CTPRP Technical Skills Development 3

Question 1

A vendor's penetration test report is 18 months old. What is the most appropriate TPRM action?

Accepted Answer

Request an updated penetration test or risk-accept with compensating controls

Answer

Penetration test results older than 12 months may not reflect current vulnerabilities; requesting updated testing or formally risk-accepting with compensating controls is the appropriate response.

Question 2

Which tool category is most useful for continuous monitoring of a third party's external attack surface?

Accepted Answer

Cyber ratings and external threat intelligence tools

Answer

Cyber ratings platforms (e.g., BitSight, SecurityScorecard) continuously scan external-facing vendor assets to provide real-time risk signals.

Question 3

What does 'data minimization' mean in the context of evaluating a vendor's data handling practices?

Accepted Answer

Collecting and retaining only the data necessary for the specified purpose

Answer

Data minimization is a core privacy principle requiring organizations to limit data collection and retention to what is strictly necessary for the defined purpose.

Question 4

An organization discovers a critical CVE affecting software used by a key vendor. What is the FIRST technical step in the TPRM response?

Accepted Answer

Contact the vendor to determine if they are affected and their remediation timeline

Answer

The first step is confirming whether and how the vendor is impacted, enabling an informed risk decision before taking operational or contractual action.

Question 5

Which encryption standard is currently considered the minimum acceptable for protecting sensitive data in transit when transmitted by a third party?

Accepted Answer

TLS 1.2 or higher

Answer

TLS 1.2 and TLS 1.3 are the current industry-accepted minimum standards; older protocols like SSL 3.0 and TLS 1.0/1.1 have known vulnerabilities and are deprecated.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Technical Skills Development 3