Shared Assessments
CTPRP
Q1:
Which of the following is typically NOT included within the scape of an organization's network access policy?
○
A
Firewall settings○
B
Unauthorized device detection○
C
Website privacy consent banners○
D
Remote access
Shared Assessments
CTPRP
Q2:
Which statement is FALSE regarding background check requirements for vendors or service providers?
○
A
Background check requirements are not applicable for vendors or service providers based outside the United States○
B
Background checks should be performed prior to employment and may be updated after employment based upon criteria in HR policies○
C
Background check requirements should be applied to employees, contract workers and temporary workers○
D
Background check requirements may differ based on level of authority, risk, or job role
Shared Assessments
CTPRP
Q3:
Which of the following BEST reflects the risk of a 'shadow IT" function?
○
A
''Shadow IT' functions often fail to detect unauthorized use of information assets○
B
''Shadow IT' functions often lack governance and security oversight○
C
inability to prevent 'shadow IT' functions from using unauthorized software solutions○
D
Failure to implement strong security controls because IT is executed remotely
Shared Assessments
CTPRP
Q4:
What attribute is MOST likely to be included in the software development lifecycle (SDLC) process?
○
A
Scheduling the frequency of automated vulnerability scans○
B
Scanning for data input validation in production○
C
Conducting peer code reviews○
D
Defining the scope of annual penetration tests
Shared Assessments
CTPRP
Q5:
You are updating program requirements due to shift in use of technologies by vendors to enable hybrid work. Which statement is LEAST likely to represent components of an Asset
Management Program?
○
A
Asset inventories should include connections to external parties, networks, or systems that process data○
B
Each asset should include an organizational owner who is responsible for the asset throughout its life cycle○
C
Assets should be classified based on criticality or data sensitivity○
D
Asset inventories should track the flow or distribution of items used to fulfill products and Services across production lines