Quiz
CIS-TPRM - MOCK 2
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (60)
1What is the minimum role required to create event-driven rules?
- Asn_vdr_risk_asmt.vendor_risk_manager
- Bsn_vdr_risk_asmt.vendor_risk_due_dilligence
- Csn_vdr_risk_asmt.vendor_risk_assessor
- Dsn_vdr_risk_asmt.vendor_risk_admin
2What is the advantage of using both TPRM and GRC/IRM?
- AAll compliance controls are automatically visible to the third-party risk manager.
- BThird-party Risk engagements automatically match with Audit engagements.
- CPrimary third-party contacts can then see their overall non-compliant risk score.
- DNon-compliant controls automatically adjust the risk score for a third-party entity.
3ServiceNow helps companies manage vendors without emails and spreadsheets using the:
- APrimary Third-party
- BThird-party Portal
- CThird-party Manager Workspace
- DThird-party Platform
4What are benefits of using the Third-party Portal? (Choose two.)
- AThe Third-party Portal can be leveraged by the third party to work with other partners.
- BThe Third-party Portal reduces risk for an organization by enabling secure communications with the third-party.
- CThe Third-party Portal consolidates all communications and artifacts to a single system of truth.
- DThird-party Portal allows the Third-party Risk Assessor team to reassign parts of an Inherent Risk Assessment.
- EThe Third-party Portal matches a database of documents to document requests.
5When a third-party risk assessment is submitted, what is the next state in the default workflow?
- AUnder Review
- BRisk Assessment
- CEvaluation
- DResponses Received
6What is the minimum role required to create a Third-party Risk Assessment?
- Asn_vdr_risk_asmt.vendor_risk_assessor
- Bsn_vdr_risk_asmt.vendor_risk_user
- Csn_vdr_risk_asmt.vendor_risk_manager
- Dsn_vdr_risk_asmt.vendor_risk_admin
7What statements can be made about the Third-party tier? (Choose two.)
- AIt is leveraged to identify the appropriate assessment to send to the third-party.
- BIt can be manually set or set via the Third-party Tiering process.
- CIt is required to generate a third-party assessment.
- DIt is leveraged to decide whether to do business with a third-party or not.
8What other record is created when an element classification is created?
- AClassification component definition.
- BClassification component criteria.
- CEngagement component criteria.
- DEngagement component definition.
9What can be said concerning the number of third-party contacts?
- AA third party can only designate one contact as the primary and must have a minimum of one non-primary contact.
- BA third party can designate more than one contact as the primary, but must have a minimum of one primary contact.
- CA third party must have one designated internal third-party manager.
- DA third party can only designate one contact as the primary contact, but may have multiple non-primary contacts.
10Which of the following describes the Third-party Tiering process?
- AA process to evaluate a third party's risk based on their responses to a questionnaire.
- BA process to evaluate a third party's risk based on their performance.
- CA process to evaluate a third party's risk based on their financial stability.
- DA process to evaluate a third party's risk based on the criticality of the services they provide.
11What does accepting an Issue mark?
- AAttempted remediation failed.
- BAn intention to create an exception for a known control failure or risk.
- CAn implication that the known control failure is unimportant.
- DSpecial third parties get an exception.
12In ServiceNow TPRM, what does 'Inherent Risk' represent?
- AThe risk that remains after a vendor fails a compliance audit
- BThe combined risk score of all vendors in a specific business unit
- CThe risk level after all mitigation controls and safeguards have been applied
- DThe risk level associated with a third party before any controls or mitigation measures are considered
13What role is required to configure Third-party Risk Management properties?
- Asn_vdr_risk_asmt.vendor_manager
- Bsn_vdr_risk_asmt.vendor_risk_manager
- Csn_vdr_risk_asmt.vendor_risk_admin
- Dsn_vdr_risk_asmt.vendor_assessor
14When the GRC: Policy and Compliance Management application is installed, what GRC related list displays on the Third-party Risk Issue record?
- AConfiguration baseline
- BPolicy Exceptions
- CCitations
- DPolicies
15What is the primary purpose of a 'Risk Response' in the context of Third-Party Risk Management?
- ATo assign a numerical score to each vendor based on their financial stability
- BTo determine the appropriate action (mitigate, transfer, accept, or avoid) for an identified and assessed risk
- CTo document regulatory requirements that apply to the organization
- DTo create a comprehensive inventory of all third-party vendors and their contracts
16A Third-party Risk Manager needs to run a report displaying Third-party Assessments due. On which table would this report be run?
- A[sn_vdr_risk_asmt_assessment]
- B[sn_vdr_risk_asmt_issue]
- C[sn_vdr_risk_asmt_task]
- D[sn_vdr_risk_assessment]
17If a Third-party Risk Issue is for internal use only, what states can be skipped? (Choose two.)
- AFinalize with Third-party
- BSubmitted to Third-party
- CNew
- DAnalyze
18How are Third-party Risk questionnaires and document requests displayed on the Third-party Portal?
- AAs separate requests and can be assigned to different third-party contacts.
- BAs a single assessment assigned to a single engagement contact.
- CAs a single assessment assigned to a single third-party contact.
- DAs separate requests and can only be assigned to the same third-party contact.
19The Third-party Risk Dashboard provides information to do what? (Choose two.)
- AReview the Third-party Risk score for all third parties.
- BMonitor Third-party Risk across the organization.
- CDrive day-to-day activities for the Third-party Risk Assessor.
- DView and respond to Third-party Risk assessments.
20What application provides the capability to define multiple levels of approvals for an employee with the sn_grc_appr.admin role?
- AMultiple Approver Manager
- BIRQ ApprovalConfigurator
- CMulti-level Approval Manager
- DApproval Configurator
21Which table stores the third-party records?
- AUser [sys_user]
- BVendor [sn_vdr_vendor]
- CDepartment [cmn_department]
- DCompany [core_company]
22Individual metrics from a question bank can be added to a questionnaire template.
- ATrue
- BFalse
23How are Assessment Templates [sn_vdr_risk_asmt_template] related to Questionnaire Templates [asmt_metric_type]?
- ABy the M2M table [sn_vdr_risk_asmt_m2m_asmt_template_questionnaire_template] (Many-to-many)
- BBy a calculated relationship (One-to-one)
- CBy a reference field on Assessment Template [sn_vdr_risk_asmt_template] (Many-to-one)
- DBy a reference field on Questionnaire Template [asmt_metric_type] (One-to-many)
24What is the relationship between records in the third-party element table and records in the third-party element classification table?
- AThe ratio relationship can vary. An element could have no classification, one classification, or many classifications.
- BFor each classification, there can be only one element.
- CFor each element, there can be many classifications.
- DMany elements could have the same classification.
25What type of assessment is used to gather information about a third party's internal security and compliance controls?
- ASecurity Assessment
- BCompliance Assessment
- CRisk Assessment
- DVendor Assessment
26As a final step before closing the Third-party Risk Assessment, what task(s) would the Risk Assessor typically do?
- ACreate issues within the assessment.
- BPerform a tiering assessment.
- CFlag questions for follow up.
- DReview comments and evaluates the risk.
27What application provides the ability to define multiple levels of approvals based on business rule definitions?
- AApprover Levels
- BRisk Approver Configuration
- CTPRM Approvals
- DApproval Configurator
28 To what do third parties have direct access?
- AView other third party's assessment responses.
- BUpdate and respond to issues and tasks.
- CView other third party's issues and tasks.
- DModify issue remediation workflow.
29Which of the following are available out-of-the-box as third-party risk assessment types? (Choose three.)
- ASIG Lite
- BVSA
- CNIST 800-53
- DCloud Security Alliance (CSA)
- EISO 27001
30To which application do you navigate to customize the Third-party Portal?
- AService Portal Home
- BFlow Designer
- CService Portal
- DNow Experience Framework
31When should a Third-party Risk Issue be created? (Choose three.)
- AWhen identifying a risk to a business
- BWhen the third party does not include documentation required as part of an assessment
- CWhen there are items that require additional follow-up
- DWhen a response to a question in the risk assessment is not satisfactory
- EWhen there is more than one third-party contact submitting responses
32Which role is required to manage the third-party portal?
- Asn_vdr_risk_asmt.vendor_risk_assessor
- Bsn_vdr_risk_asmt.vendor_portal_admin
- Csn_vdr_risk_asmt.vendor_risk_admin
- Dsn_vdr_risk_asmt.vendor_risk_manager
33What can primary third-party contacts do in the Third-party Portal? (Choose three.)
- AManage third-party contacts
- BCustomize the Third-party Portal
- CManage assessment templates
- DRespond to issues
- ERespond to assessments
34What types of requests can be made by an employee selecting the Request third-party risk due diligence option? (Choose four.)
- AOffboard an engagement with due diligence
- BDuplicate an engagement
- CReassess an existing engagement for contract renewal
- DReassess an existing engagement
- EOnboard a new engagement
- FCancel an engagement
35What are the features of Third-party Risk Issues? (Choose two.)
- AGenerate audit tasks for the third-party risk team
- BCan only be seen by the customer's risk team
- CCan be generated on-demand or automatically due to an incorrect answer
- DProvide third parties direct access to update and respond to Issues
36What are the element classification values in the ServiceNow baseline for Third-party Risk Management? (Choose three.)
- AFacility
- BPrincipal
- CProduct
- DManufacturer
- EService
37What type of record is each question in an assessment?
- AGRC Task [sn_grc_task]
- BAssessment Metric [asmt_metric]
- CAssessment Instance [asmt_assessment_instance]
- DTask [task]
38What are the application scopes to be considered when making changes to the Vendor Management Workspace? (Choose two.)
- AGRC: Vendor Portal (sn_svdp)
- BVendor Management Workspace UI Components (sn_itsm_vend_comp)
- CCommon Core Workspace (cmn_ws)
- DGRC: Vendor Risk Management Workspace (sn_vrm_ws)
- EGRC: Third-party Risk Management Workspace (sn_tprm_ws)
39If clean data is not provided by the customer, what baseline solutions are available within the platform? (Choose three.)
- AIntegration hub ETL plugin
- BService graph connector
- CSystem import transform map scripts
- DField normalization plugin
- ESystem definition fix scripts module
40What are the benefits of performing a Third-party Risk Assessment? (Choose two.)
- ATo understand with whom you are working when you partner with third parties.
- BTo put the ownership on the third party to prove that they manage risk at a level with which the third party is comfortable.
- CTo have third parties demonstrate that they operate their business at an acceptable risk level to your organization.
- DTo have a stronger negotiating position for future contracts.
41Elements can be defined on an engagement. What do these elements represent?
- ARisk areas defined for the engagement applicable to the third party's delivery of goods, services, or support.
- BAn external organization on which the third party relies to provide goods, services, or support.
- CThe goods, services, or support that is provided by the third party.
- DComponent criteria for the engagement applicable to the third party's delivery of goods, services, or support.
42To what type of assessment record can a third-party contact respond?
- AThird-party tiering assessment
- BThird-party IRQ
- CThird-party risk assessment
- DThird-party Risk Area assessment
43What do third-party risk event-driven rules do?
- AAuto-generate issue records when third parties are not compliant
- BAuto-generate engagements when risk intelligence scores fall below specified levels
- CAuto-generate and send questionnaires and document requests to engagements and third parties
- DAuto-generate and send email notifications to third parties for engagements
44What type of assessment is used to gather information about the services a third party provides?
- ARisk Assessment
- BService Assessment
- CEngagement Assessment
- DPerformance Assessment
45Third-party contacts are stored in the vm_vdr_contact table, which extends from which table?
- Atask
- Bsys_user
- Ccore_company
- DExt_user
46By default, when are reminder notifications for pending assessments sent to the third party contact? (Choose two.)
- A14 days after due date
- B30 days prior to due date
- C7 days prior to due date
- D3 days prior to due date
47What create actions can be triggered from the Rule Actions tab of a Provider-Based Submission Rule? (Choose three.)
- ACreate issue
- BCreate recipient
- CCreate task
- DCreate assessment
- ECreate third party
- FCreate primary contact
48Where are questionnaires and document requests created?
- AAssessment Metric Type
- BQuestion Bank
- CThird-party Portal
- DAssessment Designer
49What can be created with the Template Designer? (Choose two.)
- AQuestionnaire Template
- BDocument Request Template
- CAssessment Template
- DThird-party Risk Assessment
50What methods in the baseline can be used to assign a Third-party Risk Assessment to a third party? (Choose three.)
- AAutomated based on Third-party categorization
- BAutomated based on Security Score rule
- CAutomated based on Third-party Tier rule
- DManual
- EAutomated based on Business Services supported by the third party
51What is the default value appended to the instance URL to access the scoped Third-party Portal according to the sn_vdr_risk_asmt.vendor_portal_endpoint system property?
- A/svp
- B/svdp
- C/tpvp
- D/tpp
52What purpose do ServiceNow third-party risk engagements serve?
- AThey give a third-party risk manager a way to assess risks at the products or services level.
- BThey give a third-party risk manager a way to assess the validity of the third-party assessment responses.
- CThey give a third-party risk manager a way of scheduling workshops with the customer to help the third party become compliant.
- DThey give a way for a third-party risk manager to assess risks and measure third-party CSAT performance.
53In which table are Third-party Risk Tasks stored?
- Asn_vdr_risk_task
- Bsn_vdr_risk_assessment_task
- Csn_vdr_risk_asmt_activity
- Dsn_vdr_risk_asmt_task
54What are ways that the third-party records can be created? (Choose three.)
- ABy manual data entry or through a due diligence onboarding request.
- BFrom existing operator records.
- CThrough the Third-party Portal.
- DBy importing data.
- EThrough integration with an existing supplier management system.
55Which related list is used when relating a Third party assessment question to a Control Objective record?
- AQuestionnaire templates
- BAssessment metrics
- CCategory metrics
- DThird-party questions
56What statement best describes what happens when a question in a Third-party Risk Assessment is related to a Control Objective?
- AAssociated Controls are marked automatically as Non-Compliant or Compliant based on the response of the third party.
- BThe Control Objective is updated as the third party completes the questionnaire.
- CControl Objectives with the Vendor Entity are automatically assigned a Question from a Questionnaire Assessment.
- DA Question can only be related to one Control Objective at a time.
57 In addition to direct third-party assessments, what other hierarchical entities can contribute to the overall third-party risk rating? (Choose two.)
- AEngagements
- BChild third parties
- CEntity class rules
- DAdvanced risk assessments
58What is the primary purpose of the Third-party Tiering assessment?
- ATo determine the financial stability of the third party.
- BTo determine the compliance level of the third party.
- CTo determine the level of risk the third party poses to the organization.
- DTo determine the performance level of the third party.
59All Assessment Metrics within a Metric Category are scored, are rolled up, and get what score range?
- A0-100
- B0-10
- C0-5
- D0-20
60What will be available to Supplier Lifecycle Operations (SLO) from Third-party Risk Management (TPRM) once suppliers respond to assessments if during onboarding, SLO requests due diligence on a supplier from TPRM?
- AContract value
- BNews and other articles
- CManaged documents
- DFinal risk scores
Information
- Description
- ServiceNow Certs ServiceNow Quiz on CIS-TPRM - MOCK 2, created by Flávio Tiezzi on 05/05/2026.
- Author
- Flávio Tiezzi
- Language
- English
- Views
- 5
- History
- Created on 5 May 2026 · updated on 27 May 2026
- Tags
- Rating
- No ratings yet Rate this quiz