Shared Assessments Certified Third-Party Risk Professional CTPRP Exam Questions

Answer : D

Multi-factor authentication (MFA) is an electronic authentication method that requires a user to present two or more pieces of evidence (or factors) to an authentication mechanism. The factors can be something the user knows (such as a password or a PIN), something the user has (such as a smartphone or a security token), or something the user is (such as a fingerprint or a facial recognition). MFA enhances the security of online accounts and applications by making it harder for attackers to gain access with stolen or guessed credentials. MFA is recommended as a best practice for third-party risk management, as it can reduce the risk of unauthorized access, data breaches, and identity theft. MFA is also a requirement for some regulatory standards and frameworks, such as PCI DSS, HIPAA, and NIST 800-63.Reference:

What is: Multifactor Authentication

Set up your Microsoft 365 sign-in for multi-factor authentication

Multi-factor authentication - Wikipedia

Shared Assessments CTPRP Study Guide, page 19

Shared Assessments CTPRP Job Guide, page 14

Best Practices Guidance for Third Party Risk, page 9

Answer : D

This statement is false because network connectivity or remote access may trigger a higher vendor risk classification for any third party that has access to the organization's network, systems, or data, regardless of whether they process personal information or not. Network connectivity or remote access increases the exposure of the organization to cyberattacks, data breaches, or unauthorized access by malicious actors. Therefore, the organization should assess the security controls and practices of the third party, such as encryption, authentication, firewall, antivirus, and patch management, to ensure that they meet the organization's standards and expectations. The organization should also monitor the network activity and performance of the third party, and establish clear policies and procedures for granting, revoking, or modifying access rights. The other statements (A, B, and C) are true regarding the primary factors in determining vendor risk classification, as they reflect the potential impact, likelihood, and severity of the risks associated with the vendor's location, importance, and data processing.Reference:

Impact of Risk Attributes on Vendor Risk Assessment and Classification, SSRN

Guide to Vendor Risk Assessment, Smartsheet

How Do You Determine Vendor Criticality?, UpGuard

Answer : B

This statement does not reflect current practice in addressing fourth party risk or subcontracting risk because it is not sufficient to rely on external audit reports alone. Outsourcers should also perform their own due diligence and monitoring of the subcontractors, as well as ensure that the third party has a robust TPRM program in place. External audit reports may not cover all the relevant aspects of subcontracting risk, such as data security, compliance, performance, and quality. Moreover, external audit reports may not be timely, accurate, or consistent, and may not reflect the current state of the subcontractor's operations. Therefore, outsourcers should adopt a more proactive and comprehensive approach to managing subcontracting risk, rather than relying on external audit reports.Reference:

Shared Assessments Program, page 13: ''Outsourcers should not rely solely on external audit reports to address subcontracting risk. Outsourcers should also inspect the vendor's TPRM program and require evidence of the assessments of subcontractors.''

Five Best Practices to Manage and Control Third-Party Risk, page 3: 'Restricting privileged accounts

Answer : B

The most important factor when scoping assessments of cloud-based third parties that access, process, and retain personal data is to identify the type of cloud hosting deployment or service model. This is because different cloud models have different implications for the allocation of security responsibilities between the third party and the cloud hosting provider. For example, in a Software as a Service (SaaS) model, the cloud provider is responsible for most of the security controls, while in an Infrastructure as a Service (IaaS) model, the third party is responsible for securing its own data and applications. Therefore, it is essential to understand the type of cloud model and the corresponding security roles and responsibilities before conducting an assessment. This will help to avoid gaps, overlaps, or conflicts in security controls and expectations.Reference:

Guidance on Cloud Security Assessment and Authorization - ITSP.50.105, Canadian Centre for Cyber Security, May 2020, Section 2.1.1

The Importance of Properly Scoping Cloud Environments, PCI Security Standards Council and Cloud Security Alliance, August 2021

Third party and cloud: Regulatory challenges, KPMG, 2022, Section 2.1

Certified Third Party Risk Professional (CTPRP) Study Guide, Shared Assessments, 2021, Section 4.2.2

Answer : B

An organization's Ethics and Code of Conduct Program is a set of policies, procedures, and practices that define the expected standards of behavior and ethical values for all employees and stakeholders. A key component of such a program is a disciplinary process that outlines the consequences and actions for violating the code of conduct or any other relevant policies. A disciplinary process helps to enforce the code of conduct, deter unethical behavior, and protect the organization's reputation and integrity. A disciplinary process should include clear criteria for determining the severity and frequency of violations, the roles and responsibilities of the parties involved, the steps and timelines for investigation and resolution, and the range of sanctions and remedies available. A disciplinary process should also be fair, consistent, transparent, and respectful of the rights and dignity of the accused and the accuser. A disciplinary process may involve formal termination or change of status of the employee, depending on the nature and impact of the violation. Therefore, option B is a correct component of an organization's Ethics and Code of Conduct Program.

The other options are not necessarily components of an Ethics and Code of Conduct Program, although they may be related or supportive of it. Option A, participation in the company's annual privacy awareness program, is more likely to be a component of a Privacy Program, which is a specific area of ethics and compliance that deals with the protection and use of personal information. Option C, signing acknowledgement of Acceptable Use policy for use of company assets, is more likely to be a component of an Information Security Program, which is another specific area of ethics and compliance that deals with the safeguarding and management of data and systems. Option D, a process to conduct periodic access reviews of critical Human Resource files, is more likely to be a component of an Internal Control Program, which is a general area of ethics and compliance that deals with the design and implementation of controls to ensure the reliability and accuracy of financial and operational information.Reference:

1: Creating an Effective Code of Conduct (and Code Program) - Corporate Compliance Insights

2: Code of Conduct & Ethics (Examples and Best Practices) - Status.net

3: Why Have a Code of Conduct - Free Ethics & Compliance Toolkit

4: ''Code of Ethics'' and ''Code of Conduct'' - GeeksforGeeks

5: Six Tips on How to Implement a Strong Ethics Program - KnowledgeLeader

Answer : A

A Zero Trust approach to access management is based on the principle of verifying every access request as if it originates from an open network, regardless of the source, destination, or context. This means that no implicit trust is granted based on network location, user identity, or device status. Instead, every access request is evaluated based on multiple factors, such as user credentials, device health, data sensitivity, and threat intelligence.A Zero Trust approach also requires that all communication is encrypted and protected, and that access is granted on a per session basis with the least privilege principle123.

Utilizing a solution that allows direct access by third parties to the organization's network does not reflect a Zero Trust approach, because it implies that the network perimeter is a reliable boundary for security and trust. This assumption is risky, because it exposes the organization to potential breaches and attacks from compromised or malicious third parties, who may have access to sensitive data and resources without proper verification or protection.A Zero Trust approach would require that third parties use secure and isolated channels to access the organization's network, such as VPNs, proxies, or gateways, and that their access is monitored and controlled based on granular policies and conditions123.Reference:

Zero Trust part 1: Identity and access management

Zero Trust Model - Modern Security Architecture | Microsoft Security

Zero Trust identity and access management development best practices ...

Answer : B

The concept of least privilege is a security principle that requires giving each user, service, and application only the permissions needed to perform their work and no more12.It is one of the most important concepts in network and system security, as it reduces the attack surface and the risk of unauthorized access, data breaches, and malware infections12. The statement B best describes this concept, as it implies that the vendor follows the principle of least privilege by granting people access to the minimum necessary to do their job. The other statements do not capture the essence of the concept, as they either describe other security practices (such as dual authorization and separation of duties) or limit the scope of the concept to a specific type of access (such as root and administrator access).

1: 9 Ways to Prevent Third-Party Data Breaches in 2024 | UpGuard

2: Best Practice Guide to Implementing the Least Privilege Principle - Netwrix