CTPRP FINAL EXAM 2026/2027 QUESTIONS AND
SOLUTIONS RATED A+
✔✔top ten vulnerabilities (OWASP) - ✔✔-Injection
-Broken Authentication
-Sensitive Data Exposure
-XML External Entities (XXE)
-Broken Access Control
-Security Misconfiguration
-Cross-Site Scripting (XSS)
-Insecure Deserialization
-Using Components with Known Vulnerabilities
-Insufficient Logging & Monitoring
✔✔threat modeling - ✔✔-vulnerability testing
-penetration testing
-data input validation
-validation checks
✔✔phishing - ✔✔targeted emails trying to get the user to click a link or download a
program
✔✔business risks - ✔✔-human capital
-strategic
-reputational
-technology
-operational
-legal
-external
-financial
✔✔risk governance plan - ✔✔enables the organization to identify, quantify and prioritize
risks based on the risk acceptance levels relevant to the organization
✔✔information security policy - ✔✔approved by mgmt and serves as foundation for the
info security controls of an organization (includes incident mgmt and exception process)
✔✔administrative info sec controls - ✔✔HR, BCP, third party risk, asset mgmt, data
classification, firewalls, malicious code preventions, outboud filtering, security
monitoring
✔✔technical info sec controls - ✔✔network access, user access, operating systems,
application development
, ✔✔Compliance standards and policies should include: - ✔✔-regulatory, statutory,
and/or contractual obligations
-corporate governance
-ethics & business practices
-marketing and selling practices
-operational compliance requirements
✔✔audits should ensure compliance with: - ✔✔-corporate
-legal
-regulatory
-industry requirements
✔✔Privacy Management Framework should: - ✔✔-maintain personal data inventory
-maintain data privacy policy & notices
-maintain training and awareness program
-manage info security risk
-manage third party risk
-maintain procedures for inquiries and complaints
-maintain data privacy breach mgmt program
-monitor data handling practices
✔✔background and employment verification - ✔✔-education
-identity verification (SSN)
-certification and license verification
-social media sites
-optional based on industry (OFAC, drug testing, credit check, finger printing)
✔✔out of wallet authentication - ✔✔-information about a user not readily available in
financial data bases
-negatively impacted by growth in social media
✔✔multi-factor authentication - ✔✔-requires that additional (multiple) credentials be
provided
-often requires something the user knows and something they possess as credentials
✔✔end user device - ✔✔any electronic device that accesses your data
✔✔mobile data protection - ✔✔-data encryption
-backup/restore
-data tracking
✔✔Server security evaluation should include: - ✔✔-system types (windows, unix,
virtual, etc.)
-system operations
-system hardening
SOLUTIONS RATED A+
✔✔top ten vulnerabilities (OWASP) - ✔✔-Injection
-Broken Authentication
-Sensitive Data Exposure
-XML External Entities (XXE)
-Broken Access Control
-Security Misconfiguration
-Cross-Site Scripting (XSS)
-Insecure Deserialization
-Using Components with Known Vulnerabilities
-Insufficient Logging & Monitoring
✔✔threat modeling - ✔✔-vulnerability testing
-penetration testing
-data input validation
-validation checks
✔✔phishing - ✔✔targeted emails trying to get the user to click a link or download a
program
✔✔business risks - ✔✔-human capital
-strategic
-reputational
-technology
-operational
-legal
-external
-financial
✔✔risk governance plan - ✔✔enables the organization to identify, quantify and prioritize
risks based on the risk acceptance levels relevant to the organization
✔✔information security policy - ✔✔approved by mgmt and serves as foundation for the
info security controls of an organization (includes incident mgmt and exception process)
✔✔administrative info sec controls - ✔✔HR, BCP, third party risk, asset mgmt, data
classification, firewalls, malicious code preventions, outboud filtering, security
monitoring
✔✔technical info sec controls - ✔✔network access, user access, operating systems,
application development
, ✔✔Compliance standards and policies should include: - ✔✔-regulatory, statutory,
and/or contractual obligations
-corporate governance
-ethics & business practices
-marketing and selling practices
-operational compliance requirements
✔✔audits should ensure compliance with: - ✔✔-corporate
-legal
-regulatory
-industry requirements
✔✔Privacy Management Framework should: - ✔✔-maintain personal data inventory
-maintain data privacy policy & notices
-maintain training and awareness program
-manage info security risk
-manage third party risk
-maintain procedures for inquiries and complaints
-maintain data privacy breach mgmt program
-monitor data handling practices
✔✔background and employment verification - ✔✔-education
-identity verification (SSN)
-certification and license verification
-social media sites
-optional based on industry (OFAC, drug testing, credit check, finger printing)
✔✔out of wallet authentication - ✔✔-information about a user not readily available in
financial data bases
-negatively impacted by growth in social media
✔✔multi-factor authentication - ✔✔-requires that additional (multiple) credentials be
provided
-often requires something the user knows and something they possess as credentials
✔✔end user device - ✔✔any electronic device that accesses your data
✔✔mobile data protection - ✔✔-data encryption
-backup/restore
-data tracking
✔✔Server security evaluation should include: - ✔✔-system types (windows, unix,
virtual, etc.)
-system operations
-system hardening
