Question 1

Which factor is MOST important when scoping assessments of cloud-based third parties that access, process, and retain personal data?

Options :

A : The geographic location of the vendor-s outsourced datacenters since assessments are only required for international data transfers

B : The identification of the type of cloud hosting deployment or service model in order to confirm responsibilities between the third party and the cloud hosting provider

C : The definition of requirements for backup capabilities for power generation and redundancy in the resilience plan

D : The contract terms for the configuration of the environment which may prevent conducting the assessment

Answer: B

Question 2

Which of the following factors is LEAST likely to trigger notification obligations in incident response?

Options :

A : Regulatory requirements

B : Data classification or sensitivity

C : Encryption of data

D : Contractual terms

Answer: C

Question 3

The BEST time in the SDLC process for an application service provider to perform Threat Modeling analysis is:

Options :

A : Before the application design and development activities begin

B : After the application vulnerability or penetration test is completed

C : After testing and before the deployment of the final code into production

D : Prior to the execution of a contract with each client

Answer: A

Question 4

Which type of contract provision is MOST important in managing Fourth-Nth party risk after contract signing and on-boarding due diligence is complete?

Options :

A : Subcontractor notice and approval

B : Indemnification and liability

C : Breach notification

D : Right to audit

Answer: A

Question 5

Which statement is TRUE regarding artifacts reviewed when assessing the Cardholder Data Environment (CDE) in payment card processing?

Options :

A : The Data Security Standards (DSS) framework should be used to scope the assessment

B : The Report on Compliance (ROC) provides the assessment results completed by a qualified security assessor that includes an onsite audit

C : The Self-Assessment Questionnaire (SAQ) provides independent testing of controls

D : A System and Organization Controls (SOC) report is sufficient if the report addresses the same location

Answer: B

Free CTPRP Mock Exam – Practice Online Confidently

Buying Options: