2026 Actual Shared Assessments CTPRP Dumps, Updated Exam Questions for Guaranteed Pass

CTPRP free sample questions and answers

Shared Assessments CTPRP practice quiz with correct answers for search indexing.

1. Question 1

   Which of the following actions reflects the first step in developing an emergency response plan?

   AConduct an assessment that includes an inventory of the types of events that have the greatest potential to trigger an emergency response plan
   

   BConsider work-from-home parameters in the emergency response plan
   

   Cincorporate periodic crisis management team tabletop exercises to test different scenarios
   

   DUse the results of continuous monitoring tools to develop the emergency response plan
   

   Correct answer: A

   An emergency response plan (ERP) is a document that outlines the procedures and actions to be taken by an organization in the event of a disruptive incident that threatens its operations, assets, reputation, or stakeholders1.An ERP should be aligned with the organization's business continuity and disaster recovery plans, and should cover the roles and responsibilities, communication channels, escalation processes, resources, and recovery strategies for different types of emergencies2.

   The first step in developing an ERP is to conduct an assessment that includes an inventory of the types of events that have the greatest potential to trigger an ERP3.This assessment should consider the likelihood and impact of various scenarios, such as natural disasters, cyberattacks, pandemics, civil unrest, terrorism, or supply chain disruptions, and identify the critical functions, processes, assets, and dependencies that could be affected by these events4.The assessment should also evaluate the existing capabilities and gaps in the organization's preparedness and response, and prioritize the areas that need improvement or enhancement5. The assessment should be based on a comprehensive risk analysis and a business impact analysis, and should involve input from relevant stakeholders, such as senior management, business units, IT, security, legal, compliance, human resources, and third parties.

   The other options are not the first step in developing an ERP, but rather subsequent or complementary steps that should be performed after the initial assessment. Considering work-from-home parameters, incorporating periodic crisis management team tabletop exercises, and using the results of continuous monitoring tools are all important aspects of an ERP, but they are not the starting point for creating one.These steps should be based on the findings and recommendations of the assessment, and should be updated and tested regularly to ensure the effectiveness and relevance of the ERP.Reference:1:What is an Emergency Response Plan? | IBM2:Emergency Response Plan | Ready.gov3:8 Steps to Building a Third-Party Incident Response Plan | Prevalent4:How to create an effective business continuity plan | CIO5:Emergency Response Planning: 4 Steps to Creating a Plan:Third-Party Risk Management: Final Interagency Guidance:Improving Third-Party Incident Response | Prevalent

   
   

2. Question 2

   Which statement does NOT reflect current practice in addressing fourth party risk or subcontracting risk?

   AThird party contracts and agreements should require prior notice and approval for subcontracting
   

   BOutsourcers should rely on requesting and reviewing external audit reports to address subcontracting risk
   

   COutsourcers should inspect the vendor's TPRM program and require evidence of the assessments of subcontractors
   

   DThird party contracts should include capturing, maintaining, and tracking authorized subcontractors
   

   Correct answer: B

   This statement does not reflect current practice in addressing fourth party risk or subcontracting risk because it is not sufficient to rely on external audit reports alone. Outsourcers should also perform their own due diligence and monitoring of the subcontractors, as well as ensure that the third party has a robust TPRM program in place. External audit reports may not cover all the relevant aspects of subcontracting risk, such as data security, compliance, performance, and quality. Moreover, external audit reports may not be timely, accurate, or consistent, and may not reflect the current state of the subcontractor's operations. Therefore, outsourcers should adopt a more proactive and comprehensive approach to managing subcontracting risk, rather than relying on external audit reports.Reference:

   Shared Assessments Program, page 13: ''Outsourcers should not rely solely on external audit reports to address subcontracting risk. Outsourcers should also inspect the vendor's TPRM program and require evidence of the assessments of subcontractors.''

   Five Best Practices to Manage and Control Third-Party Risk, page 3: 'Restricting privileged accounts

   
   

3. Question 3

   Which of the following is NOT an attribute in the vendor inventory used to assign risk rating and vendor classification?

   AType of data accessed, processed, or retained
   

   BType of systems accessed
   

   CType of contract addendum
   

   DType of network connectivity
   

   Correct answer: C

   One of the key steps in creating and maintaining a vendor inventory is to assign a risk rating and a vendor classification to each vendor, based on various attributes that reflect the level of risk and criticality they pose to the organization.The risk rating and vendor classification help an organization determine the frequency and depth of its vendor due diligence, review, and audit processes, as well as the appropriate controls and remediation actions to implement3.

   Some of the common attributes used to assign risk rating and vendor classification are :

   Type of data accessed, processed, or retained: This attribute indicates the sensitivity and confidentiality of the data that the vendor handles on behalf of the organization, such as personally identifiable information (PII), protected health information (PHI), financial information, intellectual property, etc. The more sensitive and confidential the data, the higher the risk rating and vendor classification, as the vendor must comply with strict security and privacy standards and regulations, and the organization must protect itself from data breaches, leaks, or losses.

   Type of systems accessed: This attribute indicates the access level and privileges that the vendor has to the organization's systems, such as networks, servers, databases, applications, etc. The more access and privileges the vendor has, the higher the risk rating and vendor classification, as the vendor must adhere to the organization's policies and procedures, and the organization must safeguard itself from unauthorized or malicious activities, such as cyberattacks, sabotage, or espionage.

   Type of network connectivity: This attribute indicates the mode and frequency of the data transmission and communication between the vendor and the organization, such as online, offline, real-time, batch, etc. The more network connectivity the vendor has, the higher the risk rating and vendor classification, as the vendor must ensure the availability, integrity, and reliability of the data, and the organization must prevent data interception, modification, or disruption.

   The type of contract addendum is NOT an attribute used to assign risk rating and vendor classification, as it is not directly related to the risk or criticality of the vendor. The type of contract addendum is a legal document that modifies or supplements the original contract between the vendor and the organization, such as adding or deleting terms, clauses, or provisions. The type of contract addendum may reflect the changes or updates in the vendor relationship, such as scope, duration, price, service level, etc., but it does not indicate the level of risk or impact that the vendor has on the organization. Therefore, the type of contract addendum is not a relevant factor for vendor risk assessment and management .Reference:

   1:Vendor Inventory - Shared Assessments

   2:Vendor Inventory Management: A Guide to Third-Party Risk Management

   3:Vendor Risk Rating - Shared Assessments

   : [Vendor Risk Rating: How to Rate Your Vendors | Smartsheet]

   : [Vendor Classification - Shared Assessments]

   : [Vendor Tiering: How to Classify Your Vendors | Smartsheet]

   : Contract Addendum - Shared Assessments

   : What is a Contract Addendum? | Definition and Examples | Imperva

   
   

4. Question 4

   When evaluating compliance artifacts for change management, a robust process should include the following attributes:

   AApproval, validation, auditable.
   

   BLogging, approvals, validation, back-out and exception procedures
   

   CLogging, approval, back-out.
   

   DCommunications, approval, auditable.
   

   Correct answer: B

   Change management is the process of controlling and documenting any changes to the scope, objectives, requirements, deliverables, or resources of a project or a program. Change management ensures that the impact of any change is assessed and communicated to all stakeholders, and that the changes are implemented in a controlled and coordinated manner. Compliance artifacts are the documents, records, or reports that demonstrate the adherence to the change management process and the regulatory or industry standards.

   A robust change management process should include the following attributes:

   Logging: This means that any change request or proposal is recorded in a change log or a change register, along with the details of the change initiator, the change description, the change category, the change priority, the change status, and the change history. Logging helps to track and monitor the progress and outcome of each change, and to provide an audit trail for compliance purposes.

   Approvals: This means that any change request or proposal is reviewed and approved by the appropriate authority or stakeholder, such as the project manager, the sponsor, the customer, the steering committee, or the regulatory body. Approvals help to ensure that the change is justified, feasible, aligned with the project or program objectives, and acceptable to the affected parties.

   Validation: This means that any change request or proposal is verified and tested to ensure that it meets the quality standards, the functional and non-functional requirements, and the expected benefits and outcomes. Validation helps to ensure that the change is implemented correctly, effectively, and efficiently, and that it does not introduce any errors, defects, or risks.

   Back-out and exception procedures: This means that any change request or proposal has a contingency plan or a rollback plan in case the change fails, causes problems, or is rejected. Back-out and exception procedures help to minimize the negative impact of the change, and to restore the original state or the baseline of the project or program. They also help to handle any deviations or issues that may arise during the change implementation or the change review.

   
   

   CTPRP Job Guide

   An Agile Approach to Change Management

   CM Overview

   Management Artifacts and its Types

   Achieving Regulatory and Industry Standards Compliance with the Scaled Agile Framework

   8 Steps for an Effective Change Management Process

5. Question 5

   Which of the following would be a component of an arganization's Ethics and Code of Conduct Program?

   AParticipation in the company's annual privacy awareness program
   

   BA disciplinary process for non-compliance with key policies, including formal termination or change of status process based on non-compliance
   

   CSigning acknowledgement of Acceptable Use policy for use of company assets
   

   DA process to conduct periodic access reviews of critical Human Resource files
   

   Correct answer: B

   An organization's Ethics and Code of Conduct Program is a set of policies, procedures, and practices that define the expected standards of behavior and ethical values for all employees and stakeholders. A key component of such a program is a disciplinary process that outlines the consequences and actions for violating the code of conduct or any other relevant policies. A disciplinary process helps to enforce the code of conduct, deter unethical behavior, and protect the organization's reputation and integrity. A disciplinary process should include clear criteria for determining the severity and frequency of violations, the roles and responsibilities of the parties involved, the steps and timelines for investigation and resolution, and the range of sanctions and remedies available. A disciplinary process should also be fair, consistent, transparent, and respectful of the rights and dignity of the accused and the accuser. A disciplinary process may involve formal termination or change of status of the employee, depending on the nature and impact of the violation. Therefore, option B is a correct component of an organization's Ethics and Code of Conduct Program.

   The other options are not necessarily components of an Ethics and Code of Conduct Program, although they may be related or supportive of it. Option A, participation in the company's annual privacy awareness program, is more likely to be a component of a Privacy Program, which is a specific area of ethics and compliance that deals with the protection and use of personal information. Option C, signing acknowledgement of Acceptable Use policy for use of company assets, is more likely to be a component of an Information Security Program, which is another specific area of ethics and compliance that deals with the safeguarding and management of data and systems. Option D, a process to conduct periodic access reviews of critical Human Resource files, is more likely to be a component of an Internal Control Program, which is a general area of ethics and compliance that deals with the design and implementation of controls to ensure the reliability and accuracy of financial and operational information.Reference:

   1: Creating an Effective Code of Conduct (and Code Program) - Corporate Compliance Insights

   2: Code of Conduct & Ethics (Examples and Best Practices) - Status.net

   3: Why Have a Code of Conduct - Free Ethics & Compliance Toolkit

   4: ''Code of Ethics'' and ''Code of Conduct'' - GeeksforGeeks

   5: Six Tips on How to Implement a Strong Ethics Program - KnowledgeLeader