GRC Third-Party Risk Management 5

Question 1

Which of the following BEST describes vendor concentration risk in a supply chain context?

Accepted Answer

Over-reliance on a single geographic region, vendor, or technology that creates systemic vulnerability

Answer

Vendor concentration risk arises when an organization depends too heavily on one source, geography, or platform, making it vulnerable to widespread disruption if that source fails.

Question 2

A financial institution uses a TPRM program to comply with OCC Bulletin 2013-29. This guidance primarily addresses:

Accepted Answer

Risk management expectations for third-party relationships in banking

Answer

OCC Bulletin 2013-29 establishes comprehensive third-party risk management expectations for national banks, covering due diligence, contract provisions, and oversight.

Question 3

When assessing a cloud service provider, which security framework attestation is MOST relevant for evaluating data protection and availability controls?

Accepted Answer

SOC 2 Trust Services Criteria (Security, Availability, Confidentiality)

Answer

SOC 2 evaluates cloud provider controls against Trust Services Criteria including Security, Availability, and Confidentiality — the most relevant domains for data protection.

Question 4

Which activity should occur BEFORE a new high-risk vendor is granted access to production systems?

Accepted Answer

Completion of due diligence, contract execution, and security control validation

Answer

High-risk vendors must pass due diligence, have a signed contract with required provisions, and demonstrate effective security controls before accessing production environments.

Question 5

An organization's TPRM policy requires vendors with access to PII to complete an annual security questionnaire. A vendor refuses to complete it. What is the BEST course of action?

Accepted Answer

Escalate the issue; consider requiring an independent audit or terminating the relationship if the vendor remains non-compliant

Answer

Non-compliance with assessment requirements is a material risk issue that should be escalated; the organization may need to enforce contractual remedies or exit the relationship.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Third-Party Risk Management 5