Technical Skills Development Flashcards

Which framework is most commonly used to assess the cybersecurity posture of third-party vendors in the US financial sector?

Answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework is widely adopted in the US financial sector to evaluate and communicate cybersecurity risk with third-party vendors.

A vendor stores client data on servers located in a country with weak data privacy laws. What technical control best mitigates this risk?

Answer: End-to-end encryption with client-managed keys

End-to-end encryption with client-managed keys ensures data remains protected even if the host country's legal environment allows government access.

In third-party risk management, what does a SOC 2 Type II report primarily assess?

Answer: Operational effectiveness of controls over a defined period

A SOC 2 Type II report evaluates whether a service organization's controls related to security, availability, and confidentiality operated effectively over a review period.

What is the primary purpose of a vendor's System and Organization Controls (SOC) report in TPRM due diligence?

Answer: To provide independent assurance on internal controls

SOC reports provide third-party auditor assurance on the design and operating effectiveness of a vendor's internal controls.

Which technical skill is essential when reviewing a vendor's API security to prevent unauthorized data access?

Answer: Evaluating OAuth 2.0 and token-based authentication implementations

OAuth 2.0 and proper token management are foundational API security controls that prevent unauthorized access to data shared between systems.

A TPRM analyst is reviewing a vendor's patch management policy. What is the most critical metric to evaluate?

Answer: Mean time to patch critical vulnerabilities

Mean time to patch critical vulnerabilities directly measures the vendor's ability to reduce exposure windows after a CVE is published.

When assessing a cloud service provider's data segregation practices, which technical control confirms that one client's data cannot be accessed by another?

Answer: Multi-tenant logical isolation with virtual private clouds

Logical isolation using virtual private clouds or similar segmentation ensures tenant data is separated and inaccessible across the shared infrastructure.