CTPRP Evaluation Details 2

Question 1

Which evaluation methodology best supports continuous monitoring of a third party's control environment between annual assessments?

Accepted Answer

Automated control testing and real-time risk indicator feeds

Answer

Automated control testing and real-time risk indicators enable continuous visibility without the cost of repeated full audits.

Question 2

A vendor's SOC 2 Type II report covers a 6-month period ending 9 months ago. What is the primary concern for a risk evaluator?

Accepted Answer

The report is stale and may not reflect current controls

Answer

A report that is 9 months old may not capture control changes made since the coverage period, creating a gap in assurance.

Question 3

During an on-site evaluation, an assessor discovers that access control logs exist but are never reviewed. Which risk domain does this finding primarily affect?

Accepted Answer

Information security risk

Answer

Unreviewed access logs represent a detective control gap within the information security domain, leaving unauthorized access undetected.

Question 4

When evaluating a fourth-party (subcontractor of a vendor), the MOST appropriate first step is to:

Accepted Answer

Review the vendor's own third-party risk program and subcontractor inventory

Answer

Reviewing the vendor's own TPRM program and subcontractor inventory establishes concentration risk visibility before deciding if direct engagement is warranted.

Question 5

A risk tiering model classifies vendors as Critical, High, Medium, or Low. Which factor most directly elevates a vendor from Medium to High tier?

Accepted Answer

The vendor has access to regulated customer data at scale

Answer

Access to regulated customer data at scale significantly increases the potential impact of a vendor incident, driving a higher risk tier.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Evaluation Details 2