CTPRP Theory and Fundamentals 5

Question 1

Which of the following scenarios best illustrates 'operational risk' arising from a third-party relationship?

Accepted Answer

A vendor's data center outage causes the organization's customer-facing systems to go offline

Answer

Operational risk from third parties manifests when vendor failures in processes, systems, or people directly disrupt the organization's own operations.

Question 2

What is the purpose of a 'vendor exit strategy' or 'termination plan' in TPRM?

Accepted Answer

To ensure continuity of operations and secure data return or destruction if the vendor relationship ends

Answer

A vendor exit strategy ensures the organization can transition services smoothly, recover its data, and maintain business continuity regardless of why the relationship ends.

Question 3

In TPRM, what is the role of a 'key risk indicator' (KRI)?

Accepted Answer

A forward-looking metric that signals increasing risk before an adverse event happens

Answer

KRIs are leading indicators that provide early warning signals of rising risk exposure, enabling proactive intervention before risks materialize into losses.

Question 4

Which principle of information security is most directly threatened when a vendor shares an organization's data with unauthorized subcontractors?

Accepted Answer

Confidentiality

Answer

Unauthorized disclosure of data to subcontractors violates confidentiality, the principle requiring that information is accessible only to those authorized to access it.

Question 5

What is the primary distinction between a 'questionnaire-based assessment' and an 'on-site assessment' in vendor due diligence?

Accepted Answer

Questionnaires rely on vendor self-attestation; on-site assessments allow direct verification of controls

Answer

Questionnaires depend on the vendor's own representations, while on-site assessments enable direct observation and testing of whether stated controls actually exist and function.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Theory and Fundamentals 5