CTPRP Technical Skills Development 2

Question 1

Which framework is most commonly used to assess the cybersecurity posture of third-party vendors in the US financial sector?

Accepted Answer

NIST Cybersecurity Framework

Answer

The NIST Cybersecurity Framework is widely adopted in the US financial sector to evaluate and communicate cybersecurity risk with third-party vendors.

Question 2

A vendor stores client data on servers located in a country with weak data privacy laws. What technical control best mitigates this risk?

Accepted Answer

End-to-end encryption with client-managed keys

Answer

End-to-end encryption with client-managed keys ensures data remains protected even if the host country's legal environment allows government access.

Question 3

In third-party risk management, what does a SOC 2 Type II report primarily assess?

Accepted Answer

Operational effectiveness of controls over a defined period

Answer

A SOC 2 Type II report evaluates whether a service organization's controls related to security, availability, and confidentiality operated effectively over a review period.

Question 4

What is the primary purpose of a vendor's System and Organization Controls (SOC) report in TPRM due diligence?

Accepted Answer

To provide independent assurance on internal controls

Answer

SOC reports provide third-party auditor assurance on the design and operating effectiveness of a vendor's internal controls.

Question 5

Which technical skill is essential when reviewing a vendor's API security to prevent unauthorized data access?

Accepted Answer

Evaluating OAuth 2.0 and token-based authentication implementations

Answer

OAuth 2.0 and proper token management are foundational API security controls that prevent unauthorized access to data shared between systems.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Technical Skills Development 2