right to audit' clauses primarily to:

Access vendor intellectual property for competitive analysis
Verify vendor compliance with contractual and regulatory requirements (Correct answer)
Negotiate better pricing during contract renewals
Reduce the organization's own internal audit workload

Correct answer: Verify vendor compliance with contractual and regulatory requirements

Right-to-audit clauses give organizations the contractual authority to verify that vendors are meeting their compliance obligations and adhering to agreed security standards.

Question 33: Which element of third-party contracts is specifically designed to protect the organization if the vendor's practices cause regulatory penalties?

Most-favored-nation clause
Indemnification clause (Correct answer)
SLA (Service Level Agreement)
Force majeure clause

Correct answer: Indemnification clause

Indemnification clauses require the vendor to compensate the organization for losses, including regulatory fines, resulting from the vendor's failures or misconduct.

Question 34: Under GDPR, which role does a vendor typically hold when processing personal data on behalf of a US-based company serving EU residents?

Data Subject
Data Controller
Data Processor (Correct answer)
Data Custodian

Correct answer: Data Processor

Under GDPR, a vendor processing personal data solely under the instructions of a client organization is classified as a Data Processor, with specific obligations under Article 28.

Question 35: How does 'strategic risk' from third parties differ from operational risk in TPRM?

Strategic risk is quantifiable in financial terms; operational risk is not measurable
Strategic risk affects daily operations; operational risk affects long-term planning
Strategic risk relates to threats to the organization's long-term goals and competitive position from vendor decisions or failures (Correct answer)
Strategic risk only applies to publicly traded companies with investor relations concerns

Correct answer: Strategic risk relates to threats to the organization's long-term goals and competitive position from vendor decisions or failures

Strategic risk from third parties arises when vendor choices, dependencies, or failures undermine the organization's ability to execute its long-term strategy or maintain competitive advantage.

Question 36: In the context of TPRM, 'inherent risk' is BEST defined as:

The residual risk remaining after all controls are applied
Regulatory penalties already assessed against a vendor
The financial cost of managing vendor relationships
The risk exposure before any mitigating controls are considered (Correct answer)

Correct answer: The risk exposure before any mitigating controls are considered

Inherent risk represents the level of risk that exists in a vendor relationship based on factors like data access, criticality, and geography before any controls or mitigations are applied.

Question 37: A vendor's contract is up for renewal, but the vendor has repeatedly missed SLA targets. What is the MOST appropriate first action before renegotiating terms?

Conduct a formal performance review and document all SLA breaches (Correct answer)
Escalate the issue to the vendor's executive team without documentation
Automatically renew with the same terms to avoid disruption
Terminate the contract immediately and source a new vendor

Correct answer: Conduct a formal performance review and document all SLA breaches

Documenting SLA breaches through a formal performance review creates an evidence-based foundation for renegotiation or termination decisions.

Question 38: What is the primary purpose of a risk appetite statement in the context of TPRM?

To establish thresholds guiding which third-party risks are acceptable or require mitigation (Correct answer)
To define the maximum financial loss acceptable from vendor failures
To outline contractual obligations vendors must meet
To document regulatory requirements for third-party oversight

Correct answer: To establish thresholds guiding which third-party risks are acceptable or require mitigation

A risk appetite statement sets organizational boundaries for tolerable risk levels, guiding decisions on whether to accept, mitigate, transfer, or avoid third-party risks.

Question 39: A vendor consistently scores high on quantitative KPIs but receives poor qualitative feedback from internal stakeholders. How should the risk team reconcile this?

Disregard stakeholder feedback as subjective
Reward the vendor based solely on quantitative scores
Immediately escalate to the board
Incorporate both quantitative scores and qualitative stakeholder feedback into the overall performance assessment (Correct answer)

Correct answer: Incorporate both quantitative scores and qualitative stakeholder feedback into the overall performance assessment

A complete performance view requires blending objective metric data with qualitative stakeholder input to capture dimensions KPIs may not fully reflect.

Question 40: What is the best characterization of the CTPRP's standing in the third-party risk management industry?

An entry-level certification for recent college graduates only
A widely recognized benchmark credential for TPRM professionals (Correct answer)
A rarely recognized credential with limited industry adoption
A government-issued license required by federal law

Correct answer: A widely recognized benchmark credential for TPRM professionals

The CTPRP is widely regarded as the benchmark professional credential in the third-party risk management field.

Question 41: Which technique allows an organization to evaluate vendor performance without requiring the vendor to be on-site?

Interview of vendor C-suite executives in person
Remote assessment using standardized questionnaires and documentation review (Correct answer)
On-site audit
Physical inspection of vendor facilities

Correct answer: Remote assessment using standardized questionnaires and documentation review

Remote assessments using questionnaires and document requests enable performance evaluation without travel or disruption.

Question 42: What is the role of a code of ethics in the CTPRP profession?

To standardize pricing for services
To create legal liability
To guide professional behavior and protect the public interest (Correct answer)
To restrict professional freedom

Correct answer: To guide professional behavior and protect the public interest

A code of ethics establishes expectations for professional conduct and serves as a guide for ethical decision-making.

Question 43: Who is typically responsible for ensuring compliance with technical standards?

All professionals involved, from design through implementation (Correct answer)
Only the quality control department
Only the client or end user
Only senior management

Correct answer: All professionals involved, from design through implementation

Compliance with technical standards is a shared responsibility across all stages of a project.

Question 44: What is the primary role of a Third-Party Risk Management (TPRM) policy within an organization?

To define the organization's marketing strategy for vendor partnerships
To list approved vendors for procurement teams
To set employee salary guidelines for risk staff
To establish the governance framework, roles, and standards for managing vendor risk (Correct answer)

Correct answer: To establish the governance framework, roles, and standards for managing vendor risk

A TPRM policy defines the governance structure, risk appetite, roles and responsibilities, and minimum standards that guide all third-party risk management activities organization-wide.

Question 45: During an on-site evaluation, an assessor discovers that access control logs exist but are never reviewed. Which risk domain does this finding primarily affect?

Strategic risk
Reputational risk
Compliance risk
Information security risk (Correct answer)

Correct answer: Information security risk

Unreviewed access logs represent a detective control gap within the information security domain, leaving unauthorized access undetected.

Question 46: When performing a financial health evaluation of a critical vendor, which indicator is MOST concerning for long-term viability?

Revenue grew 5% year-over-year
The vendor carries more debt than equity and has negative cash flow from operations (Correct answer)
The vendor recently completed a Series B funding round
The vendor's gross margin declined by 2% compared to prior year

Correct answer: The vendor carries more debt than equity and has negative cash flow from operations

Negative operating cash flow combined with high leverage signals potential insolvency risk that could disrupt service continuity.

Question 47: In the cultural context of TPRM, what does 'vendor risk fatigue' describe?

Risk teams becoming desensitized to low-severity vendor findings over time
Regulatory bodies reducing enforcement frequency
Vendors refusing to complete risk assessment questionnaires due to their volume and repetitiveness (Correct answer)
Organizations abandoning TPRM programs due to cost

Correct answer: Vendors refusing to complete risk assessment questionnaires due to their volume and repetitiveness

Vendor risk fatigue describes the phenomenon where vendors become overwhelmed by the volume of similar but non-standardized questionnaires from multiple clients, leading to reduced quality and completeness of responses.

Question 48: What does DAST (Dynamic Application Security Testing) assess that SAST (Static Application Security Testing) cannot?

Runtime vulnerabilities in a running application environment (Correct answer)
Developer coding standard compliance
Documentation completeness of API endpoints
Code-level logic errors in uncompiled source code

Correct answer: Runtime vulnerabilities in a running application environment

DAST tests a running application to identify vulnerabilities that only manifest at runtime, such as injection attacks and authentication bypasses, which SAST cannot detect from source code alone.

Question 49: What is the importance of proper labeling in data visualizations?

Labels provide context and prevent misinterpretation of the data (Correct answer)
Labels are optional decorations
Only the chart title matters
Labels make charts look cluttered

Correct answer: Labels provide context and prevent misinterpretation of the data

Clear labeling including titles, axis labels, units, and legends ensures viewers interpret the visualization correctly.

Question 50: Which control is most effective for reducing risk when a vendor has access to your internal network?

Relying on the vendor's own firewall exclusively
Giving the vendor full administrative access for convenience
Allowing vendor access only during business hours without monitoring
Network segmentation and least-privilege access controls (Correct answer)

Correct answer: Network segmentation and least-privilege access controls

Network segmentation limits vendor access to only the systems they need, and least-privilege principles ensure they cannot access unrelated sensitive data or critical infrastructure.

Question 51: What is a key benefit of CPTRP certification to organizations?

Reduces hiring costs for HR.
Boosts software innovation.
Enhances risk management processes (Correct answer)
Minimizes operational expenses.

Correct answer: Enhances risk management processes

CTPRP-certified professionals bring specialized knowledge and best practices in identifying, assessing, mitigating, and monitoring third-party risks. By integrating their expertise, organizations can develop more robust and effective risk management frameworks, leading to better protection against potential threats and improved operational resilience. This directly strengthens the overall risk posture.

Question 52: Which of the following exam domain areas is most likely tested under 'Credential Requirements' topics in the CTPRP exam blueprint?

Professional standards, ethics, and ongoing certification obligations (Correct answer)
Cryptocurrency valuation methodologies
Supply chain logistics optimization
Social media brand management

Correct answer: Professional standards, ethics, and ongoing certification obligations

Professional standards, ethics, and maintenance obligations are the core of credential requirements in any professional certification.

Question 53: Under NY DFS Cybersecurity Regulation (23 NYCRR 500), what is required regarding third-party service providers?

Third-party contracts must not exceed five years in duration
Covered entities must implement written policies governing third-party cybersecurity practices (Correct answer)
Vendors must maintain their own NY DFS licenses
All vendors must be certified by NY DFS directly

Correct answer: Covered entities must implement written policies governing third-party cybersecurity practices

23 NYCRR 500 requires covered entities to implement written policies and procedures designed to ensure the security of information systems accessible to third-party service providers.

Question 54: Which scenario represents the MOST significant vendor governance failure?

A vendor requests a contract amendment to adjust service pricing
A vendor transitions account managers without advance notice
A vendor submits an annual compliance certification two weeks late
A vendor accesses production systems beyond agreed scope without authorization (Correct answer)

Correct answer: A vendor accesses production systems beyond agreed scope without authorization

Unauthorized access to production systems beyond the agreed scope represents a critical security and compliance failure that could trigger regulatory violations and data breach liability.

Question 55: A CTPRP holder presents a session at an industry conference on vendor risk management. How does this typically affect CPE credit eligibility?

Presenting does not qualify; only attending qualifies for CPE credit
Presenting may qualify for CPE credits, often at a higher rate than attendance (Correct answer)
Presenting qualifies only for the first conference in a renewal cycle
Presenting qualifies only if the audience exceeds 100 attendees

Correct answer: Presenting may qualify for CPE credits, often at a higher rate than attendance

Presenting at industry events typically qualifies for CPE credit and is often awarded at a higher rate to recognize preparation and knowledge-sharing effort.

Question 56: Which ethical obligation does a CTPRP professional have when advising a client whose third-party risk practices conflict with industry standards?

Adopt the client's practices to preserve the business relationship
Advise the client of the risks and recommend alignment with best practices (Correct answer)
Remain silent to avoid creating conflict
Immediately report the client to regulatory authorities

Correct answer: Advise the client of the risks and recommend alignment with best practices

CTPRP professionals are ethically obligated to provide honest, competent advice that serves the client's best interests including risk exposure.

Question 57: Which statement about the CTPRP renewal cycle is most accurate?

Renewal requires peer endorsement letters annually
CPE credits accumulated annually maintain the credential without exam retake (Correct answer)
Renewal requires re-taking the full exam every three years
Renewal occurs automatically upon payment of dues

Correct answer: CPE credits accumulated annually maintain the credential without exam retake

CTPRP holders maintain their credential by accumulating CPE credits rather than re-sitting the exam at each renewal.

Question 58: When communicating a vendor's improved risk posture after remediation, what should the TPRM report include?

Only the current risk rating without historical context
Before-and-after risk scores, remediated findings, and any residual or accepted risks (Correct answer)
A statement that all risks have been fully resolved
Vendor marketing materials about their security improvements

Correct answer: Before-and-after risk scores, remediated findings, and any residual or accepted risks

Comparative before-and-after reporting with residual risk documentation provides a complete and accurate picture of the vendor's risk trajectory.

Question 59: How does publication of a TPRM-related article or whitepaper typically affect a CTPRP holder's CPE credits?

Only peer-reviewed academic journal publications qualify
Credits are awarded only if the publication is endorsed by Shared Assessments
Publishing professional content in a relevant field generally qualifies for CPE credits (Correct answer)
Publications are never accepted as CPE activities

Correct answer: Publishing professional content in a relevant field generally qualifies for CPE credits

Publishing professional content relevant to third-party risk management is generally accepted as a CPE-qualifying activity that reflects professional contribution.

Question 60: In TPRM literature, the 'right to audit' clause in a vendor contract primarily serves to:

Limit liability for both parties in the event of a data breach
Enable the vendor to charge additional fees for compliance reviews
Allow the organization to assess the vendor's compliance and controls firsthand (Correct answer)
Restrict the vendor from using subcontractors without approval

Correct answer: Allow the organization to assess the vendor's compliance and controls firsthand

A right-to-audit clause contractually entitles the contracting organization to assess the vendor's controls, processes, and compliance with agreed standards.

Question 61: In the TPRM lifecycle, what is the correct sequence of the initial phases?

Identification → Due diligence → Contracting → Onboarding (Correct answer)
Assessment → Selection → Onboarding → Monitoring
Onboarding → Risk assessment → Contracting → Monitoring
Planning → Identification → Assessment → Selection

Correct answer: Identification → Due diligence → Contracting → Onboarding

The standard TPRM lifecycle begins with identifying the need, conducting due diligence, formalizing the relationship through contracting, and then onboarding the vendor.

Question 62: A CTPRP holder completes an online self-study course on cybersecurity vendor risk. What is the most important step to validate this as a CPE activity?

Convert the hours to credits at a ratio of 2:1
Notify the certifying body within 30 days of completion
Have a supervisor sign off on the learning outcomes
Retain a certificate of completion or other evidence of the activity (Correct answer)

Correct answer: Retain a certificate of completion or other evidence of the activity

Retaining a certificate of completion or equivalent documentation is essential to substantiate self-study CPE activities if audited.

Question 63: Under the OCC's third-party risk management guidance, which activity requires the MOST rigorous due diligence before engagement?

Routine administrative vendor relationships
Critical activities that could harm consumers if the third party fails (Correct answer)
Office supply and facilities management vendors
Technology vendors providing non-core software tools

Correct answer: Critical activities that could harm consumers if the third party fails

OCC guidance requires the most rigorous due diligence for third parties performing critical activities, especially those that could harm consumers or the bank if the arrangement fails.

Question 64: Which phase of the third-party risk lifecycle involves assessing whether a prospective vendor's risk profile is acceptable before contracting?

Contract remediation
Pre-contract due diligence (Correct answer)
Offboarding
Ongoing monitoring

Correct answer: Pre-contract due diligence

Pre-contract due diligence evaluates inherent and residual risk before the organization commits to a vendor relationship.

Question 65: During the creative process of control design for a high-risk vendor, iterative prototyping is valuable because:

It allows testing of control assumptions before full deployment, catching gaps early (Correct answer)
Regulators require iterative design documentation
It delays implementation indefinitely
It replaces the need for vendor cooperation

Correct answer: It allows testing of control assumptions before full deployment, catching gaps early

Iterative prototyping exposes flawed assumptions about control effectiveness before resources are fully committed.

Question 66: A vendor's penetration test report is 18 months old. What is the most appropriate TPRM action?

Request an updated penetration test or risk-accept with compensating controls (Correct answer)
Escalate to the board without further analysis
Terminate the vendor relationship immediately
Accept the report since it was conducted by a reputable firm

Correct answer: Request an updated penetration test or risk-accept with compensating controls

Penetration test results older than 12 months may not reflect current vulnerabilities; requesting updated testing or formally risk-accepting with compensating controls is the appropriate response.

Question 67: Which statement most accurately reflects the ethical obligations of a CTPRP holder when a conflict of interest arises in a vendor assessment?

Keep the conflict confidential to avoid embarrassing the vendor
Delegate the work without disclosing the conflict to management
Proceed with the assessment and disclose the conflict afterward
Disclose the conflict of interest and recuse from the assessment if necessary (Correct answer)

Correct answer: Disclose the conflict of interest and recuse from the assessment if necessary

CTPRP holders must proactively disclose conflicts of interest and recuse themselves from affected assessments to maintain integrity.

Question 68: What does 'vendor offboarding' in a TPRM program primarily ensure?

That the vendor receives a positive reference letter
That the vendor is added to a preferred vendor list for future use
That the vendor's invoices are paid in full before separation
That access is revoked and data is returned or destroyed when a vendor relationship ends (Correct answer)

Correct answer: That access is revoked and data is returned or destroyed when a vendor relationship ends

Vendor offboarding ensures that all system access is terminated, data obligations are fulfilled (returned or securely destroyed), and residual risks are managed when a vendor relationship concludes.

Question 69: Which of the following BEST describes the role of the 'relationship owner' (also called the 'business owner') in a TPRM program?

The CISO responsible for all vendor cybersecurity
The legal team member who drafts contracts
The employee who physically signs vendor invoices
The internal stakeholder accountable for managing the day-to-day vendor relationship and escalating risk issues (Correct answer)

Correct answer: The internal stakeholder accountable for managing the day-to-day vendor relationship and escalating risk issues

The relationship owner is the business-side accountable party who manages operational interactions with the vendor and is responsible for escalating emerging risks.

Question 70: What is a key requirement for third-party risk professionals under CPTRP certification?

Sales and negotiation techniques
Budget management skills
Risk assessment methodologies (Correct answer)
Software development expertise

Correct answer: Risk assessment methodologies

The CTPRP certification focuses on managing risks associated with third-party relationships. Therefore, a core competency for certified professionals is the ability to effectively identify, analyze, and evaluate these risks using established methodologies. This ensures a systematic approach to understanding potential threats and vulnerabilities introduced by third parties.

Question 71: What does 'risk appetite' mean in the context of a TPRM program?

The budget allocated to vendor risk management tools
The level of third-party risk an organization is willing to accept in pursuit of its objectives (Correct answer)
The number of vendors an organization is willing to onboard per year
The vendor's tolerance for audit requests from the client

Correct answer: The level of third-party risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines the boundaries within which an organization is willing to operate regarding third-party risk, guiding decisions about which vendors to engage and what risk levels are acceptable.

Question 72: What is the primary goal of Third-Party Risk Management (TPRM)?

Optimize communication with vendors.
Streamline vendor onboarding processes.
Ensure cost reduction for external vendors.
Identify and mitigate third-party risks. (Correct answer)

Correct answer: Identify and mitigate third-party risks.

The primary goal of Third-Party Risk Management (TPRM) is to proactively identify, assess, and mitigate the risks associated with engaging external vendors, suppliers, and partners. These risks can include cybersecurity breaches, regulatory non-compliance, financial instability, or operational disruptions. TPRM aims to protect the organization from potential harm caused by its third-party relationships.

Question 73: Which US regulatory framework requires organizations to report material cybersecurity incidents involving third parties to the SEC within four business days?

FFIEC IT Examination Handbook
HIPAA Breach Notification Rule
SEC Cybersecurity Disclosure Rules (2023) (Correct answer)
NIST SP 800-53

Correct answer: SEC Cybersecurity Disclosure Rules (2023)

The SEC's 2023 Cybersecurity Disclosure Rules require public companies to disclose material cybersecurity incidents, including those originating from third parties, within four business days.

Question 74: Under the Gramm-Leach-Bliley Act (GLBA), what must financial institutions require from service providers who handle consumer financial data?

Annual charity contributions
A minimum of 500 employees
Proof of ISO 9001 certification
Contractual safeguards and privacy obligations for consumer data (Correct answer)

Correct answer: Contractual safeguards and privacy obligations for consumer data

GLBA's Safeguards Rule requires financial institutions to contractually obligate service providers to implement appropriate safeguards for customer financial data.

Question 75: Which of the following is the BEST reason to include a 'benchmarking' clause in a long-term vendor contract?

To require the vendor to benchmark all employees annually
To allow the vendor to benchmark the organization's internal processes
To establish a baseline for the vendor's marketing spend
To enable the organization to periodically compare vendor pricing and performance against market standards (Correct answer)

Correct answer: To enable the organization to periodically compare vendor pricing and performance against market standards

A benchmarking clause allows the organization to periodically compare the vendor's pricing and service quality against market peers, ensuring ongoing value and competitiveness over the contract's life.

Question 76: Which framework is commonly used for managing third-party risks?

Six Sigma
NIST Cybersecurity Framework (Correct answer)
PMBOK Guide
ISO 9001

Correct answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework is commonly used for managing third-party risks, particularly those related to information security. It provides a flexible, risk-based approach to help organizations assess, manage, and communicate cybersecurity risks, which is critical when dealing with external entities that may access sensitive data or systems. While other frameworks exist, NIST is highly recognized for its comprehensive approach to cybersecurity risk management in third-party contexts.

Question 77: Which element is MOST critical to include in an evaluation scoping document before beginning a vendor assessment?

A list of the vendor's other customers for benchmarking purposes
The systems, data types, and business processes in scope for the engagement (Correct answer)
The vendor's marketing collateral and product roadmap
The evaluator's preferred questionnaire format

Correct answer: The systems, data types, and business processes in scope for the engagement

Defining systems, data types, and processes in scope ensures the evaluation is targeted, relevant, and produces actionable findings.

Question 78: Which metric would be MOST useful to include in a quarterly TPRM dashboard presented to senior management?

The number of high-risk vendors with overdue remediation items (Correct answer)
The average tenure of the TPRM team's analysts
The total number of vendor invoices processed in the quarter
The vendor's employee satisfaction scores from internal surveys

Correct answer: The number of high-risk vendors with overdue remediation items

Senior leadership needs actionable risk intelligence. The number of high-risk vendors with overdue remediation items is a direct indicator of unresolved risk exposure that may require executive escalation or resource allocation. Analyst tenure, invoice volumes, and vendor employee satisfaction do not convey meaningful risk posture to a risk dashboard audience.

Question 79: Which of the following best describes the purpose of the CTPRP CPE requirement?

To align the CTPRP with unrelated financial services regulations
To ensure credential holders stay current with evolving third-party risk practices (Correct answer)
To discourage professionals from maintaining the credential long-term
To generate revenue for the certifying organization

Correct answer: To ensure credential holders stay current with evolving third-party risk practices

CPE requirements ensure that CTPRP holders continuously update their knowledge as the third-party risk landscape changes.

Question 80: What is the CTPRP credential's recertification cycle period?

1 year
3 years (Correct answer)
2 years
5 years

Correct answer: 3 years

The CTPRP credential requires recertification every three years, during which holders must accumulate the required continuing education hours.

Question 81: Under GDPR, when a US company uses a European vendor to process EU personal data, the US company is classified as the:

Joint controller sharing equal liability with the vendor
Data subject with rights to erasure
Data processor with full liability
Data controller responsible for determining processing purposes (Correct answer)

Correct answer: Data controller responsible for determining processing purposes

Under GDPR, the entity that determines the purposes and means of processing personal data is the data controller, which retains ultimate responsibility for compliance.

Question 82: What is the main purpose of an exit strategy or exit plan for a critical vendor?

To prepare the vendor for an acquisition by your organization
To ensure business continuity if the vendor fails, exits the market, or the contract is terminated (Correct answer)
To plan the vendor's retirement from the industry
To document the vendor's succession of account managers

Correct answer: To ensure business continuity if the vendor fails, exits the market, or the contract is terminated

An exit strategy for a critical vendor details how the organization will transition services to maintain continuity if the vendor relationship ends abruptly or is terminated for cause.

Question 83: Which technique is used to detect if a vendor's software supply chain has been compromised by a malicious third-party component?

Annual vendor financial health assessment
Software Composition Analysis (SCA) to identify vulnerable or tampered open-source dependencies (Correct answer)
Review of vendor employee satisfaction surveys
Static code formatting review

Correct answer: Software Composition Analysis (SCA) to identify vulnerable or tampered open-source dependencies

SCA tools scan a vendor's software for known vulnerabilities and licensing issues in open-source and third-party components, detecting supply chain compromise risks.

Question 84: What is typically required to maintain CTPRP certification?

Nothing once initial certification is obtained
Retaking the full certification exam annually
Completing continuing education credits and meeting renewal requirements (Correct answer)
Paying fees without any additional requirements

Correct answer: Completing continuing education credits and meeting renewal requirements

Most certifications require ongoing professional development to ensure practitioners stay current in their field.

Question 85: Which concept describes the scenario where multiple organizations rely on the same critical vendor, creating systemic risk across an entire industry?

Vendor lock-in
Systemic concentration risk (Correct answer)
Cascading dependency failure
Supplier monoculture

Correct answer: Systemic concentration risk

Systemic concentration risk occurs when widespread reliance on a single vendor means that vendor's failure could simultaneously impact numerous organizations across an industry.

Question 86: When a vendor is classified as 'critical,' what additional oversight is typically required beyond standard due diligence?

Enhanced monitoring, executive engagement, and contingency planning (Correct answer)
Monthly marketing meetings
A credit check and insurance verification
Only an annual questionnaire review

Correct answer: Enhanced monitoring, executive engagement, and contingency planning

Critical vendors receive heightened oversight including more frequent assessments, senior-level relationship management, and tested contingency or exit plans due to their impact on business operations.

Question 87: The 'outside view' technique in risk interpretation involves:

Consulting only external consultants for all risk decisions
Reviewing competitor risk reports before forming any view
Using base rates from similar situations to counterbalance overly optimistic inside assessments (Correct answer)
Excluding internal stakeholder input from risk deliberations

Correct answer: Using base rates from similar situations to counterbalance overly optimistic inside assessments

The outside view counteracts inside-view optimism by grounding estimates in empirical base rates from comparable situations.

Question 88: Which governance body within an organization typically holds ultimate accountability for the TPRM program?

The procurement department
The legal and compliance team
The vendor management team
The board of directors or senior executive leadership (Correct answer)

Correct answer: The board of directors or senior executive leadership

Regulatory guidance consistently places ultimate accountability for TPRM program oversight with the board of directors and senior management, not operational teams.

Question 89: How should performance anxiety be managed?

Anxiety should be ignored and suppressed
Through preparation, breathing techniques, and positive mental rehearsal (Correct answer)
By avoiding performances entirely
By taking medication before every performance

Correct answer: Through preparation, breathing techniques, and positive mental rehearsal

Effective management combines thorough preparation with relaxation techniques and positive visualization.

Question 90: A CTPRP holder attends a Shared Assessments annual summit focused on vendor risk trends. Which CPE category does this activity fall under?

Academic coursework in a non-related field
Industry conference attendance relevant to TPRM (Correct answer)
Internal company training on HR policies
Unrelated professional development

Correct answer: Industry conference attendance relevant to TPRM

Attending industry conferences directly related to third-party risk management qualifies as CPE for CTPRP renewal.

Question 91: A risk tiering model classifies vendors as Critical, High, Medium, or Low. Which factor most directly elevates a vendor from Medium to High tier?

The vendor is headquartered outside the United States
The vendor has access to regulated customer data at scale (Correct answer)
The vendor charges more than $500,000 annually
The vendor uses open-source software components

Correct answer: The vendor has access to regulated customer data at scale

Access to regulated customer data at scale significantly increases the potential impact of a vendor incident, driving a higher risk tier.

Question 92: An organization is offboarding a vendor that had access to sensitive customer data. Which action is MOST critical during offboarding?

Updating the vendor's tier classification
Conducting a final invoice reconciliation
Requesting a final SOC 2 report
Confirming data destruction or return and revoking all access credentials (Correct answer)

Correct answer: Confirming data destruction or return and revoking all access credentials

Data disposition and access revocation are the highest-priority security tasks during vendor offboarding to prevent unauthorized data retention or access.

Question 93: Which of the following represents an appropriate use of the CTPRP credential in contract language?

'CTPRP-level services guaranteed' as a general service quality claim
'Our firm holds the CTPRP credential' on behalf of the organization
Listing CTPRP in contract scope without identifying the specific credential holder
'This engagement will be led by a CTPRP-certified professional' naming the individual (Correct answer)

Correct answer: 'This engagement will be led by a CTPRP-certified professional' naming the individual

Contracts may reference a named CTPRP-certified individual as the engagement lead, which accurately and appropriately ties the credential to the specific person.

Question 94: An organization outsources its customer call center to a third party. Which control evaluation area is MOST relevant due to the nature of this engagement?

Social engineering and insider threat controls, along with data handling procedures (Correct answer)
Physical asset management of server hardware
Software development lifecycle security practices
Network perimeter firewall configuration

Correct answer: Social engineering and insider threat controls, along with data handling procedures

Call center environments handle sensitive customer interactions, making them especially susceptible to social engineering and insider data misuse.

Question 95: Which of the following best describes 'reputational risk' in third-party risk management?

The risk of financial losses due to vendor pricing increases
The risk that a vendor's misconduct or failure will damage the organization's public image and stakeholder trust (Correct answer)
The risk that competitors will learn about the organization's vendor relationships
The risk that a vendor will go bankrupt and cease operations

Correct answer: The risk that a vendor's misconduct or failure will damage the organization's public image and stakeholder trust

Reputational risk in TPRM arises when vendor failures, ethical violations, or scandals become associated with the contracting organization, damaging brand trust.

Question 96: A TPRM practitioner is building a vendor inventory. Which data element is MOST essential to capture for every third party?

Number of vendor employees
Vendor's marketing budget
Type and criticality of services provided and data accessed (Correct answer)
Vendor CEO's LinkedIn profile

Correct answer: Type and criticality of services provided and data accessed

Services provided and data accessed directly determine the vendor's risk classification, due diligence requirements, and monitoring frequency.

Question 97: A risk team uses brainstorming sessions with diverse stakeholders to identify overlooked vendor risk scenarios. The primary benefit of stakeholder diversity in this context is:

It distributes accountability for the final risk rating
It satisfies regulatory diversity requirements
Different functional perspectives surface risk scenarios that siloed teams would not generate alone (Correct answer)
Cross-functional brainstorming always produces lower risk scores

Correct answer: Different functional perspectives surface risk scenarios that siloed teams would not generate alone

Diverse perspectives from legal, IT, operations, and finance reveal blind spots that any single team's frame of reference would miss.

Question 98: What is the key purpose of a right-to-audit clause in a vendor contract?

To permit third-party auditors to review the client's own employees
To authorize government regulators to inspect vendor facilities on behalf of the client
To give the vendor the right to audit the client's financials
To allow the client organization to audit the vendor's controls and compliance (Correct answer)

Correct answer: To allow the client organization to audit the vendor's controls and compliance

A right-to-audit clause contractually reserves the client's ability to conduct or commission audits of the vendor's controls, ensuring ongoing accountability beyond self-attestation.

Question 99: What distinguishes 'due diligence' from 'due care' in the context of third-party risk management?

Due care involves legal review; due diligence involves financial review only
Due diligence is the investigative process of assessing risk; due care is the ongoing effort to maintain appropriate standards (Correct answer)
Due diligence applies to vendors; due care applies only to internal staff
Due diligence is ongoing; due care is a one-time assessment at onboarding

Correct answer: Due diligence is the investigative process of assessing risk; due care is the ongoing effort to maintain appropriate standards

Due diligence refers to the upfront investigation to understand a vendor's risk profile, while due care is the continuous responsibility to act prudently in managing those risks over time.

Question 100: Which monitoring approach is MOST appropriate for a critical vendor providing core payment processing services?

Continuous automated monitoring supplemented by periodic on-site assessments (Correct answer)
Monitoring only when contractual SLAs are reported as breached
Annual self-assessment questionnaire with no follow-up validation
Biennial document review conducted by a junior analyst

Correct answer: Continuous automated monitoring supplemented by periodic on-site assessments

Critical vendors warrant the most rigorous monitoring. Combining automated, real-time signals (e.g., threat intelligence feeds, uptime monitoring) with periodic deeper assessments — including on-site reviews — provides the layered assurance appropriate for high-risk, high-criticality relationships. Annual self-assessments alone are insufficient for critical vendors.

CTPRP (Certified Third-Party Risk Professional) Exam

The CTPRP exam is administered by the Shared Assessments Program and is designed for professionals involved in third-party risk management and vendor governance. The exam covers third-party risk assessment, due diligence, regulatory compliance, vendor governance, and professional standards. Candidates must demonstrate knowledge of industry frameworks including SIG, CAIQ, and ISO 27001. The exam consists of approximately 100 questions with a passing score of 70%.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds