Swift CSP-ASSESSOR Online Practice Questions and Exam Preparation

Swift CSP-ASSESSOR Online Questions & Answers

• Question 1:

  The SWIFT HSM Box must be hardened at the system level by the SWIFT user owning the equipment. Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. TRUE
  B. FALSE
  A. TRUE

• Question 2:

  The internet connectivity restriction control prevents having internet access on any CSCE m-scope components.

  

  A. TRUE
  B. FALSE
  B. FALSE

• Question 3:

  In the case that nothing has changed in the SWIFT user's infrastructure, is it possible to rely on a previous Independent assessment report without performing another independent assessment? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. Yes, full reliance can be provided without the need of an independent assessment if nothing has changed
  B. No, even if nothing has changed, an independent assessor needs to assess the conditions before being able to rely on the previous year's assessment
  C. No, even if nothing has changed, an independent assessor needs to perform a full assessment including full testing every year
  D. Yes, full reliance can be provided if the CISO of the SWIFT user signs a letter which confirms that nothing has changed
  B. No, even if nothing has changed, an independent assessor needs to assess the conditions before being able to rely on the previous year's assessment

• Question 4:

  On which one of the following components must a Password/PIN Policy not be defined and implemented as per the CSCF? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls

  A. Operator PCs, (physical or virtual) systems running SWIFT-related components, network devices protecting the secure zone(s), bridging servers
  B. Jump server(s), SWIFT-related components at application level
  C. Personal tokens or mobile devices used as a possession factor
  D. All equipment within the user environment
  C. Personal tokens or mobile devices used as a possession factor

• Question 5:

  Can an assessor re-use an ISAE 3000 report dating back 2 years to support an independent assessment?

  

  A. No, that is too old, the maximum is 18 months
  B. Yes, there is no time limit for an iSAE 3000 report
  C. No, the SAE 3000 report is no validsurrogateas a rule
  D. Yes, provided there is no change to the Swift user's infrastructure
  C. No, the SAE 3000 report is no validsurrogateas a rule

• Question 6:

  The Physical Security protection control is also aimed at protecting the "on call" and "working from home" employees' equipment used to access the Swift-related components.

  

  A. TRUE
  B. FALSE
  A. TRUE

• Question 7:

  Who can connect to SWIFT? (Select all answers that apply) Connectivity Generic Products Cloud Products OnPrem Security

  A. Financial institutions, such as banks and securities broker-dealers
  B. Individuals who use online banking for international transfers
  C. Market infrastructures that provide financial institutions with centralized transaction processing
  D. Corporates that work with multiple banking partners
  A. Financial institutions, such as banks and securities broker-dealers
  C. Market infrastructures that provide financial institutions with centralized transaction processing
  D. Corporates that work with multiple banking partners

• Question 8:

  The Swift user has an sFTP server to push files to an outsourcing agent hosting the Swift users own Communication interface. What is their architecture type?

  

  A. A1
  B. B
  C. A3
  D. A4
  C. A3

• Question 9:

  In the illustration, identify which components are in scope of the CSCF? (Choose all that apply.)

  

  A. Components A, B, K
  B. Components J, K, I
  C. Components F, G, H
  D. Components C, E, M
  C. Components F, G, H
  D. Components C, E, M

• Question 10:

  A Treasury Management System (TMS) application is installed on the same machine as the customer connector, connecting to a Service Bureau. Are these applications/systems in scope of CSCF? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. The TMS application, the customer connector, and the hosting system are in the scope of the CSCF
  B. Only the customer connector application is in scope of the CSCF. The TMS application is a back-office
  C. The TMS application is the highest risk and must be secured appropriately. The customer connector should be secured on a best effort basis
  D. The TMS application, the customer connector, and the hosting system are in scope only if they connect directly to SWIFT, not towards a Service Bureau
  A. The TMS application, the customer connector, and the hosting system are in the scope of the CSCF