ServiceNow CIS-TPRM ServiceNow Certified Implementation Specialist – Third-party Risk Management Exam Practice Test

An element classification is a reusable definition that determines the scoring model applied to a third-party element. Because it is reusable, a single classification record is referenced by many element records. The correct statement is therefore that many elements may share the same classification; every element of a given type, such as a facility, draws on the same scoring definition, which keeps assessment of similar elements consistent.

Statements suggesting that each element can have many classifications are incorrect, since the classification determines the scoring of that element and multiple classifications would create conflicting models. The claim that each classification can only have one element is also wrong, as it would defeat the purpose of defining a classification once. The assertion that an element could have no classification, one, or many describes an unconstrained ratio that does not match the model; an element is scored through its classification, so it is expected to reference one.

The relationship is thus one-to-many from classification to elements. When maintaining the model, a change to a classification, such as revised criteria, affects every element that references it, so changes should be tested carefully and communicated to the assessors who rely on the resulting scores.

A Provider-Based Submission Rule evaluates incoming data from a risk intelligence provider and responds to defined conditions. The Rule Actions tab lets an administrator specify the records the rule will generate when its conditions are satisfied. The create actions available are Create assessment, Create issue and Create task, each applied to the third parties identified by the rule.

These three actions correspond to the principal work records of the application: an assessment to gather evidence, an issue to track a concern needing remediation, and a task to track follow-up work. Together they allow an externally sourced signal, such as a deterioration in a provider score, to trigger a proportionate internal response without manual intervention.

Creating a third party or a primary contact is not offered because the rule operates on third parties that already exist; it acts on them and does not register them. A recipient is not a work record either. Recipients define who is notified and are configured as notification targets rather than created as an action outcome.

During implementation, test each rule with representative provider payloads to confirm that the intended third party is matched and that duplicate assessments or issues are not generated on repeated submissions.

Third-party Risk Issues have two characteristics reflected in the correct options. They can be generated on demand by an assessor or automatically, for example when a response to a question in an external assessment is evaluated as incorrect. They also support collaboration with the third party: contacts use the Third-party Portal to view and respond to issues raised by the risk team, so remediation evidence can be exchanged without email.

Generating audit tasks is not a feature of issues. Audit work belongs to audit management and engagements, while issues in this application drive remediation conversations with the third party. The statement that issues can only be seen by the customer's risk team is also incorrect, because third-party contacts see issues that have been shared with them and are assigned within their organization.

For design purposes, this duality matters: internal-only issues exist for matters not intended for the third party, while shared issues move through states that include third-party submission and finalization. Visibility is governed by the state and by the access granted to the third-party contact, not by a blanket restriction.

Automatic issue generation should be paired with sensible thresholds to avoid flooding assessors with low-value records.

The Request third-party risk due diligence option lets an employee submit a structured request that starts due diligence on a third party or engagement. The supported request types are onboarding a new engagement, reassessing an existing engagement, reassessing an existing engagement for contract renewal, and offboarding an engagement with due diligence. Each type determines the questions the requester answers and the assessment activity that follows.

Duplicating an engagement is a record-management operation and cancelling an engagement is a lifecycle action; neither requests due diligence, so both are excluded. Offboarding without due diligence also exists as a lifecycle path, but it is not offered here because the selection is specific to due-diligence requests.

The value of this design lies in its consistency. A business user who wants to engage a supplier does not need to understand questionnaires or tiering; the request captures context such as the engagement, the products or services involved, and the business owner, and the risk team then drives the assessment. Reassessment variants allow existing relationships to be re-evaluated at renewal without creating duplicate third-party records.

Third-party records can be populated in three ways. They can be created through integration with an existing supplier management system, which synchronizes records from a system of record and prevents duplicate entry. They can be created by manual data entry or as the result of a due diligence onboarding request, where a business requester proposes a new third party for evaluation. They can also be loaded by importing data, using import sets and transform maps against the Company table.

The Third-party Portal is not a creation channel. Portal users are existing contacts who respond to assigned work, and they cannot register new third-party organizations. Existing operator records are likewise not a source; this refers to a construct unrelated to third-party onboarding and would not generate third-party records.

These routes carry different data-quality implications. Integration and imports demand clean, normalized data, including consistent naming to avoid duplicates, while manual entry and onboarding requests depend on user discipline. Implementers should select the primary creation method, document the ownership of the data, and use hierarchy fields such as Parent to represent subsidiaries at the time of load, so that subsequent rollup scoring operates correctly.

Event-driven rules automate outreach. When a defined event occurs, the rule automatically generates and sends questionnaires and document requests to engagements and third parties. This removes the need for a manager to manually create assessments in response to changes, for instance a new engagement, a tier change or the approach of a renewal date.

The rules do not generate issue records when third parties are not compliant; issues arise from assessment responses or manual identification during review. They do not create engagements when risk intelligence scores decline, because engagements represent contractual relationships and are not produced by monitoring data; score-based activity is handled by provider-based submission rules and security score triggers. Although email notifications may accompany the process, the rule's purpose is not to send standalone notifications; the substantive output is the assessment content issued to the recipient.

For implementation, an event-driven rule should be planned with its triggering condition, the target third parties or engagements, and the templates to send. Because a rule can issue requests to many external parties at once, it should be tested in a sub-production instance and reviewed by the risk manager before activation.

The scoped Third-party Portal is reached by appending the /svdp endpoint to the instance URL. The value is defined by the system property sn_vdr_risk_asmt.vendor_portal_endpoint, and its default of svdp corresponds to the application scope for the portal. A contact would therefore browse to the instance address followed by /svdp to reach the login and landing page.

The other values are not baseline endpoints. The abbreviations /tpp and /tpvp resemble plausible third-party portal names but are not defined by default, and /svp omits the d that identifies the vendor-derived scope name. Using a nonexistent suffix returns a page-not-found result for the contact, which commonly generates support requests after go-live.

Administrators may change the property to align the URL with corporate naming conventions, but any change must be communicated to contacts and reflected in notification templates that embed the portal link. Because the portal URL appears in invitations and reminders, the property should be finalized before large-scale invitations are issued.

When troubleshooting access, verify the property value first, then the contact's account status and role assignment.

Issues are created from assessment responses after the assessment moves to the Generating Observations state. At this stage the third party has returned its responses, and the assessor reviews them, evaluating answers against expectations. Incorrect or unsatisfactory answers can produce issues, either through automatic generation or when the assessor raises them manually, and the resulting issues can then be managed and shared with the third party as needed.

Issues cannot be created at any time that one question has been answered, since a partially completed assessment has not yet been returned for review and premature issue creation would address incomplete information. The Submitted to Third-party state indicates that the assessment is with the third party for response, so the assessor has no completed responses to evaluate. The Finalizing with Third-party state occurs later, after observations have been generated and the exchange of findings is being concluded, so it is too late to originate issues from the response review.

This ordering ensures that issues are based on complete data and that remediation can be agreed with the third party before the assessment is closed. Assessors should confirm that all required responses and documents have been received before progressing to Generating Observations.

The overall risk rating of a third party is not derived solely from its own direct assessments. It also takes into account entities arranged beneath it in the hierarchy. Engagements contribute, because they represent the specific products or services supplied and carry their own assessment results. Child third parties, such as subsidiaries recorded with the primary third party as their parent, also contribute, with their risk ratings feeding into the primary third party's rating, which is calculated as a weighted average.

Advanced risk assessments are not a hierarchical entity; they describe a type or depth of assessment and not a level in the hierarchy that rolls into the rating. Entity class rules are configuration constructs that classify or drive behavior and are not entities that contribute a rating.

The rollup supports a realistic view of exposure. A parent organization with a high-risk subsidiary, or a low-risk third party with a single critical engagement, should not appear uniformly low risk. Implementers should therefore model subsidiaries as separate records with the Parent field populated and define engagements for the distinct services provided, so that the rating reflects the whole relationship.

Weighting should be reviewed so that no single child distorts the result.

Creating an element classification automatically generates a corresponding classification component definition record. The component definition describes the components that will be evaluated for elements assigned that classification, and it provides the structure to which scoring criteria are later attached. The platform produces it to guarantee that every classification has a definition ready for configuration.

Classification component criteria are different records. They hold the detailed conditions used to evaluate each component and are configured by the administrator after the definition exists; they are not created automatically with the classification. Engagement component definitions and criteria belong to the engagement side of the model, where scoring is applied to engagements, and they are not generated when an element classification is created.

Understanding this sequence is useful when configuring a custom classification. After creating the classification, the administrator opens the generated component definition, adds the components that matter for that type of element, and then defines criteria that translate answers into scores. Skipping the criteria leaves the classification without meaningful scoring, even though the definition record exists.

Testing with a sample element confirms that scores calculate as intended before the classification is used in production assessments.

The baseline element classifications delivered with Third-party Risk Management are Service, Product and Facility. A classification describes the nature of what a third party's dependency provides, and it determines the scoring model and the element questionnaires applied. The sample content accordingly includes questionnaires directed at products and at facilities, reflecting the different risk questions each category raises: a facility is assessed for physical security and continuity, whereas a product is assessed for security of the product itself.

Principal and Manufacturer are not baseline classifications. They may describe roles in a supply relationship, but they are not delivered values, and an organization wishing to use them would have to create them as additional classifications.

Because classifications are reusable, defining them once allows many elements to share the same scoring model, which promotes consistent assessment. When adding custom classifications, define the associated component definitions and criteria so that the new classification produces meaningful scores. Excessive custom classifications fragment reporting, so organizations should first test whether the three baseline values adequately describe their dependencies.

The Approval Configurator is the application used to define multiple approval levels based on business-rule definitions. Part of the GRC approver framework, it lets an administrator build configurations in which conditions determine which approvers are required and at what level, so that approval requirements adapt to attributes of the record being approved, for example its risk rating or its financial impact.

The alternative names are not delivered applications. A Risk Approver Configuration, an Approver Levels module and a TPRM Approvals module sound plausible, but approvals in this context are not managed by a dedicated third-party risk approvals application; the shared configurator serves that purpose across GRC products.

The use of business rule definitions is what distinguishes this from a fixed approval chain. Rather than hard-coding approvers into workflows, the administrator expresses conditions and levels declaratively, which makes the arrangement maintainable as organizational structure changes. In Third-party Risk Management this supports governance of issue acceptance, exceptions and similar decisions that warrant escalating scrutiny.

When implementing, define approver groups first, then create the configuration with its levels and conditions, and test with sample records to confirm the right approvers are invoked at each level.

The third-party contact table, vm_vdr_contact, extends the User table [sys_user]. By inheriting from sys_user, a contact receives the standard user attributes, including name, email address and credentials, as well as the capabilities of the platform's authentication and notification services. This is what allows a contact to log in to the Third-party Portal and to receive email notifications from the application.

The task table is a work item parent and has no relevance to person records. The ext_user table is not the parent of contacts. The Company table [core_company] holds organizations; the third-party record is held there, and the contact relates to it through a reference field, not by extending it.

This inheritance has implementation consequences. Contacts are subject to user-level controls such as access control rules, roles and, where configured, restrictions on internal functionality, so the integrity of their role assignments is essential to keeping them confined to the portal. Importing contacts also follows the user data model, so email addresses must be unique and valid, and administrators should confirm that the contact is linked to the correct third party before invitations are sent.

The Third-party Risk Assessor role is designed for analysts who administer day-to-day assessment work. It permits management of third parties, third-party contacts, external risk assessments and issues, and it inherits assessment-review permissions that expose assessment and questionnaire data.

Consequently the role can create issues for a third party, access completed assessments submitted by third parties, and create a Primary Contact record for a third party so that the correct individual receives questionnaires and portal access.

Updating contract deadlines belongs to contract and engagement management responsibilities and is not part of the assessor function. Enabling communications across third parties is also outside scope; third parties are isolated from one another by design, and each contact sees only the records assigned to that third party. Allowing cross-third-party communication would breach confidentiality expectations that the portal is built to protect.

When mapping roles during implementation, keep the separation clear: the manager configures rules and templates, the assessor executes and reviews assessments, and contacts respond externally. Assigning assessor access to staff who only need read access to results is an unnecessary expansion of privilege.

The organization name presented to third-party contacts is controlled by the system property sn_vdr_risk_asmt.company.name. Setting this value replaces the default name wherever the Third-party Portal and its associated communications refer to the organization, so contacts see the correct customer identity when responding to questionnaires and document requests.

The remaining choices are variants that do not match the application's property naming. One omits the vdr segment that identifies the third-party risk scope, another truncates the property so it would not resolve to an existing record, and the last drops the trailing name element, which would describe a different, nonexistent property. Property names must be exact, because a near match creates an unused system property and leaves the displayed name unchanged.

When branding the portal, administrators generally combine this property with portal-level customization such as the logo, theme and page content, which are maintained separately in the portal configuration. Verifying the result by opening the portal as a test contact in a private session confirms the name appears as expected.

Within an external assessment, questionnaires and document requests are tracked as independent items, and the Third-party Portal presents each as a separate request. Because they are separate, they can be assigned to different third-party contacts. A primary contact can delegate a questionnaire to a colleague with the subject knowledge, for example a security officer, while a legal or compliance contact handles the document requests.

The statement that they appear as a single assessment is incorrect, as the assessment is the parent record that groups the requests, whereas the contact sees and works through the individual items. The restriction that they can only be assigned to the same contact is also wrong; delegation to multiple eligible contacts is a supported capability intended to mirror how real organizations distribute responsibility. The reference to assigning to a single engagement contact introduces a concept that is not part of this behavior, since assignment is made to third-party contacts, not to engagement contacts.

For implementation, ensure that all intended respondents exist as contacts on the third-party record before the assessment is issued, and that the primary contact understands the delegation process. This reduces delays caused by a single person being a bottleneck.

Third-party records in Third-party Risk Management are held in the Company table [core_company]. The application builds on the platform's existing company data model, where an organization flagged as a third party carries the attributes the application needs, such as tier, risk rating and related contacts. This avoids a parallel data store and lets other ServiceNow applications that reference companies, including procurement and contract management, work with the same record.

The Department table [cmn_department] represents an internal organizational unit and has no relationship to external parties. The User table [sys_user] holds individual people; third-party contacts are people who extend this table, but the third party itself is the organization, not the individual. A table named sn_vdr_vendor is not the store for third-party records and should not be used as the target for imports or reports.

For implementation, this has direct consequences for data loading. Import sets and integrations with supplier management systems should target the Company table, with the third-party indicator set and parent relationships populated where subsidiaries exist, so that tiering, assessment generation and rollup scoring behave correctly.

Within a metric category, each assessment metric is scored, and the individual scores are rolled up into a category score expressed on a normalized scale of 0 to 100. The same scale applies to the scores of categories and to the resulting assessment and risk scores. A common range allows scores from different categories and assessments to be combined, compared and measured against thresholds.

Narrower ranges such as 0 to 5, 0 to 10 or 0 to 20 are not the convention for the roll-up. Individual metrics may have their own response weightings, but they are normalized when aggregated, which makes the category result comparable regardless of the number of questions or the weights of each.

The practical significance is in rating configuration. Risk rating thresholds, for example the boundaries separating low, moderate and high risk, are defined against the normalized scale, and category weights determine how each category contributes to the assessment score. Misunderstanding the scale leads to poorly set thresholds and ratings that do not reflect the organization's tolerance.

When designing questionnaires, assign metric weights thoughtfully, review category weights for balance, and test sample responses to confirm that the resulting scores and ratings behave as intended before releasing the template for production use.