CTPRP Theory and Fundamentals 3

Question 1

Which risk domain is MOST directly affected when a third party has access to an organization's personally identifiable information (PII)?

Accepted Answer

Information security and privacy risk

Answer

Third-party access to PII primarily triggers information security and privacy risk, governed by regulations such as GDPR, CCPA, and HIPAA.

Question 2

What is 'residual risk' in the context of third-party risk management?

Accepted Answer

Risk remaining after controls and mitigations have been applied

Answer

Residual risk is the exposure that persists after all risk mitigation controls, contractual protections, and compensating measures have been implemented.

Question 3

Which element of third-party contracts is specifically designed to protect the organization if the vendor's practices cause regulatory penalties?

Accepted Answer

Indemnification clause

Answer

Indemnification clauses require the vendor to compensate the organization for losses, including regulatory fines, resulting from the vendor's failures or misconduct.

Question 4

What is the primary goal of vendor tiering in a TPRM program?

Accepted Answer

To prioritize oversight resources based on the level of risk each vendor poses

Answer

Vendor tiering allocates risk management resources proportionally, applying the most rigorous oversight to high-risk vendors and lighter-touch processes to low-risk ones.

Question 5

In TPRM theory, what does 'fourth-party risk' specifically refer to?

Accepted Answer

Risk arising from subcontractors or service providers used by your direct vendors

Answer

Fourth-party risk refers to the exposure created by subcontractors, sub-processors, and suppliers engaged by your direct (third-party) vendors.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Theory and Fundamentals 3