サンプル問題 1： When defining due diligence requirements for the set of vendors that host web applications which of the following is typically NOT part of evaluating the vendor's patch management controls?
A: The capability of the vendor to apply priority patching of high-risk systems
B: Established procedures for testing of patches, service packs, and hot fixes prior to installation
C: A documented process to gain approvals for use of open source applications
D: The existence of a formal process for evaluation and prioritization of known vulnerabilities
正解：C
Explanation: A documented process to gain approvals for use of open source applications is typically not part of evaluating the vendor’s patch management controls, because it is not directly related to the patching process. Patch management controls are the policies, procedures, and tools that enable an organization to identify, acquire, install, and verify patches for software vulnerabilities. Patch management controls aim to reduce the risk of exploitation of known software flaws and ensure the functionality and compatibility of the patched systems. A documented process to gain approvals for use of open source applications is more relevant to the software development and procurement processes, as it involves assessing the legal, security, and operational implications of using open source software components in the vendor’s products or services. Open source software may have different licensing terms, quality standards, and support levels than proprietary software, and may introduce additional vulnerabilities or dependencies that need to be managed. Therefore, a documented process to gain approvals for use of open source applications is a good practice for vendors, but it is not a patch management control per se. References: • Guide to Enterprise Patch Management Planning • Governance of Key Aspects of System Patch Management • Certified Third Party Risk Professional (CTPRP) Study Guide
サンプル問題 2： The primary disadvantage of Single Sign-On (SSO) access control is:
A: The impact of a compromise of the end-user credential that provides access to multiple systems is greater
B: A single password is easier to guess and be exploited
C: Users store multiple passwords in a single repository limiting the ability to change the password
D: Vendors must develop multiple methods to integrate system access adding cost and complexity
正解：A
Explanation: Single Sign-On (SSO) is a convenient and efficient way of authenticating users across multiple applications and platforms with a single set of credentials. However, it also poses some security risks and challenges that need to be considered and addressed. One of the main disadvantages of SSO is that it creates a single point of failure and a high-value target for attackers. If an end-user credential is compromised, the attacker can gain access to all the systems and resources that the user is authorized to access, potentially causing significant damage and data breaches. Therefore, SSO requires strong security measures to protect the user credentials, such as encryption, multifactor authentication, password policies, and monitoring. Additionally, SSO users need to be aware of the risks and follow best practices to safeguard their credentials, such as using strong and unique passwords, changing them regularly, and avoiding phishing and social engineering attacks. References: • 1: What are the disadvantages of single sign-on authentication? - Information Security Stack Exchange • 2: Single Sign-On Disadvantages: 6 Advantages and Disadvantages [What You Need to Know] - Mostly Blogging • 3: SSO Security Risks: The Drawbacks of SSO (And What Can You Do About it) - Zluri
サンプル問題 3： Which statement BEST describes the use of risk based decisioning in prioritizing gaps identified at a critical vendor when defining the corrective action plan?
A: The assessor determined that gaps should be analyzed, documented, reviewed for compensating controls, and submitted to the business owner to approve risk treatment plan
B: The assessor decided that the critical gaps should be discussed in the closing meeting so that the vendor can begin to implement corrective actions immediately
C: The assessor concluded that all gaps should be logged and treated as high severity findings since the assessment was performed on a critical vendor
D: The assessor determined that all gaps should be logged and communicated that if the gaps were corrected immediately they would not need to be included in the findings report
正解：A
Explanation: According to the Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, risk based decisioning is the process of applying risk criteria to prioritize and address the gaps identified during a third-party risk assessment1. The assessor should analyze the gaps based on the impact, likelihood, and urgency of the risk, and document the findings and recommendations in a report. The assessor should also review the existing or proposed compensating controls that could mitigate the risk, and submit the report to the business owner for approval of the risk treatment plan. The risk treatment plan could include accepting, transferring, avoiding, or reducing the risk, depending on the risk appetite and tolerance of the organization1. The other statements do not reflect the best use of risk based decisioning, as they either ignore the risk analysis and documentation process, or apply a uniform or arbitrary approach to prioritizing and addressing the gaps. The assessor should not decide or conclude on the risk treatment plan without consulting the business owner, as the business owner is ultimately responsible for the third-party relationship and the risk management decisions1. The assessor should also not communicate that the gaps would not be included in the report if they were corrected immediately, as this could compromise the integrity and transparency of the assessment process and the report2. References: • 1: Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, pages 29-30, 33-34 • 2: Third-Party Risk Management: Final Interagency Guidance, page 10
試験はこの世界で成功しやすいことの一つです。試験は前もって範囲を教えていますから、復習はこの範囲内の自分ができないところを探し続けています。GOWUKAKUはCTPRP問題集を用いたCTPRP（Certified Third-Party Risk Professional (CTPRP)）試験の復習方法を案内しています。
