Free Practice Shared Assessments CTPRP Exam Questions 2025

Stay ahead with 100% Free Certified Third-Party Risk Professional (CTPRP) CTPRP Dumps Practice Questions

Page: 1 / 26

Total 126 Questions | Updated On: Apr 10, 2025

Add To Cart

Question 1

Which statement is TRUE regarding the use of questionnaires in third party risk assessments?

A : The total number of questions included in the questionnaire assigns the risk tier

B : Questionnaires are optional since reliance on contract terms is a sufficient control

C : Assessment questionnaires should be configured based on the risk rating and type of service being evaluated

D : All topic areas included in the questionnaire require validation during the assessment

Answer: C

Question 2

When defining due diligence requirements for the set of vendors that host web applications which of the

following is typically NOT part of evaluating the vendor's patch

management controls?

A : The capability of the vendor to apply priority patching of high-risk systems

B : Established procedures for testing of patches, service packs, and hot fixes prior to installation

C : A documented process to gain approvals for use of open source applications

D : The existence of a formal process for evaluation and prioritization of known vulnerabilities

Answer: C

Question 3

Which type of contract provision is MOST important in managing Fourth-Nth party risk after contract signing and on-boarding due diligence is complete?

A : Subcontractor notice and approval

B : Indemnification and liability

C : Breach notification

D : Right to audit

Answer: A

Question 4

Which of the following factors is LEAST likely to trigger notification obligations in incident response?

A : Regulatory requirements

B : Data classification or sensitivity

C : Encryption of data

D : Contractual terms

Answer: C

Question 5

Which statement is TRUE regarding artifacts reviewed when assessing the Cardholder Data Environment (CDE) in payment card processing?

A : The Data Security Standards (DSS) framework should be used to scope the assessment

B : The Report on Compliance (ROC) provides the assessment results completed by a qualified security assessor that includes an onsite audit

C : The Self-Assessment Questionnaire (SAQ) provides independent testing of controls

D : A System and Organization Controls (SOC) report is sufficient if the report addresses the same location

Answer: B

Page: 1 / 26

Total 126 Questions | Updated On: Apr 10, 2025

Add To Cart