Question 1

Which statement is TRUE regarding the use of questionnaires in third party risk assessments?

Options :

A : The total number of questions included in the questionnaire assigns the risk tier

B : Questionnaires are optional since reliance on contract terms is a sufficient control

C :

Assessment questionnaires should be configured based on the risk rating and type of service being evaluated

D : All topic areas included in the questionnaire require validation during the assessment

Answer: C

Question 2

Which statement BEST reflects the factors that help you determine the frequency of cyclical assessments?

Options :

A :

Vendor assessments should be conducted during onboarding and then be replaced by continuous monitoring

B :

Vendor assessment frequency should be based on the level of risk and criticality of the vendor to your operations as determined by their vendor risk score

C : Vendor assessments should be scheduled based on the type of services/products provided

D : Vendor assessment frequency may need to be changed if the vendor has disclosed a data breach

Answer: B

Question 3

When defining due diligence requirements for the set of vendors that host web applications which of the

following is typically NOT part of evaluating the vendor's patch

management controls?

Options :

A : The capability of the vendor to apply priority patching of high-risk systems

B : Established procedures for testing of patches, service packs, and hot fixes prior to installation

C : A documented process to gain approvals for use of open source applications

D : The existence of a formal process for evaluation and prioritization of known vulnerabilities

Answer: C

Question 4

Which of the following statements is FALSE about Data Loss Prevention Programs?

Options :

A :

DLP programs include the policy, tool configuration requirements, and processes for the identification, blocking or monitoring of data

B : DLP programs define the consequences for non-compliance to policies

C : DLP programs define the required policies based on default tool configuration

D : DLP programs include acknowledgement the company can apply controls to remove any data

Answer: C

Question 5

Which of the following factors is LEAST likely to trigger notification obligations in incident response?

Options :

A : Regulatory requirements

B : Data classification or sensitivity

C : Encryption of data

D : Contractual terms

Answer: C

Confidently Practice Online with Free CTPRP Exam Cram

Buying Options: