CTPRP 無料問題集「Shared Assessments Certified Third-Party Risk Professional (CTPRP)」

（A）Vendor's commitment to confidentiality and the timeline for deleting sensitive data.

（B）Procedures for notifying relevant parties, timelines, and information sharing.

（C）The specific security technologies that the vendor should use following a breach.

（D）Details about the compensation the vendor owes the organization after a breach.

（A）To evaluate the response time of local emergency services during different scenarios.

（B）To check the operational readiness of emergency equipment like fire extinguishers.

（C）To ensure all occupants are familiar with evacuation procedures and can respond quickly in a crisis.

（D）To provide a realistic experience of potential emergency scenarios without actual risk.

（A）The device's operating system is updated to the latest version

（B）The device automatically contacts the nearest police station

（C）The device is restored to its factory settings

（D）The device locks permanently, requiring a physical unlock

（A）Conduct a surprise on-site inspection

（B）Initiate a third-party compliance investigation

（C）Request additional information or documentation

（D）Engage in renegotiation of contract terms

（A）The Federal Information Security Management Act (FISMA)

（B）The Health Insurance Portability and Accountability Act (HIPAA)

（C）The Payment Card Industry Data Security Standard (PCI DSS)

（D）The General Data Protection Regulation (GDPR)

（A）Reviewing the frequency of security audits conducted on the image snapshot storage systems.

（B）Validation that deletion protocols for image snapshots include comprehensive logs and verifiable trails to confirm proper disposal.

（C）Ensuring that image snapshots are stored in at least three different locations to provide geographic redundancy.

（D）Analyzing the scalability of image snapshot processes to handle increasing data volumes effectively.

（A）Assessment of the communication process around patch management and updates.

（B）Verification that all devices have received and applied the patch correctly.

（C）Checking the frequency and scheduling of patch deployments across networks.

（D）Evaluation of the patch's impact on system performance during testing.

（A）Employee negligence, vendor errors, or software bugs

（B）Unauthorized access, use, modification, disclosure, or destruction

（C）Physical theft, natural disasters, or system failures

（D）Financial loss, regulatory fines, or reputation damage

（A）By focusing solely on industry-specific standards

（B）By applying the most recently updated regulations only

（C）By evaluating their impact on international operations

（D）By identifying regulations that extend specific obligations to service providers

（A）Reviewing whether image snapshots are stored in multiple geographical locations to ensure redundancy.

（B）Checking if the vendor has an ISO/IEC 27001 certification specifically for cloud security.

（C）Assessing the physical security measures at data centers where image snapshots are stored.

（D）Ensuring the image snapshots are encrypted at rest and in transit to prevent unauthorized data access.

（A）personal preferences

（B）organizational data

（C）user settings

（D）accounts information

（A）encryption techniques

（B）identity and access management

（C）error handling protocols

（D）logging mechanisms

（A）Sanitizing physical media to secure confidential data

（B）Conducting regular audits on asset utilization

（C）Recycling components to promote environmental sustainability

（D）Upgrading software to extend asset usability

（A）Increasing focus on technical solutions rather than cultural adjustments.

（B）Concentrating on punitive measures for managing and responding to risks.

（C）Implementing values and practices that promote consistent risk-aware decision-making.

（D）Emphasizing the reduction of external audits and compliance requirements.

（A）Response

（B）Audit

（C）Recovery

（D）Certification

（A）Conduct an internal review of the remediation plans

（B）Inform the third-party of the potential changes directly

（C）Schedule a meeting with the business unit relationship owner

（D）Review the contract terms for potential breaches

（A）negligible consequence

（B）potential impact

（C）minimal effect

（D）slight risk

（A）To minimize the cost of asset maintenance and repairs

（B）To ensure all assets are properly accounted for and monitored

（C）To enhance the performance metrics of technology used

（D）To maximize the utilization of each asset in the company