お手軽CTPRP問題集PDFのベスト問題集を使おう！高得点目指すならここ [Q55-Q77]

お手軽CTPRP問題集PDFのベスト問題集を使おう！高得点目指すならここ

Third Party Risk Management CTPRP試験と認定テストエンジン

質問 # 55
Which statement provides the BEST description of inherent risk?

• A. Inherent risk is the level of risk that exists with all of the necessary controls in place
• B. Inherent risk is the level of risk triggered by outsourcing & product or service
• C. inherent risk is the amount of risk an organization can incur when there is an absence of controls
• D. Inherent risk is the amount of risk an organization can accept based on their risk tolerance

正解：C

解説：
Inherent risk refers to the level of risk that exists in the absence of any controls or mitigation measures. It represents the natural exposure to risk in operations, transactions, or activities without considering the effectiveness of any risk management practices. In the context of Third-Party Risk Management (TPRM), inherent risk assesses the potential for loss or adverse outcomes associated with a third-party relationship before any controls or risk treatments are applied. Understanding inherent risk is crucial for organizations to identify where controls are necessary and to prioritize risk management efforts based on the potential impact and likelihood of different risks. This concept is foundational in risk management frameworks and is used to guide the development and implementation of controls to reduce risk to an acceptable level, aligned with the organization's risk appetite and tolerance.
References:
* Risk management standards such as ISO 31000 (Risk Management - Guidelines) provide a framework for assessing and managing inherent risks, emphasizing the importance of understanding the baseline level of risk in decision-making processes.
* The "Third-Party Risk Management Guide" by ISACA outlines best practices for assessing inherent risks in third-party relationships, highlighting the need to evaluate the nature and scope of third-party engagements to determine the baseline risk exposure.

質問 # 56
Which type of contract termination is MOST likely to occur after failure to remediate assessment findings?

• A. Normal termination
• B. Termination for cause
• C. Termination for convenience
• D. Regulatory/supervisory termination

正解：B

解説：
Termination for cause is the type of contract termination that is most likely to occur after failure to remediate assessment findings. This is because termination for cause is based on a breach of contract by the third-party, such as non-compliance, poor performance, fraud, or misconduct. Failure to remediate assessment findings indicates that the third-party has not met the contractual obligations or expectations of the entity, and thus exposes the entity to increased risk and liability. Termination for cause allows the entity to end the contract immediately or after a notice period, and to seek damages or remedies from the third-party. Termination for cause is different from other types of contract termination, such as:
* Regulatory/supervisory termination, which is triggered by a change in law or regulation that affects the legality or feasibility of the contract.
* Termination for convenience, which is exercised by the entity without any fault or breach by the third-party, usually for strategic or operational reasons.
* Normal termination, which is the natural expiration of the contract term or the completion of the contract scope. References:
* Shared Assessments. (2020). Certified Third Party Risk Professional (CTPRP) Study Guide1
* Fusion Risk Management. (2021). Exit Strategy for Terminating a Third Party2
* Volkov, M. (2016). Third-Party Risk Management - Part 2: Contract Termination3

質問 # 57
Which action statement BEST describes an assessor calculating residual risk?

• A. The assessor adjusts the vendor risk rating prior to reporting the findings to the business unit
• B. The assessor adjusts the vendor risk rating based on changes to the risk level after analyzing the findings and mitigating controls
• C. The business unit closes out the finding prior to the assessor submitting the final report
• D. The assessor recommends implementing continuous monitoring for the next 18 months

正解：B

解説：
When calculating residual risk, the best practice for an assessor is to adjust the vendor risk rating based on the changes to the risk level after analyzing the findings and considering the effectiveness of mitigating controls.
Residual risk refers to the level of risk that remains after controls are applied to mitigate the initial (inherent) risk. By evaluating the findings from a third-party assessment and factoring in the mitigating controls implemented by the vendor, the assessor can more accurately determine the remaining risk level. This adjusted risk rating provides a more realistic view of the vendor's risk profile, aiding in informed decision-making regarding risk management and vendor oversight.
References:
* The concept of residual risk calculation is discussed in risk management frameworks such as ISO 31000 (Risk Management - Guidelines), which guides the assessment and treatment of risks.
* The "Third-Party Risk Management Guide" by ISACA outlines the process of assessing and managing risks associated with third parties, including the calculation of residual risk.

質問 # 58
Which example of a response to external environmental factors is LEAST likely to be managed directly within the BCP or IT DR plan?

• A. Response to a large scale illness or health outbreak
• B. Protocols for social media channels and PR communication
• C. Dependency on key employee or supplier issues
• D. Response to a natural or man-made disruption

正解：B

解説：
A BCP or IT DR plan is a set of procedures and actions that an organization takes to ensure the continuity and recovery of its critical business functions and IT systems in the event of a disruption. A BCP or IT DR plan typically covers the following aspects12:
* Identification and prioritization of critical business functions and IT systems
* Assessment and mitigation of risks and threats to the organization
* Allocation and mobilization of resources and personnel
* Communication and coordination with internal and external stakeholders
* Testing and updating of the plan
Among the four examples of a response to external environmental factors, protocols for social media channels and PR communication are the least likely to be managed directly within the BCP or IT DR plan. This is because social media and PR communication are not critical business functions or IT systems that need to be restored or maintained during a disruption. They are rather supplementary tools that can be used to inform and engage with the public, customers, partners, and media about the organization's situation and actions3.
Therefore, protocols for social media and PR communication are more likely to be part of a crisis communication plan, which is a separate but related document that outlines the strategies and tactics for communicating with various audiences during a crisis.
The other three examples are more likely to be managed directly within the BCP or IT DR plan, as they directly affect the organization's ability to perform its critical business functions and IT systems. For instance, a response to a natural or man-made disruption would involve activating the BCP or IT DR plan, assessing the impact and extent of the damage, deploying backup and recovery solutions, and restoring normal operations as soon as possible. A response to a dependency on key employee or supplier issues would involve identifying and managing the single points of failure, implementing contingency plans, and ensuring the availability and redundancy of essential skills and resources. A response to a large scale illness or health outbreak would involve implementing health and safety measures, enabling remote work arrangements, and ensuring the resilience and continuity of the workforce. References:
* Business continuity vs. disaster recovery: Which plan is right ... - IBM
* Business Continuity vs Disaster Recovery: What's The Difference?
* Disaster recovery plan vs. business continuity plan: Is there a difference?
* [Crisis Communication Plan: A PR Blue Print by Sandra K. Clawson Freeo]
* [Disaster Recovery Planning (DRP) | Business Continuity Plan (BCP) | Disaster Recovery Journal]
* [Managing Third Party Risk in a Disrupted World]
* [Business Continuity Planning for a Pandemic]

質問 # 59
At which level of reporting are changes in TPRM program metrics rare and exceptional?

• A. Risk committee
• B. Board of Directors
• C. Executive management
• D. Business unit

正解：B

解説：
TPRM program metrics are the indicators that measure the performance, effectiveness, and maturity of the TPRM program. They help to monitor and communicate the progress, achievements, and challenges of the TPRM program to various stakeholders, such as business units, executive management, risk committees, and board of directors. However, the level of reporting and the frequency of changes in TPRM program metrics vary depending on the stakeholder's role, responsibility, and interest123:
* Business unit: This level of reporting is focused on the operational aspects of the TPRM program, such as the status of vendor assessments, remediation actions, issues, and incidents. The changes in TPRM program metrics at this level are frequent and granular, as they reflect the day-to-day activities and outcomes of the TPRM program.
* Executive management: This level of reporting is focused on the strategic aspects of the TPRM program, such as the alignment with the business objectives, the compliance with the regulatory requirements, the management of the key risks, and the optimization of the resources and costs. The changes in TPRM program metrics at this level are less frequent and more aggregated, as they reflect the overall direction and performance of the TPRM program.
* Risk committee: This level of reporting is focused on the oversight aspects of the TPRM program, such as the evaluation of the risk appetite, the review of the risk profile, the approval of the risk policies, and the escalation of the risk issues. The changes in TPRM program metrics at this level are occasional and more analytical, as they reflect the governance and assurance of the TPRM program.
* Board of Directors: This level of reporting is focused on the advisory aspects of the TPRM program, such as the endorsement of the risk strategy, the awareness of the risk trends, the guidance of the risk culture, and the support of the risk initiatives. The changes in TPRM program metrics at this level are rare and exceptional, as they reflect the high-level and long-term vision and value of the TPRM program.
Therefore, the correct answer is D. Board of Directors, as this is the level of reporting where changes in TPRM program metrics are rare and exceptional. References:
* 1: 15 KPIs & Metrics to Measure the Success of Your TPRM Program | UpGuard
* 2: Third-party risk management metrics: Best practices to enhance your ... | Diligent
* 3: TPRM Metrics - Telling Your Risk Story - Shared Assessments | Shared Assessments

質問 # 60
Which statement is NOT a method of securing web applications?

• A. Conduct periodic penetration tests
• B. Include validation checks in SDLC for cross site scripting and SOL injections
• C. Ensure appropriate logging and review of access and events
• D. Adhere to web content accessibility guidelines

正解：D

解説：
Web content accessibility guidelines (WCAG) are a set of standards that aim to make web content more accessible to people with disabilities, such as visual, auditory, cognitive, or motor impairments. While WCAG is a good practice for web development and usability, it is not directly related to web application security.
WCAG does not address the common security risks that web applications face, such as injection, broken authentication, misconfiguration, or vulnerable components. Therefore, adhering to WCAG is not a method of securing web applications, unlike the other options. References:
* 4: OWASP Top 10, a standard awareness document for web application security, lists the most critical security risks to web applications and provides best practices to prevent or mitigate them.
* 5: SANS Institute, a leading provider of cybersecurity training and certification, offers a security checklist for web application technologies (SWAT) that covers best practices for error handling, data protection, configuration, authentication, session management, input and output handling, and access control.
* 6: Built In, a platform for tech professionals, provides 13 web application security best practices, such as using a web application firewall, keeping track of APIs, enforcing expected application behaviors, and following the OWASP Top 10.

質問 # 61
Which of the following BEST reflects the risk of a 'shadow IT" function?

• A. inability to prevent "shadow IT' functions from using unauthorized software solutions
• B. "Shadow IT" functions often fail to detect unauthorized use of information assets
• C. "Shadow IT" functions often lack governance and security oversight
• D. Failure to implement strong security controls because IT is executed remotely

正解：C

解説：
Shadow IT refers to the use of IT systems, services, or devices that are not authorized, approved, or supported by the official IT department. Shadow IT can pose significant risks to an organization's data security, compliance, performance, and reputation. One of the main risks of shadow IT is that it often lacks governance and security oversight. This means that the shadow IT functions may not follow the established policies, standards, and best practices for IT management, such as data protection, access control, encryption, backup, patching, auditing, and reporting. This can expose the organization to various threats, such as data breaches, cyberattacks, malware infections, legal liabilities, regulatory fines, and reputational damage. Additionally, shadow IT can create operational inefficiencies, compatibility issues, duplication of efforts, and increased costs for the organization.
According to the web search results from the search_web tool, shadow IT is a common and growing phenomenon in many organizations, especially with the proliferation of cloud-based services and applications. Some of the articles suggest the following best practices for managing and mitigating shadow IT risks123:
* Performing SaaS assessments to proactively detect shadow IT
* Prioritizing user experience (UX) and providing support for integrating tools
* Streamlining user account and identity management
* Using operating systems and devices with which employees are comfortable
* Compromising and collaborating with users to minimize shadow IT risks
* Educating and training users on the security risks and consequences of shadow IT
* Establishing clear policies and guidelines for IT procurement and usage
* Creating a culture of trust and transparency between IT and business units Therefore, the verified answer to the question is B. "Shadow IT" functions often lack governance and security oversight.
References:
* Shadow IT Explained: Risks & Opportunities - BMC Software
* Start reducing your organization's Shadow IT risk in 3 steps
* What is shadow IT? - Article | SailPoint

質問 # 62
Which statement is TRUE regarding the tools used in TPRM risk analyses?

• A. Risk registers are used for logging and tracking third party risks
• B. Risk treatment plans define the due diligence standards for third party assessments
• C. Vendor inventories provide an up-to-date record of high risk relationships across an organization
• D. Risk ratings summarize the findings in vendor remediation plans

正解：A

解説：
Risk registers are tools that help organizations document, monitor, and manage their third party risks. They typically include information such as the risk description, category, source, impact, likelihood, rating, owner, status, and action plan. Risk registers enable organizations to prioritize their risks, assign responsibilities, track progress, and report on their risk posture. According to the CTPRP Study Guide, "A risk register is a tool for capturing and managing risks throughout the third-party lifecycle. It provides a comprehensive view of the organization's third-party risk profile and facilitates risk reporting and communication."1 Similarly, the GARP Best Practices Guidance for Third-Party Risk states, "A risk register is a tool that records and tracks the risks associated with third parties. It helps to identify, assess, and prioritize risks, as well as to assign ownership, mitigation actions, and target dates."2 References:
* CTPRP Study Guide
* GARP Best Practices Guidance for Third-Party Risk

質問 # 63
Which of the following methods of validating pre-employment screening attributes is appropriate due to limitations of international or state regulation?

• A. Reviewing evidence of web search of social media sites
• B. Requesting evidence of the performance of pre-employment screening when permitted by law
• C. Requiring evidence of drug testing
• D. Providing and sampling complete personnel files to demonstrate unique screening results

正解：B

解説：
it is the most appropriate and compliant method of validating pre-employment screening attributes among the given options. Requesting evidence of the performance of pre-employment screening when permitted by law means that the organization respects the legal and regulatory boundaries of different jurisdictions and does not impose unnecessary or unlawful requirements on its third parties. It also ensures that the organization obtains relevant and reliable information about the third parties' screening processes and outcomes, which can help assess their suitability and risk level.
The other options are incorrect because they are either inappropriate or ineffective methods of validating pre-employment screening attributes. Reviewing evidence of web search of social media sites (A) is inappropriate because it may violate the privacy and data protection rights of the third parties and their employees, as well as expose the organization to potential bias and discrimination claims. Providing and sampling complete personnel files to demonstrate unique screening results (B) is ineffective because it may not reflect the actual screening attributes of the third parties, as they may have different screening criteria, standards, and methods than the organization. Requiring evidence of drug testing is inappropriate because it may not be relevant or necessary for the nature and scope of the third-party relationship, and it may also conflict with the laws and regulations of different jurisdictions that prohibit or limit such testing. References:
https://www.onetrust.com/blog/third-party-risk-management/

質問 # 64
Which statement provides the BEST example of the purpose of scoping in third party assessments?

• A. Scoping is used primarily to limit the inclusion of supply chain vendors in third party assessments
• B. Scoping is the process an outsourcer uses to configure a third party assessment based on the risk the vendor presents to the organization
• C. Scoping is an assessment technique only used for high risk or critical vendors that require on-site assessments
• D. Scoping is used to reduce the number of questions the vendor has to complete based on vendor
  "classification

正解：B

解説：
Scoping is a critical step in third party assessments, as it determines the scope and depth of the assessment based on the inherent risk, impact, and complexity of the vendor relationship. Scoping helps to ensure that the assessment is relevant, efficient, and consistent with the outsourcer's risk appetite and objectives. Scoping also helps to avoid over or under assessing the vendor, which could result in unnecessary costs, delays, or gaps in risk management. Scoping is not a one-time activity, but rather an ongoing process that should be reviewed and updated throughout the vendor lifecycle. Scoping should be aligned with the outsourcer's third party risk management framework and policies, and follow the best practices and guidelines provided by the Shared Assessments Program and other industry standards. References:
* 1: THIRD PARTY RISK MANAGEMENT TOOLKIT - Shared Assessments, pages 4-6
* 2: How Dynamic Scoping Can Improve Vendor Risk Assessments - ProcessUnity
* 3: Inherent Risk Tiering for Third-Party Vendor Assessments - MindPoint Group

質問 # 65
Which statement is TRUE regarding the use of questionnaires in third party risk assessments?

• A. The total number of questions included in the questionnaire assigns the risk tier
• B. Questionnaires are optional since reliance on contract terms is a sufficient control
• C. Assessment questionnaires should be configured based on the risk rating and type of service being evaluated
• D. All topic areas included in the questionnaire require validation during the assessment

正解：C

解説：
Questionnaires are one of the most common and effective tools for conducting third party risk assessments.
They help organizations gather information about the security and compliance practices of their vendors and service providers, as well as identify any gaps or weaknesses that may pose a risk to the organization.
However, not all questionnaires are created equal. Depending on the nature and scope of the third party relationship, different types and levels of questions may be required to adequately assess the risk. Therefore, it is important to configure the assessment questionnaires based on the risk rating and type of service being evaluated12.
The risk rating of a third party is determined by various factors, such as the criticality of the service they provide, the sensitivity of the data they handle, the regulatory requirements they must comply with, and the potential impact of a breach or disruption on the organization. The higher the risk rating, the more detailed and comprehensive the questionnaire should be. For example, a high-risk third party that processes personal or financial data may require a questionnaire that covers multiple domains of security and privacy, such as data protection, encryption, access control, incident response, and audit. A low-risk third party that provides a non-critical service or does not handle sensitive data may require a questionnaire that covers only the basic security controls, such as firewall, antivirus, and password policy12.
The type of service that a third party provides also influences the configuration of the questionnaire. Different services may have different security and compliance standards and best practices that need to be addressed.
For example, a third party that provides cloud-based services may require a questionnaire that covers topics such as cloud security architecture, data residency, service level agreements, and disaster recovery. A third party that provides software development services may require a questionnaire that covers topics such as software development life cycle, code review, testing, and vulnerability management12.
By configuring the assessment questionnaires based on the risk rating and type of service being evaluated, organizations can ensure that they ask the right questions to the right third parties, and obtain relevant and meaningful information to support their risk management decisions. Therefore, the statement that assessment questionnaires should be configured based on the risk rating and type of service being evaluated is TRUE12. References: 1: How to Use SIG Questionnaires for Better Third-Party Risk Management 2:
Third-party risk assessment questionnaires - KPMG India

質問 # 66
Physical access procedures and activity logs should require all of the following EXCEPT:

• A. Require multiple access controls for server rooms and data centers
• B. Include a process to trigger review of the logs after security events
• C. Record successful and unsuccessful attempts including investigation of unsuccessful access attempts
• D. Require physical access logs to be retained indefinitely for audit purposes

正解：D

解説：
Physical access procedures and activity logs are important components of third-party risk management, as they help to ensure the security and integrity of the physical assets and data of the organization and its third parties.
However, requiring physical access logs to be retained indefinitely for audit purposes is not a best practice, as it may pose legal, regulatory, and operational challenges. According to the Supplemental Examination Procedures for Risk Management of Third-Party Relationships, physical access logs should be retained for a reasonable period of time, consistent with the organization's policies and procedures, and in compliance with applicable laws and regulations1. Retaining physical access logs indefinitely may increase the risk of unauthorized access, data breaches, privacy violations, and litigation2. Therefore, the statement B is the correct answer, as it is the only one that does not reflect a best practice for physical access procedures and activity logs.
References:
* 1: How to Write Third-Party Risk Management (TPRM) Policies and Procedures - SecurityScorecard Blog
* 2: Five Best Practices to Manage and Control Third-Party Risk - Broadcom Inc.
* 3: A checklist for third-party risk management platforms - Crowe LLP
* 4: Supplemental Examination Procedures for Risk Management of Third-Party Relationships
* 5: Third Party Risk Management: Why It's Important And What Features To Look For - Expert Insights

質問 # 67
Which of the following data safeguarding techniques provides the STRONGEST assurance that data does not identify an individual?

• A. Data encryption
• B. Data anonymization
• C. Data compression
• D. Data masking

正解：B

解説：
Data anonymization is the process of removing or altering any information that can be used to identify an individual from a data set. This technique provides the strongest assurance that data does not identify an individual, as it makes it impossible or extremely difficult to link the data back to the original source. Data anonymization can be achieved by various methods, such as generalization, suppression, perturbation, or pseudonymization12. Data anonymization is often used for privacy protection, compliance with data protection regulations, and data sharing purposes3. References:
* 1: Data Security: Definition, Importance, and Types | Fortinet
* 2: Data Security Best Practices: Top 10 Data Protection Methods - Ekran System
* 3: Data anonymization - Wikipedia

質問 # 68
Which of the following actions reflects the first step in developing an emergency response plan?

• A. Consider work-from-home parameters in the emergency response plan
• B. Use the results of continuous monitoring tools to develop the emergency response plan
• C. incorporate periodic crisis management team tabletop exercises to test different scenarios
• D. Conduct an assessment that includes an inventory of the types of events that have the greatest potential to trigger an emergency response plan

正解：D

解説：
An emergency response plan (ERP) is a document that outlines the procedures and actions to be taken by an organization in the event of a disruptive incident that threatens its operations, assets, reputation, or stakeholders1. An ERP should be aligned with the organization's business continuity and disaster recovery plans, and should cover the roles and responsibilities, communication channels, escalation processes, resources, and recovery strategies for different types of emergencies2.
The first step in developing an ERP is to conduct an assessment that includes an inventory of the types of events that have the greatest potential to trigger an ERP3. This assessment should consider the likelihood and impact of various scenarios, such as natural disasters, cyberattacks, pandemics, civil unrest, terrorism, or supply chain disruptions, and identify the critical functions, processes, assets, and dependencies that could be affected by these events4. The assessment should also evaluate the existing capabilities and gaps in the organization's preparedness and response, and prioritize the areas that need improvement or enhancement5.
The assessment should be based on a comprehensive risk analysis and a business impact analysis, and should involve input from relevant stakeholders, such as senior management, business units, IT, security, legal, compliance, human resources, and third parties.
The other options are not the first step in developing an ERP, but rather subsequent or complementary steps that should be performed after the initial assessment. Considering work-from-home parameters, incorporating periodic crisis management team tabletop exercises, and using the results of continuous monitoring tools are all important aspects of an ERP, but they are not the starting point for creating one. These steps should be based on the findings and recommendations of the assessment, and should be updated and tested regularly to ensure the effectiveness and relevance of the ERP. References: 1: What is an Emergency Response Plan? | IBM 2: Emergency Response Plan | Ready.gov 3: 8 Steps to Building a Third-Party Incident Response Plan | Prevalent 4: How to create an effective business continuity plan | CIO 5: Emergency Response Planning: 4 Steps to Creating a Plan : Third-Party Risk Management: Final Interagency Guidance : Improving Third-Party Incident Response | Prevalent

質問 # 69
When working with third parties, which of the following requirements does not reflect a "Zero Trust" approach to access management?

• A. Utilizing a solution that allows direct access by third parties to the organization's network
• B. Require that all communication is secured regardless of network location
• C. Ensure that access is granted on a per session basis regardless of network location, user, or device
• D. Implement device monitoring, continual inspection and monitoring of logs/traffic

正解：A

解説：
A Zero Trust approach to access management is based on the principle of verifying every access request as if it originates from an open network, regardless of the source, destination, or context. This means that no implicit trust is granted based on network location, user identity, or device status. Instead, every access request is evaluated based on multiple factors, such as user credentials, device health, data sensitivity, and threat intelligence. A Zero Trust approach also requires that all communication is encrypted and protected, and that access is granted on a per session basis with the least privilege principle123.
Utilizing a solution that allows direct access by third parties to the organization's network does not reflect a Zero Trust approach, because it implies that the network perimeter is a reliable boundary for security and trust.
This assumption is risky, because it exposes the organization to potential breaches and attacks from compromised or malicious third parties, who may have access to sensitive data and resources without proper verification or protection. A Zero Trust approach would require that third parties use secure and isolated channels to access the organization's network, such as VPNs, proxies, or gateways, and that their access is monitored and controlled based on granular policies and conditions123. References:
* Zero Trust part 1: Identity and access management
* Zero Trust Model - Modern Security Architecture | Microsoft Security
* Zero Trust identity and access management development best practices ...

質問 # 70
An IT asset management program should include all of the following components EXCEPT:

• A. Identifying and tracking adherence to IT asset end-of-life policy
• B. Maintaining inventories of systems, connections, and software applications
• C. Tracking and monitoring availability of vendor updates and any timelines for end of support
• D. Defining application security standards for internally developed applications

正解：D

解説：
An IT asset management program is a set of processes and tools that help an organization manage its IT assets throughout their lifecycle, from acquisition to disposal. An IT asset management program should include the following components1234:
* Maintaining inventories of systems, connections, and software applications: This component involves creating and updating a comprehensive and accurate list of all IT assets owned or used by the
* organization, including their location, ownership, configuration, and status. This helps the organization optimize the use of its IT resources, reduce costs, and ensure compliance with licensing and regulatory requirements.
* Tracking and monitoring availability of vendor updates and any timelines for end of support: This component involves keeping track of the latest updates, patches, and security fixes provided by the vendors of the IT assets, as well as the end-of-life dates and support options for the assets. This helps the organization maintain the security, performance, and functionality of its IT assets, and plan for timely replacement or migration of obsolete or unsupported assets.
* Identifying and tracking adherence to IT asset end-of-life policy: This component involves defining and implementing a policy for retiring and disposing of IT assets that are no longer needed, useful, or supported by the organization. This helps the organization reduce risks, costs, and environmental impacts associated with IT asset disposal, and ensure compliance with data protection and disposal regulations.
Defining application security standards for internally developed applications is not a component of an IT asset management program, but rather a component of an application development and security program. An application development and security program is a set of processes and tools that help an organization design, develop, test, deploy, and maintain secure and reliable applications, whether they are internally developed or acquired from external sources. An application development and security program should include the following components5 :
* Defining application security standards for internally developed applications: This component involves establishing and enforcing a set of security requirements and best practices for the applications developed by the organization, such as secure coding, testing, and deployment methodologies, security controls, and vulnerability management. This helps the organization ensure the confidentiality, integrity, and availability of its applications and data, and prevent or mitigate security breaches and incidents.
* Performing application security assessments for externally acquired applications: This component involves conducting security reviews and audits of the applications acquired from external sources, such as vendors, partners, or open source communities, before integrating them into the organization's IT environment. This helps the organization identify and address any security risks, gaps, or weaknesses in the applications, and ensure compatibility and compliance with the organization's security policies and standards.
References:
* ITAM: The ultimate guide to IT asset management
* IT asset management: 10 best practices for success
* Asset Management: The Five Core Components
* The Fundamentals of Asset Management
* Application Development and Security Program
* Application Security Best Practices

質問 # 71
Tracking breach, credential exposure and insider fraud/theft alerts is an example of which continuous monitoring technique?

• A. Monitoring surface
• B. Business intelligence
• C. Passive and active indicators of compromise
• D. Vulnerabilities

正解：C

解説：
Continuous monitoring is a process of collecting and analyzing data on the performance and security of third-party vendors on an ongoing basis. Continuous monitoring helps to identify and mitigate potential risks, such as data breaches, credential exposures, insider fraud/theft, and other cyber incidents, that may affect the organization and its customers. Continuous monitoring can use various techniques, such as monitoring surface, vulnerabilities, passive and active indicators of compromise, and business intelligence.
Passive and active indicators of compromise are examples of continuous monitoring techniques that track the signs of malicious activity or compromise on the third-party vendor's systems or networks. Passive indicators of compromise are data sources that do not require direct interaction with the target, such as threat intelligence feeds, dark web monitoring, or external scanning. Active indicators of compromise are data sources that require direct interaction with the target, such as penetration testing, malware analysis, or incident response.
Both passive and active indicators of compromise can provide valuable information on the current state and potential threats of the third-party vendor's environment.
The other options are not examples of continuous monitoring techniques that track breach, credential exposure and insider fraud/theft alerts. Monitoring surface is a technique that measures the size and complexity of the third-party vendor's attack surface, such as the number and type of internet-facing assets, domains, and services. Vulnerabilities are a technique that identifies the weaknesses or flaws in the third-party vendor's systems or applications that can be exploited by attackers, such as outdated software, misconfigurations, or unpatched bugs. Business intelligence is a technique that analyzes the business performance and reputation of the third-party vendor, such as financial stability, customer satisfaction, or regulatory compliance. References:
* Guide: Continuous Monitoring for Third-Party Risk
* Continuous Monitoring - Third Party Risk Management
* 12 Ongoing Monitoring Best Practices for Third-Party Risk Management

質問 # 72
Which factor is the LEAST important attribute when classifying personal data?

• A. The data subject category that identifies the data owner
• B. The volume of data records processed or retained
• C. The assignment of a confidentiality level that differentiates public or non-public information
• D. The sensitivity level of specific data elements that could identify an individual

正解：B

解説：
According to the GDPR, personal data is any information relating to an identified or identifiable natural person (data subject). The GDPR does not consider the volume of data records as a relevant factor for classifying personal data, but rather the nature and context of the data. The GDPR requires data controllers and processors to apply appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing personal data, taking into account factors such as the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks of varying likelihood and severity for the rights and freedoms of natural persons. Therefore, the volume of data records is not a decisive attribute for classifying personal data, but rather an indicator of the potential impact of a data breach or misuse.
The other factors listed in the question are more important attributes for classifying personal data, as they relate to the identification, protection, and rights of the data subjects. The data subject category that identifies the data owner refers to the type of natural person whose personal data is processed, such as customers, employees, patients, students, etc. This factor is important for determining the purpose and legal basis of processing, as well as the data subject's rights and expectations1. The sensitivity level of specific data elements that could identify an individual refers to the degree of harm or discrimination that could result from the disclosure or misuse of such data, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation, or criminal convictions or offenses2. The GDPR imposes stricter rules and obligations for the processing of such special categories of personal data, as they pose a higher risk to the data subject's fundamental rights and freedoms. The assignment of a confidentiality level that differentiates public or non-public information refers to the degree of access and disclosure that is permitted or required for the personal data, depending on the data subject's consent, the legitimate interests of the data controller or processor, or the applicable laws and regulations1. The GDPR requires data controllers and processors to implement data protection by design and by default, meaning that they should only process the personal data that is necessary for the specific purpose and limit the access to those who need to know.
References:
* 4: 5 Types of Data Classification (With Examples) | Indeed.com
* 7: Special Categories of Personal Data - GDPR EU
* [8]: Data Classification for GDPR Explained [Full Breakdown] - DataGrail

質問 # 73
Which statement is NOT an example of the purpose of internal communications and information sharing using TPRM performance metrics?

• A. To communicate the status of policy compliance with TPRM onboarding, periodic assessment and off-boarding requirements
• B. To communicate the status of findings identified in vendor assessments and escalate issues es needed
• C. To develop and provide periodic reporting to management based on TPRM results
• D. To document the agreed upon corrective action plan between external parties based on the severity of findings

正解：D

解説：
The purpose of internal communications and information sharing using TPRM performance metrics is to inform and align the organization's stakeholders on the status, progress, and outcomes of the TPRM program.
This includes communicating the results of vendor assessments, the compliance level of the organization's policies and procedures, and the periodic reporting to management and other relevant parties. However, documenting the corrective action plan between external parties is not an internal communication, but rather an external one. This is because the corrective action plan is a formal agreement between the organization and the vendor to address and resolve the issues identified in the assessment. Therefore, this statement is not an example of the purpose of internal communications and information sharing using TPRM performance metrics. References:
* 15 KPIs & Metrics to Measure the Success of Your TPRM Program
* Third-party risk management metrics: Best practices to enhance your program
* 3 Best Third-Party Risk Management Software Solutions (2024)

質問 # 74
Which of the following BEST describes the distinction between a regulation and a standard?

• A. A regulation must be adhered to by all companies subject to its requirements, but companies "can voluntarily choose to follow standards.
• B. There is no distinction, regulations and standards are the same and have equal impact
• C. Standards are always a subset of a regulation
• D. A standard must be adhered to by companies based on the industry they are in, while regulations are voluntary.

正解：A

解説：
A regulation is a rule of order having the force of law, prescribed by a superior or competent authority, relating to the actions of those under the authority's control. Regulations are issued by various government departments and agencies to carry out the intent of legislation enacted by the legislature of the applicable jurisdiction. Regulations also function to ensure uniform application of the law. A standard is a guideline established generally by private-sector bodies and that are available for use by any person or organization, private or government. The term includes what are commonly referred to as 'industry standards' as well as
'consensus standards'. Standards are developed through a voluntary process of collaboration and consensus among stakeholders, such as manufacturers, consumers, regulators, and experts. Standards may reflect best practices, technical specifications, performance criteria, or quality requirements. Standards do not have the force of law unless they are adopted or referenced by a regulation. Therefore, a regulation must be adhered to by all companies subject to its requirements, but companies can voluntarily choose to follow standards that are relevant and beneficial to their operations, products, or services. References:
* The Difference Between Regulations and Standards
* Regulations vs Standards: Clearing Up the Confusion - AEM
* Standards vs. Regulations
* Certified Third Party Risk Professional (CTPRP) Study Guide

質問 # 75
Which example BEST represents the set of restrictive areas that require an additional authentication factor for access control?

• A. Datacenters; telecom rooms; server rooms; exterior building entrance
• B. Exterior building entrance; datacenters; telecom rooms; printer rooms
• C. Telecom rooms; parking garage; security operations centers; exterior building entrance
• D. Datacenters; telecom rooms; security operations centers; loading docks

正解：A

解説：
Restrictive areas are those that contain sensitive or critical assets, systems, or information that require additional protection from unauthorized access or tampering. Access control is the process of granting or denying access to these areas based on predefined policies, rules, and criteria. An additional authentication factor is a method of verifying the identity or authorization of a user or device that is used in conjunction with another factor, such as a password, a token, or a biometric feature. Additional authentication factors enhance the security and reliability of access control by reducing the risk of impersonation, compromise, or theft of credentials.
The example that best represents the set of restrictive areas that require an additional authentication factor for access control is A. Datacenters; telecom rooms; server rooms; exterior building entrance. These areas contain vital infrastructure, equipment, and data that are essential for the organization's operations, performance, and security. Unauthorized access to these areas could result in significant damage, disruption, or loss of data, services, or resources. Therefore, these areas should be protected by multiple layers of access control, including physical and logical barriers, as well as additional authentication factors, such as smart cards, biometrics, or one-time passwords.
The other examples are less likely to represent the set of restrictive areas that require an additional authentication factor for access control, because they either contain less sensitive or critical assets, systems, or information, or they are more accessible or visible to the public or other authorized users. For example:
* B. Datacenters; telecom rooms; security operations centers; loading docks: While datacenters, telecom rooms, and security operations centers are restrictive areas that require an additional authentication factor for access control, loading docks are not. Loading docks are typically open to external vendors, suppliers, or delivery personnel, and may not contain any sensitive or critical assets, systems, or information. Therefore, loading docks may not require an additional authentication factor for access control, but rather a basic verification of identity or authorization, such as a badge, a signature, or a receipt.
* C. Telecom rooms; parking garage; security operations centers; exterior building entrance: While telecom rooms, security operations centers, and exterior building entrance are restrictive areas that require an additional authentication factor for access control, parking garage is not. Parking garage is usually accessible to employees, visitors, or customers, and may not contain any sensitive or critical
* assets, systems, or information. Therefore, parking garage may not require an additional authentication factor for access control, but rather a simple validation of access rights, such as a ticket, a code, or a gate.
* D. Exterior building entrance; datacenters; telecom rooms; printer rooms: While exterior building entrance, datacenters, and telecom rooms are restrictive areas that require an additional authentication factor for access control, printer rooms are not. Printer rooms are generally available to all employees or authorized users, and may not contain any sensitive or critical assets, systems, or information. Therefore, printer rooms may not require an additional authentication factor for access control, but rather a standard authentication factor, such as a password, a PIN, or a fingerprint.
References:
* Shared Assessments CTPRP Study Guide, page 46, section 4.3.1: Access Control
* Access Controls Over Third-Party Applications, section: Vendor Access
* Controlling Third-Party Access Risk, section: Best Practices for Controlling Third-Party Vendor Risks, bullet point: Implementing supporting processes and controls that define and enforce access policies for third-party privileged users.

質問 # 76
Which of the following is a component of evaluating a third party's use of Remote Access within their information security policy?

• A. Providing guidelines to configuring ports on a router
• B. Reviewing the testing and deployment procedures to networking components
• C. Identifying the use of multifactor authentication
• D. Maintaining blocked IP address ranges

正解：C

解説：
Remote access is any connection made to an organization's internal network and systems from an external source by a device or host. Remote access can enable greater worker flexibility and productivity, but it also poses significant security risks, such as unauthorized access, data leakage, malware infection, or network compromise. Therefore, it is important to evaluate a third party's use of remote access within their information security policy, which should define the roles, responsibilities, standards, and procedures for remote access.
One of the key components of evaluating a third party's use of remote access within their information security policy is identifying the use of multifactor authentication. Multifactor authentication is a method of verifying the identity of a remote user by requiring two or more factors, such as something the user knows (e.g., password, PIN), something the user has (e.g., token, smart card), or something the user is (e.g., fingerprint, face). Multifactor authentication enhances the security of remote access by making it harder for attackers to impersonate or compromise legitimate users. According to the NIST Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security1, multifactor authentication should be used for all remote access, especially for high-risk situations, such as accessing sensitive data or privileged accounts.
The other options are not components of evaluating a third party's use of remote access within their information security policy. Maintaining blocked IP address ranges, reviewing the testing and deployment procedures to networking components, and providing guidelines to configuring ports on a router are all examples of network security controls, but they are not specific to remote access. They may be part of the overall information security policy, but they are not sufficient to assess the security of remote access.
References:
* NIST Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security
* How to Implement an Effective Remote Access Policy
* Why Managing Third-Party Access Requires A Better Approach

質問 # 77
......

無料提供中のCTPRP試験問題集で（2024年最新のPDF問題集）信頼度の高いCTPRPテストエンジン：https://jp.fast2test.com/CTPRP-premium-file.html

CTPRPのPDFで最近更新された問題です集試験点数を伸ばそう：https://drive.google.com/open?id=10cTGB0NO0OHorlZVwv_mmTgjNS7ZFSEq