Free Certified Implementation Specialist – Third-party Risk Management Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Implementation Specialist – Third-party Risk Management practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which TPRM capability centralizes interactions with third parties?

   1. A.Concentration risk map
   2. B.Third-party portalCorrect answer: B
   3. C.Third-party risk scoring framework
   4. D.Third-party risk management workspace

   Explanation: ServiceNow describes the portal as: "Centralize all Third-party interaction is in a Third-party portal". The map provides a risk view, the scoring framework calculates scores, and the workspace supports the internal risk team.

   Reference: How-to: Third-party Risk Management — Page 7, Third-party risk building blocks

2. 2In the ServiceNow description of the third-party portfolio, which records are flagged as external vendors and integrated with the portfolio?

   1. A.Company recordsCorrect answer: A
   2. B.Due diligence request records
   3. C.Risk assessment records
   4. D.Risk intelligence score records

   Explanation: ServiceNow explains: "External vendors are flagged in the Company table. These records are integrated with the Third-party Portfolio to capture related contacts and fulfilled business services." The portfolio uses company records to represent external vendors.

   Reference: Achieving DORA Compliance with ServiceNow at Heart — Identify IT assets and systems supporting core business functions; Third-party Portfolio

3. 3For which third-party engagements can a business user request due diligence through the Employee Center, according to the TPRM overview?

   1. A.Only engagements with an executed contract
   2. B.Only new third-party engagements
   3. C.New or existing third-party engagementsCorrect answer: C
   4. D.Only engagements being offboarded

   Explanation: ServiceNow states: "Business users can now request due diligence for a new or existing Third-party engagement". Requests are not restricted to onboarding.

   Reference: How-to: Third-party Risk Management — Page 9, Third-party risk end user interface

4. 4Which role grants a third-party contact access to the Third-party Portal according to ServiceNow's portal implementation guidance?

   1. A.vendor_contactCorrect answer: A
   2. B.snc_internal
   3. C.snc_external
   4. D.vendor_reader

   Explanation: The guidance states: "The `vendor_contact` role grants access to the Third-Party Portal". The snc_external role restricts the user's access scope.

   Reference: Third-Party Risk Management: Implementing a Third-Party Portal — TPRM FAQs, roles assigned to third-party contacts

5. 5How can a third-party risk issue enter the New state in the documented issue lifecycle?

   1. A.Manually or automaticallyCorrect answer: A
   2. B.Manually but never automatically
   3. C.Automatically but never manually
   4. D.Neither manually nor automatically

   Explanation: The lifecycle says: "Issue is created manually or automatically". Both creation paths can produce a new issue.

   Reference: Third-party Risk Issue and Remediation Workflow in TPRM — Page 6, Lifecycle of Third-party Risk Issue and Remediation Task

6. 6What does ServiceNow state about running TPRM and pairing it with other ServiceNow applications?

   1. A.It can run alone and can integrate with other applicationsCorrect answer: A
   2. B.It can run alone but cannot integrate with GRC applications
   3. C.It requires Policy & Compliance before it can run
   4. D.It requires Risk Management before it can run

   Explanation: The overview states: "The TPRM application can stand alone, but there is great synergy in pairing it with other ServiceNow applications." Integration is available, not universally required.

   Reference: How-to: Third-party Risk Management — Page 12, Third-party risk with GRC integration

7. 7Which TPRM capability integrates targeted scores and ratings for continuous monitoring?

   1. A.Third-party risk workspace
   2. B.Risk intelligenceCorrect answer: B
   3. C.Concentration risk map
   4. D.Third-party portal

   Explanation: ServiceNow describes risk intelligence and ongoing monitoring as: "Integrate targeted risk intelligence scores and ratings for insights and continuous monitoring." The map visualizes risk, the workspace supports the internal team, and the portal centralizes third-party interaction.

   Reference: How-to: Third-party Risk Management — Page 7, Risk intelligence and ongoing monitoring

8. 8In the documented third-party portal setup, what can a primary contact create for the relationship?

   1. A.Additional third-party or engagement contactsCorrect answer: A
   2. B.Additional third-party contacts but no engagement contacts
   3. C.Engagement contacts but no third-party contacts
   4. D.No additional contacts for either type

   Explanation: ServiceNow states: "The primary contacts setup additional contacts as Third-party / Engagement contacts". Primary contacts can therefore add the contacts who will participate in the relationship.

   Reference: External Assessments to Risk Assess Third-party and Engagements — Page 6, Pre-requisites to External Assessments; Third-party portal access

9. 9When a business user selects the due diligence type in Employee Center, which intake behaviors can change?

   1. A.Both information collection and pre-populationCorrect answer: A
   2. B.Information collection but not pre-population
   3. C.Pre-population but not information collection
   4. D.Neither information collection nor pre-population

   Explanation: The overview says: "Information Collection and pre-population will change based on selection". The selected request type affects the information presented during intake.

   Reference: How-to: Third-party Risk Management — Page 9, Third-party risk end user interface

10. 10What is the purpose of the snc_external role for a third-party portal contact in the implementation guidance?

    1. A.Restrict the external user's access to the portalCorrect answer: A
    2. B.Grant the user unrestricted internal instance access
    3. C.Replace the portal access grant from vendor_contact
    4. D.Grant internal roles automatically to the contact

    Explanation: The guidance says: "`snc_external` restricts access to only the portal, preventing unauthorized entry into the entire instance." It limits access; vendor_contact supplies portal access.

    Reference: Third-Party Risk Management: Implementing a Third-Party Portal — TPRM FAQs, roles assigned to third-party contacts