Swift CSP-ASSESSOR Online Practice Questions and Exam Preparation

Swift CSP-ASSESSOR Online Questions & Answers

• Question 1:

  A Treasury Management System (TMS) application is installed on the same machine as the customer connector, connecting to a Service Bureau. Are these applications/systems in scope of CSCF? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. The TMS application, the customer connector, and the hosting system are in the scope of the CSCF
  B. Only the customer connector application is in scope of the CSCF. The TMS application is a back-office
  C. The TMS application is the highest risk and must be secured appropriately. The customer connector should be secured on a best effort basis
  D. The TMS application, the customer connector, and the hosting system are in scope only if they connect directly to SWIFT, not towards a Service Bureau
  A. The TMS application, the customer connector, and the hosting system are in the scope of the CSCF

• Question 2:

  The Swift HSM boxes:

  

  A. Are located at the network partner premises and managed by Swift
  B. Are located at the Swift user premises and managed by Swift
  C. Are located at the Swift user premises and managed by the Swift user
  D. Are located at the network partner premises and managed by Swift the network partner
  C. Are located at the Swift user premises and managed by the Swift user

• Question 3:

  In the case that nothing has changed in the SWIFT user's infrastructure, is it possible to rely on a previous Independent assessment report without performing another independent assessment? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. Yes, full reliance can be provided without the need of an independent assessment if nothing has changed
  B. No, even if nothing has changed, an independent assessor needs to assess the conditions before being able to rely on the previous year's assessment
  C. No, even if nothing has changed, an independent assessor needs to perform a full assessment including full testing every year
  D. Yes, full reliance can be provided if the CISO of the SWIFT user signs a letter which confirms that nothing has changed
  B. No, even if nothing has changed, an independent assessor needs to assess the conditions before being able to rely on the previous year's assessment

• Question 4:

  Must all CSCF controls be subject to an assessment? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. Yes
  B. No, only the mandatory controls
  C. No, only the attested controls (with as a minimum the mandatory ones according to the architecture type)
  D. No, the controls selection is agreed upfront between the SWIFT User and the assessor
  C. No, only the attested controls (with as a minimum the mandatory ones according to the architecture type)

• Question 5:

  Which of the following statements best describes the difference between an audit and an assessment as per SWIFT CSP definitions? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. An audit is a comprehensive review of a customer's controls to ensure they meet regulatory requirements, while an assessment is a very high-level review of controls to identify potential weaknesses
  B. An audit looks at the defined controls design and implementation compliance and follows recognized international audit standards, whereas an assessment is less strict but aims the same common objectives
  C. An audit is a one-time event, while an assessment is an ongoing process of monitoring and improving security controls
  D. An audit and an assessment can be used interchangeably
  B. An audit looks at the defined controls design and implementation compliance and follows recognized international audit standards, whereas an assessment is less strict but aims the same common objectives

• Question 6:

  On which one of the following components must a Password/PIN Policy not be defined and implemented as per the CSCF? (Select the correct answer) Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls

  A. Operator PCs, (physical or virtual) systems running SWIFT-related components, network devices protecting the secure zone(s), bridging servers
  B. Jump server(s), SWIFT-related components at application level
  C. Personal tokens or mobile devices used as a possession factor
  D. All equipment within the user environment
  C. Personal tokens or mobile devices used as a possession factor

• Question 7:

  How are online SwiftNet Security Officers authenticated?

  

  A. Via their PKI certificate
  B. Via their swift.com account and secure code card
  C. Via their swift.com account
  B. Via their swift.com account and secure code card

• Question 8:

  A Swift user relies on a sFTP server to connect through an externally exposed connection with a service provider or a group hub What architecture type is the Swift user? (Choose all that apply.)

  

  A. A1
  B. A2
  C. A3
  D. A4
  B. A2
  D. A4

• Question 9:

  For each of the following setups, the responsible party is identified to protect the virtualization or cloud underlying platform. Which one of the combinations is not correct? Swift Customer Security Controls Policy Swift Customer Security Controls Framework v2025 Independent Assessment Framework Independent Assessment Process for Assessors Guidelines Independent Assessment Framework - High-Level Test Plan Guidelines Outsourcing Agents - Security Requirements Baseline v2025 CSP Architecture Type - Decision tree CSP_controls_matrix_and_high_test_plan_2025 Assessment template for Mandatory controls Assessment template for Advisory controls CSCF Assessment Completion Letter Swift_CSP_Assessment_Report_Template

  A. For on-premises virtualization platform: by the platform provider
  B. For virtualization platform deployed at a third party on which user's SWIFT-related components are virtually hosted: by the third party
  C. For on-premises container platform: by the SWIFT user
  D. For Cloud Provider: the cloud provider
  A. For on-premises virtualization platform: by the platform provider

• Question 10:

  Which of the following infrastructures has the smallest SWIFT footprint? (Select the correct answer) Connectivity Generic Products Cloud Products OnPrem Security

  A. Full stack of products up to the Messaging Interface
  B. Alliance Remote Gateway
  C. Lite 2 or Alliance Cloud
  D. A user with a Messaging Interface behind a Service Bureau
  C. Lite 2 or Alliance Cloud