CTPRP Regulatory Compliance and Vendor Governance 5

Question 1

Which of the following BEST describes 'concentration risk' in third-party risk management?

Accepted Answer

Over-reliance on a limited number of vendors for critical functions, creating systemic vulnerability

Answer

Concentration risk refers to the systemic vulnerability created when an organization over-relies on a single or few vendors for critical functions, meaning one failure affects multiple operations.

Question 2

Under NY DFS Cybersecurity Regulation (23 NYCRR 500), what is required regarding third-party service providers?

Accepted Answer

Covered entities must implement written policies governing third-party cybersecurity practices

Answer

23 NYCRR 500 requires covered entities to implement written policies and procedures designed to ensure the security of information systems accessible to third-party service providers.

Question 3

A vendor's Business Continuity Plan (BCP) should be reviewed by the contracting organization primarily to:

Accepted Answer

Ensure the vendor can maintain services during disruptions in alignment with the organization's RTO/RPO

Answer

Reviewing a vendor's BCP ensures their recovery time objectives (RTO) and recovery point objectives (RPO) are compatible with the contracting organization's own continuity requirements.

Question 4

Which scenario represents the MOST significant vendor governance failure?

Accepted Answer

A vendor accesses production systems beyond agreed scope without authorization

Answer

Unauthorized access to production systems beyond the agreed scope represents a critical security and compliance failure that could trigger regulatory violations and data breach liability.

Question 5

In the context of TPRM, 'inherent risk' is BEST defined as:

Accepted Answer

The risk exposure before any mitigating controls are considered

Answer

Inherent risk represents the level of risk that exists in a vendor relationship based on factors like data access, criticality, and geography before any controls or mitigations are applied.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Regulatory Compliance and Vendor Governance 5