CTPRP Evaluation Details 3

Question 1

A financial institution is evaluating a SaaS vendor that processes payment card data. Which framework should guide the evaluation's control requirements?

Accepted Answer

PCI DSS

Answer

PCI DSS establishes specific security requirements for entities that process, store, or transmit payment card data.

Question 2

When performing a financial health evaluation of a critical vendor, which indicator is MOST concerning for long-term viability?

Accepted Answer

The vendor carries more debt than equity and has negative cash flow from operations

Answer

Negative operating cash flow combined with high leverage signals potential insolvency risk that could disrupt service continuity.

Question 3

Which of the following BEST describes the purpose of a right-to-audit clause in a third-party contract?

Accepted Answer

It grants the organization the contractual right to inspect the vendor's facilities and records

Answer

A right-to-audit clause gives the organization contractual authority to verify vendor controls through direct inspection when needed.

Question 4

During evaluation, a vendor reports its RTO for critical systems is 4 hours but cannot produce a recent business continuity test report. What should the evaluator conclude?

Accepted Answer

The RTO is unverified and the evaluator should treat it as a gap

Answer

An untested RTO is an aspirational target, not validated capability; the evaluator must treat this as a gap requiring remediation evidence.

Question 5

A vendor provides a penetration test report conducted by its internal security team. Why might an evaluator give this less weight than an external pen test?

Accepted Answer

Internal testers may have conflicts of interest that limit objectivity and scope

Answer

Internal testers may unconsciously limit scope or soften findings to protect internal relationships, reducing the independence and credibility of the assessment.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Evaluation Details 3