CSP-Assessor Actual Questions - Instant Download 118 Questions [Q33-Q57]

CSP-Assessor Actual Questions - Instant Download 118 Questions

Download Free Latest Exam CSP-Assessor Certified Sample Questions

NEW QUESTION # 33
What is expected regarding Token Management when (physical or software-based) tokens are used? (Choose all that apply.)

• A. Similar to user accounts, individual assignment and ownership for accurate traceability and revocation in case of potential tampering, loss or in case of user role change
• B. All tokens must be stored in a safe when not used
• C. Have in place a strict token assignment process. This avoids the need to perform g a regular review of assigned tokens
• D. Individuals must not share their tokens. Tokens must remain under the control and supervision of its owner

Answer: A,D

Explanation:
This question relates to Control 5.2 - Token Management in the CSCF, which outlines requirements for managing physical or software-based tokens used for authentication or cryptographic operations in the SWIFT environment. Let's evaluate each option:
* A. Similar to user accounts, individual assignment and ownership for accurate traceability and revocation in case of potential tampering, loss or in case of user role change
* CSCF Control 5.2 mandates that tokens (e.g., HSM tokens or software tokens) be uniquely assigned to individuals to ensure traceability and accountability. This allows for revocation in cases of tampering, loss, or role changes, mirroring user account management principles under Control 5.1 - Logical Access Control.

NEW QUESTION # 34
In the illustration, identify which components are in scope of the CSCF? (Choose all that apply.)

• A. Components A, B, K
• B. Components C, E, M
• C. Components J, K, I
• D. Components F, G, H

Answer: B,D

Explanation:
The Swift Customer Security Controls Framework (CSCF) defines the scope of components that must comply with its security controls. This scope is detailed in theCSCF v2024(and prior versions like CSCF v2023), which specifies that the CSCF applies to systems directly involved in the Swift messaging and connectivity ecosystem. Let's analyze the diagram to identify which components fall within this scope.
Step 1: Understand the Scope of CSCF
According to theSwift Customer Security Controls Framework (CSCF) v2024, the scope includes:
* Swift messaging interfaces(e.g., Alliance Access/Entry, RMA).
* Communication interfacesto the Swift network (e.g., SNL, HSM, PKI).
* Operator systemsdirectly interacting with Swift components (e.g., GUIs, admin/operator workstations).
* Middlewareor connectors directly facilitating Swift message flows.Systems that are not directly involved in Swift messaging or connectivity (e.g., back-office systems, general-purpose servers) are typically out of scope unless they pose a direct risk to the Swift environment.
Step 2: Analyze the Diagram and Identify Components
The diagram includes the following labeled components:
* A. Back Office: A system for back-office operations, not directly part of Swift messaging.
* B. Back Office Using Middleware Client: A back-office system with middleware for data exchange.
* C. Messaging Interface: Likely a Swift messaging interface (e.g., Alliance Access).
* D. RMA: Relationship Management Application, a Swift component for managing messaging relationships.
* E. GUI: Graphical User Interface for operators to interact with the messaging interface.
* F. Communication Interface: Interface for connecting to the Swift network.
* G. SNL: SwiftNet Link, a communication layer for Swift connectivity.
* H. HSM & PKI: Hardware Security Module and Public Key Infrastructure, used for secure Swift connectivity.
* I. Middleware File Transfer Servers: Servers facilitating data exchange between back-office and Swift systems.
* J, K, L. Data Exchange Paths: Represent data flows between systems (not components themselves).
* M. Operator (End User): The operator's workstation interacting with the Swift GUI.
* N. Connector: The connection point to the Swift network.
Step 3: Evaluate Each Option Against CSCF Scope
* A. Components A, B, K
* A (Back Office): Back-office systems are not in scope unless they directly process Swift messages. The CSCF focuses on Swift-specific infrastructure, and back-office systems are typically considered out of scope unless they pose a direct risk (e.g., via middleware).
* B (Back Office Using Middleware Client): While this system uses middleware to exchange data with Swift components, it is still a back-office system, not a core Swift component. The middleware itself (I) may be in scope, but the client (B) is not.
* K (Data Exchange Path): This is a data flow, not a component, and thus not directly in scope.
Conclusion: This option is incorrect.
* B. Components J, K, I
* J, K (Data Exchange Paths): These are data flows, not components, and are not directly in scope.
* I (Middleware File Transfer Servers): Middleware that facilitates Swift message flows (e.g., between back-office and messaging interface) can be in scope if it directlyprocesses or transmits Swift messages. PerControl 1.1: Swift Environment Protection, middleware in the Swift data flow must be secured, making it in scope. However, this option pairs I with J and K, which are not components.Conclusion: This option is incorrect due to J and K, though I alone would be in scope.
* C. Components F, G, H
* F (Communication Interface): This is the interface connecting to the Swift network, clearly in scope perControl 1.1.
* G (SNL): SwiftNet Link is a core communication component for Swift connectivity, in scope per Control 1.1.
* H (HSM & PKI): HSM and PKI are critical for secure Swift connectivity, in scope perControl
1.1.Conclusion: This option is correct.
* D. Components C, E, M
* C (Messaging Interface): This is a core Swift component (e.g., Alliance Access), in scope per Control 1.1.
* E (GUI): The GUI used by operators to interact with the messaging interface is in scope, as specified inControl 1.2: Logical Access Control, which includes operator systems.
* M (Operator End User): The operator's workstation is in scope as it directly interacts with Swift systems, perControl 1.2.Conclusion: This option is correct.
Step 4: Conclusion and Verification
The components in scope of the CSCF are those directly involved in Swift messaging, connectivity, and operator interaction. Based on the analysis:
* C (F, G, H)includes communication components, all in scope.
* D (C, E, M)includes the messaging interface, GUI, and operator workstation, all in scope.Components A, B, and data exchange paths (J, K, L) are not directly in scope, though middleware (I) would be if considered separately.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection.
* Swift Customer Security Programme - Scope and Applicability, Section: CSCF Scope Definition.
* CSCF v2024, Control 1.2: Logical Access Control.

NEW QUESTION # 35
Which of the following statements best describe valid implementations when implementing control 2.9 Transaction Business Controls? (Choose all that apply.)

• A. A customer designed implementation or a combination of different measures are deemed valid if they sufficiently mitigate the control risks
• B. Multiple measures must be implemented by the Swift user to validate the flows of transactions are in the bounds of the normal expected business
• C. Any solutions is acceptable so long as the CISO approves the implementation
• D. Reliance on a recent business assessment or regulator response confirming the effectiveness of the control (as an example CPMI's_ requirement) is especially poignant to this control

Answer: A,B,D

NEW QUESTION # 36
Is the restriction of Internet access only relevant when having SWIFT-related components in a secure zone?
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework - High-Level Test Plan Guidelines
*Outsourcing Agents - Security Requirements Baseline v2025
*CSP Architecture Type - Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls

• A. Yes, because if there is no secure zone, then the internet connectivity does not need to be restricted
• B. No, because there can be in-scope general operator PCs used to access a SWIFT-related application hosted at a service provider

Answer: B

Explanation:
The restriction of Internet access is a key control under the CSCF, specifically tied to Control "1.1 SWIFT Environment Protection," which mandates that SWIFT-related components in the secure zone be isolated from the general IT environment and the Internet to prevent unauthorized access and attacks. Let's evaluate the options:
*Option A: Yes, because if there is no secure zone, then the internet connectivity does not need to be restricted This is incorrect. The CSCF applies to all SWIFT users, regardless of whether they maintain a local secure zone. Even if SWIFT-related components (e.g., a customer connector or operator PC) are hosted externally (e.
g., by a service provider), the user's endpoints (e.g., operator PCs accessing the application) must still adhere to security controls, including restricting Internet access where applicable. The "Independent Assessment Framework" requires assessing all in-scope components, not just those in a secure zone.
*Option B: No, because there can be in-scope general operator PCs used to access a SWIFT-related application hosted at a service provider This is correct. General operator PCs used to access SWIFT-related applications (e.g., Alliance Lite2 Business Application hosted by a service provider) are in scope of the CSCF, as they handle sensitive SWIFT data or credentials. Control "1.1" and "6.1 Security Awareness" require these PCs to have restricted Internet access to prevent malware or unauthorized access, even if the application is hosted externally. The "CSP Architecture Type - Decision tree" includes such endpoints in the assessment scope, making Internet access restriction relevant beyond the secure zone.
Summary of Correct answer:
The restriction of Internet access is not only relevant when having SWIFT-related components in a secure zone; it applies to in-scope general operator PCs accessing hosted applications (B).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 1.1 mandates Internet access restriction for in- scope components.
*Independent Assessment Framework: Includes operator PCs in scope, even with external hosting.
*CSP_controls_matrix_and_high_test_plan_2025: Applies controls to endpoints accessing SWIFT services.
========

NEW QUESTION # 37
What is the purpose of a SWIFT HSM? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

• A. To encrypt the database of the messaging interface
• B. To store PKI certificates
• C. To format the FIN MT messages
• D. To connect to the SWIFT Secure IP Network (SIPN)

Answer: B

Explanation:
A Hardware Security Module (HSM) in the SWIFT context is a physical or virtual device used to manage cryptographic keys and perform security operations. Its purpose is critical to ensuring the integrity and confidentiality of SWIFT transactions. Let's evaluate each option:
*Option A: To encrypt the database of the messaging interface
This is incorrect. While HSMs can perform encryption, their primary role in the SWIFT ecosystem is not to encrypt databases of messaging interfaces (e.g., Alliance Access). Database encryption is typically handled by the institution's own security measures or software, not the HSM. The CSCF focuses on HSMs for key management and message security, not database-level encryption (e.g., Control "1.1 SWIFT Environment Protection").
*Option B: To store PKI certificates
This is correct. The SWIFT HSM is used to securely store and manage Public Key Infrastructure (PKI) certificates, which are essential for authentication, message signing, and encryption within the SWIFT network. SWIFT uses PKI for role-based access control and to secure communications over SWIFTNet. The HSM ensures that these certificates are protected against unauthorized access and tampering, aligning with CSCF Control "1.3 Cryptographic Failover." For example, in Alliance Gateway setups, the HSM stores SWIFTNet PKI certificates used for secure message transmission.
*Option C: To connect to the SWIFT Secure IP Network (SIPN)
This is incorrect. Connection to the SIPN is managed by components like SwiftNet Link (SNL) and VPN boxes, not the HSM. The HSM's role is security-focused, handling cryptographic operations, not network connectivity. CSCF Control "1.1" specifies that connectivity is achieved through network components, while the HSM supports security within that environment.
*Option D: To format the FIN MT messages
This is incorrect. Message formatting (e.g., creating FIN MT messages like MT103) is handled by messaging interfaces like Alliance Access or Alliance Gateway, not the HSM. The HSM's function is limited to cryptographic tasks, such as signing and verifying messages after they are formatted, as per CSCF Control
"2.1 Internal Data Transmission Security."
Summary of Correct answer:
The primary purpose of a SWIFT HSM is to store PKI certificates, ensuring secure cryptographic operations for SWIFT transactions.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.3 mandates the use of HSMs for cryptographic failover and certificate management.
*SWIFT Security Guidelines: HSMs are described as key management devices for PKI certificates in SWIFTNet communications.
*Alliance Gateway Documentation: Details the HSM's role in storing and managing PKI certificates for secure message processing.

NEW QUESTION # 38
Is it mandated to perform security awareness and other specific trainings every year for individuals with SWIFT-critical roles? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework - High-Level Test Plan Guidelines
*Outsourcing Agents - Security Requirements Baseline v2025
*CSP Architecture Type - Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls

• A. No, a track record must show that both awareness and specific training are performed at least bi-yearly (every 2 years)
• B. No, awareness training expected to be performed yearly; specific training to maintain the required knowledge only when needed
• C. No, both awareness and specific trainings are planned when deemed required
• D. Yes, and a track record must show that both awareness and specific training are performed annually

Answer: D

Explanation:
CSCF Control "6.1 Security Awareness" mandates training for individuals with SWIFT-critical roles (e.g., LSO, RSO, operators) to ensure they understand security policies and procedures. Let's evaluate each option:
*Option A: Yes, and a track record must show that both awareness and specific training are performed annually This is correct. Control 6.1 requires annual security awareness training for all SWIFT-critical personnel, with additional specific training as needed to maintain knowledge. The "Swift Customer SecurityControls Framework v2025" and "Assessment template for Mandatory controls" mandate annual training and require a track record (e.g., logs or certificates) to demonstrate compliance.
*Option B: No, both awareness and specific trainings are planned when deemed required This is incorrect. The CSCF mandates annual awareness training, not just ad-hoc planning, to ensure consistent security awareness.
*Option C: No, awareness training expected to be performed yearly; specific training to maintain the required knowledge only when needed This is incorrect. While specific training can be as needed, awareness training is explicitly required annually, making this option partially inaccurate.
*Option D: No, a track record must show that both awareness and specific training are performed at least bi- yearly (every 2 years) This is incorrect. The CSCF requires annual awareness training, not bi-yearly, as specified in the guidelines.
Summary of Correct answer:
It is mandated to perform security awareness and specific trainings every year, with a track record (A).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 6.1 mandates annual training.
*Assessment template for Mandatory controls: Requires annual training records.
*Independent Assessment Framework: Verifies training frequency.
========

NEW QUESTION # 39
In an entity having a small infrastructure and only 2 operators, the HR manager explains in a short interview how the security training is implemented providing one example. Would it be acceptable?

• A. Yes. it's a risk based testing approach this can be enough in this case
• B. No. more evidence are required

Answer: B

Explanation:
This question assesses whether a short interview with the HR manager providing one example of security training implementation is acceptable for a small infrastructure with only two operators, under the Swift Customer Security Programme (CSP).
Step 1: Understand Security Training Requirements
TheSwift Customer Security Controls Framework (CSCF) v2024, underControl 5.1: Security Training and Awareness, mandates that all personnel with access to Swift-related systems (including operators) receive regular, documented security training. This includes awareness of security policies, procedures, and incident response. The control applies regardless of the size of the infrastructure.
Step 2: Analyze the Scenario
* The entity has a small infrastructure with two operators, and the HR manager provides a short interview with one example of security training implementation.
* TheIndependent Assessment Frameworkrequires assessors to validate the effectiveness of controls, including evidence of training completion, content, frequency, and attendance records. A risk-based approach allows flexibility, but minimum evidence standards must still be met.
Step 3: Evaluate Against CSCF Guidelines
* Control 5.1specifies that training must be documented, with evidence such as training logs, attendance records, or certification. A single interview with one example does not provide sufficient evidence to demonstrate:
* That all operators (both in this case) have been trained.
* The frequency and comprehensiveness of the training program.
* The effectiveness of the training (e.g., understanding and application).
* TheSwift CSP FAQandSecurity Best Practicesnote that even for small entities, assessors must see multiple pieces of evidence (e.g., training schedules, materials, test results) to confirm compliance, especially during an independent assessment.
* A risk-based testing approach (mentioned in option A) allows tailoring the depth of evidence based on risk, but it does not exempt small entities from providing more than a single anecdotal example. The Independent Assessment Frameworkrequires objective evidence, not just verbal assurances.
Step 4: Conclusion and Verification
The answer isB, as a short interview with one example is insufficient to meet the evidence requirements of Control 5.1in theCSCF v2024. More evidence (e.g., training records, attendance logs, or test results) is required to validate compliance, even for a small infrastructure.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 5.1: Security Training and Awareness.
* Swift Independent Assessment Framework, Section: Evidence Requirements.
* Swift Security Best Practices, Section: Training Documentation.
* Swift CSP FAQ, Section: Small Entity Compliance.

NEW QUESTION # 40
How can PKI certificate requests be submitted to SWIFT? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

• A. Using an online method
• B. None of the above
• C. Using an offline method
• D. Using both online and offline methods

Answer: D

Explanation:
SWIFT PKI certificates are critical for securing communications and require a formal request process to SWIFT for issuance or renewal. Let's evaluate each option:
*Option A: Using both online and offline methods
This is correct. SWIFT provides multiple channels for submitting PKI certificate requests to accommodate different customer needs and security requirements. The online method involves submitting requests through the SWIFT Alliance Web Platform or SWIFT's customer portal, where users can generate and upload certificate signing requests (CSRs). The offline method involves physical submission, such as sending a signed request via secure mail or courier, often used for initial setups or high-security environments. SWIFT documentation confirms both methods are supported, aligning with CSCF Control "1.3 Cryptographic Failover" for secure certificate management.
*Option B: Using an online method
This is incorrect as a standalone answer. While the online method is available and widely used, it is not the only method. Excluding the offline option does not reflect SWIFT's flexible process.
*Option C: Using an offline method
This is incorrect as a standalone answer. The offline method is an option, but it is not the only method.
SWIFT supports both approaches depending on the customer's infrastructure and security policies.
*Option D: None of the above
This is incorrect. Both online and offline methods are valid, making this option invalid.
Summary of Correct answer:
PKI certificate requests can be submitted to SWIFT using both online and offline methods (A), providing flexibility and security.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.3 supports secure certificate request processes.
*SWIFT PKI Management Guide: Details online and offline submission methods for certificate requests.
*SWIFT Alliance Documentation: Confirms dual submission channels for PKI certificates.

NEW QUESTION # 41
To verify the applicability of a CSCF control to a specific component, several actions may be considered.
Which one does not apply in this case?
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework - High-Level Test Plan Guidelines
*Outsourcing Agents - Security Requirements Baseline v2025
*CSP Architecture Type - Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

• A. Check appendix F of the CSCF
• B. Open a case with SWIFT support via the case manager on swift.com if further information or solution cannot be found in the documentation
• C. Check carefully the Introduction section of the CSCF
• D. Check in the CSP Policy document

Answer: D

Explanation:
Verifying the applicability of a CSCF control to a specific component involves consulting relevant SWIFT documentation and processes. The "Swift Customer Security Controls Framework v2025" and associated guidelines provide the framework for this determination. Let's evaluate each option:
*Option A: Check in the CSP Policy document
This does not apply. The "Swift Customer Security Controls Policy" is a high-level document outlining the CSP's objectives and requirements but does not provide detailed guidance on control applicability to specific components. Control applicability is determined by the CSCF itself (e.g., through appendices or the control matrix), not the policy document, which is more strategic than operational.
*Option B: Check appendix F of the CSCF
This applies. Appendix F of the CSCF (or a similar appendix in the v2025 version) typically includes guidance on control applicability, mapping controls to different architecture types and components. This is a standard action for assessors, as noted in the "Independent Assessment Process for Assessors Guidelines."
*Option C: Check carefully the Introduction section of the CSCF
This applies. The Introduction section of the CSCF provides an overview of the framework's scope, objectives, and how controls apply to various components, making it a relevant resource for verification.
*Option D: Open a case with SWIFT support via the case manager on swift.com if further information or solution cannot be found in the documentation This applies. If documentation does not resolve the applicability question, SWIFT support via the case manager on swift.com is a recognized escalation path, as outlined in the "Independent Assessment Framework" and SWIFT operational guidelines.
Summary of Correct answer:
Checking the CSP Policy document (A) does not apply, as it is not the appropriate resource for verifying control applicability to specific components.
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Provides applicability guidance in appendices (e.g., Appendix F) and the Introduction.
*Independent Assessment Process for Assessors Guidelines: Recommends using CSCF appendices and support channels.
*CSP_controls_matrix_and_high_test_plan_2025: Supports control applicability analysis.
========

NEW QUESTION # 42
Select the components a SwiftNet Link (SNL) may communicate with. (Choose all that apply.)

• A. The Graphical User Interface
• B. The VPN boxes
• C. The messaging interface (such as Alliance Access)
• D. The HSM device

Answer: B,C,D

Explanation:
This question identifies the components with which the SwiftNet Link (SNL) communicates, based on its role in the Swift ecosystem under theSwift Customer Security Controls Framework (CSCF) v2024.
Step 1: Understand the Role of SwiftNet Link (SNL)
The SNL is a communication layer that facilitates secure connectivity between a Swift user's environment and the Swift network. It handles encrypted data transmission and interacts with specific infrastructure components, as detailed in theSwift Alliance Gateway Technical DocumentationandControl 1.1: Swift Environment Protectionof theCSCF v2024.
Step 2: Evaluate Each Option
* A. The Graphical User InterfaceThe GUI (e.g., operator interface) is used by personnel to interact with Swift applications (e.g., Alliance Access), but it does not directly communicate with the SNL. The SNL operates at the network and security layer, not the user interface layer, per theSwift User Handbook
.Conclusion: Incorrect.
* B. The VPN boxesThe SNL communicates with VPN boxes to establish secure tunnels (e.g., using NTLS) for data transmission to the Swift network, as specified in theSwift Security Best Practicesand Control 2.6: Internet Accessibility Restriction.Conclusion: Correct.
* C. The HSM deviceThe SNL interacts with the Hardware Security Module (HSM) to manage cryptographic keys and secure communications, as outlined inControl 2.5B: Cryptographic Key Managementand theSwift Alliance Gateway Technical Documentation.Conclusion: Correct.
* D. The messaging interface (such as Alliance Access)The SNL connects to the messaging interface (e.
g., Alliance Access or Entry) to transmit and receive Swift messages, a core function described in the CSCF v2024underControl 1.1.Conclusion: Correct.
Step 3: Conclusion and Verification
The correct answers areB, C, and D, as the SNL communicates with VPN boxes, HSM devices, and messaging interfaces to ensure secure and functional connectivity to the Swift network, consistent withCSCF v2024and related documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection, Control 2.5B: Cryptographic Key Management, Control 2.6: Internet Accessibility Restriction.
* Swift Alliance Gateway Technical Documentation, Section: SNL Communication.
* Swift Security Best Practices, Section: Network Infrastructure.

NEW QUESTION # 43
Select the correct statement(s) about the Swift Alliance Gateway. (Choose all that apply.)

• A. The Alliance Gateway can only be accessed by a SWIFTNet user
• B. It acts as the single window to SwiftNet messaging services byconcentratingyour traffic flows
• C. It allows sharing of PKI profiles between application or individuals, through the use of virtual profiles
• D. It allows the creation and/or modification of some Swift messages (depending on the types &/or formats)

Answer: B,C

Explanation:
The Swift Alliance Gateway is a critical component in the Swift ecosystem, designed to facilitate secure messaging and connectivity. Let's evaluate each option based on theSwift Customer Security Controls Framework (CSCF) v2024and related documentation.
Step 1: Understand the Role of Swift Alliance Gateway
The Swift Alliance Gateway (SAG) is a software component that serves as a centralized entry point for SwiftNet messaging services. It handles traffic concentration, security, and connectivity management. This is detailed in theSwift Alliance Gateway User Guideand referenced in theCSCF v2024underControl 1.1: Swift Environment Protection.
Step 2: Evaluate Each Option
* A. It acts as the single window to SwiftNet messaging services by concentrating your traffic flows The SAG is designed to consolidate and manage all SwiftNet traffic from a user's environment,acting as a single point of access to SwiftNet services. This is a primary function, as confirmed in theSwift Alliance Gateway Technical Documentationand aligns withControl 1.1, which emphasizes secure traffic management.Conclusion: This statement is correct.
* B. It allows sharing of PKI profiles between application or individuals, through the use of virtual profilesThe SAG supports the use of virtual PKI profiles to enable secure sharing of cryptographic identities across applications or users within the Swift environment. This feature enhances flexibility while maintaining security, as noted in theSwift Security Best PracticesandControl 2.5B:
Cryptographic Key Management.Conclusion: This statement is correct.
* C. It allows the creation and/or modification of some Swift messages (depending on the types &
/or formats)The SAG is a gateway for message routing and security, not a tool for creating or modifying Swift messages. Message creation and modification are handled by applications like Alliance Access or Entry, not the Gateway. This is clarified in theSwift Alliance Gateway User Guide, which specifies its role as a connectivity and security layer.Conclusion: This statement is incorrect.
* D. The Alliance Gateway can only be accessed by a SWIFTNet userThe SAG is accessed by authorized systems and users within the Swift user's environment, not exclusively by SwiftNet users. It interfaces with operator systems, middleware, and other components, as perControl 1.2: Logical Access Control, which allows controlled access by authorized entities, not just SwiftNet users.
Conclusion: This statement is incorrect.
Step 3: Conclusion and Verification
The verified statements areAandB, as they accurately reflect the SAG's role in traffic concentration and PKI profile management, consistent with Swift CSP documentation.
References
* Swift Alliance Gateway User Guide, Section: Functionality Overview.
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection, Control 2.5B: Cryptographic Key Management.
* Swift Security Best Practices, Section: Alliance Gateway Configuration.

NEW QUESTION # 44
As a Swift CSP Certified Assessor, I left the listed provider and started to work independently. Can I continue to perform CSP assessments?

• A. [No, except if Swift formally provides you permission
• B. Yes. but not as a Swift CSP Certified assessor
• C. No, this is not allowed
• D. Yes. during the certification validity period

Answer: C

Explanation:
This question addresses the eligibility of a SWIFT CSP Certified Assessor who leaves a listed provider to continue performing assessments independently:
* Step 1: SWIFT CSP Assessor Certification Rules
* The SWIFT CSP Independent Assessment Framework (IAF) specifies that assessors must be certified and affiliated with a SWIFT-approved provider listed in the Directory of CSP Assessment Providers. Certification is tied to the individual but exercised through the provider's accreditation.
* Step 2: Impact of Leaving a Provider
* When an assessor leaves a listed provider, they lose the organizational backing required to conduct official CSP assessments. The IAF states that "assessments must be performed by approved providers," and independent operation without SWIFT's formal re-approval or affiliation with another provider is not permitted, even during the certification validity period.

NEW QUESTION # 45
Is it necessary to formally explain to the Swift user the testing methodology that will be used for the CSP assessment during the kick-off?

• A. No
• B. Yes

Answer: B

Explanation:
This question concerns the assessor's obligations during the CSP assessment kick-off:
* Step 1: CSP Assessment Process
* The IAF recommends a kick-off meeting to align expectations between the assessor and SWIFT user, including explaining the testing methodology (e.g., HLTP, sampling, evidence collection).

NEW QUESTION # 46
What type of keys does the HSM box store? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

• A. Private keys
• B. Public keys
• C. Both private and public keys

Answer: A

Explanation:
A Hardware Security Module (HSM) box in the SWIFT context is a secure device used to manage cryptographic keys and perform security operations, such as signing and encryption for SWIFT transactions.
Let's evaluate each option:
*Option A: Private keys
This is correct. The primary function of an HSM box in the SWIFT environment is to securely store and manage private keys, which are part of the Public Key Infrastructure (PKI) used for asymmetric cryptography.
Private keys are used for signing messages to ensure authenticity and integrity, and for decryption to maintain confidentiality. The HSM protects these private keys from unauthorized access, aligning with CSCF Control
"1.3 Cryptographic Failover," which mandates the use of HSMs to safeguard cryptographic materials. SWIFT documentation specifies that private keys are stored within the HSM, while public keys are distributed separately (e.g., via certificates).
*Option B: Public keys
This is incorrect. Public keys are not stored in the HSM box. Instead, they are embedded in PKI certificates and distributed to other parties (e.g., SWIFT or counterparties) for verification and encryption purposes. The HSM's role is to protect the sensitive private keys, not to store public keys, which are openly shared as part of the PKI ecosystem.
*Option C: Both private and public keys
This is incorrect. While the HSM may temporarily handle public keys during cryptographic operations (e.g., for certificate validation), its primary and secure storage function is limited to private keys. Storing both types of keys is not a standard practice in SWIFT's HSM usage, as public keys are managed outside the HSM in certificate repositories or directories.
Summary of Correct answer:
The HSM box stores private keys (A), ensuring the security of cryptographic operations in the SWIFT environment.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.3 mandates HSMs for storing private keys securely.
*SWIFT Security Guidelines: Details the HSM's role in managing private keys for PKI operations.
*SWIFT HSM Documentation: Confirms that private keys are stored in the HSM, with public keys managed externally.
========

NEW QUESTION # 47
Which authentication methods are possible on the Alliance Interfaces? (Choose all that apply.)

• A. Password and TOTP
• B. LDAP Authentication
• C. Password
• D. Radius One-time password

Answer: A,B,C

Explanation:
This question identifies the authentication methods supported by Alliance Interfaces (e.g., Alliance Access, Alliance Gateway) under theSwift Customer Security Controls Framework (CSCF) v2024.
Step 1: Understand Authentication on Alliance Interfaces
TheCSCF v2024, underControl 2.3: System Access Control, mandates strong authentication for access to Swift-related components, including Alliance Interfaces. TheSwift Alliance Gateway Technical Documentation andAlliance Access User Guidedetail supported methods.
Step 2: Evaluate Each Option
* A. PasswordAlliance Interfaces support basic password authentication as a standard method, as noted in theAlliance Access User Guide. While not the strongest alone, it is permitted with additional controls.
Conclusion: Correct.
* B. LDAP AuthenticationLDAP (Lightweight Directory Access Protocol) is supported for centralized authentication, integrating with enterprise directory services, per theSwift Security Best Practicesand Control 2.3.Conclusion: Correct.
* C. Radius One-time passwordRADIUS with one-time passwords (OTP) is not a standard authentication method for Alliance Interfaces. TheAlliance Gateway Technical Documentationdoes not list RADIUS OTP as supported, focusing instead on password, LDAP, and TOTP.Conclusion:
Incorrect.
* D. Password and TOTPTime-based One-Time Password (TOTP) combined with password (multi- factor authentication) is supported for enhanced security, as required byControl 2.3and detailed in the Swift Security Best Practicesfor privileged access.Conclusion: Correct.
Step 3: Conclusion and Verification
The correct answers areA, B, and D, as these methods are supported by Alliance Interfaces, aligning with CSCF v2024and related documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.3: System Access Control.
* Swift Alliance Gateway Technical Documentation, Section: Authentication Methods.
* Swift Security Best Practices, Section: Multi-Factor Authentication.

NEW QUESTION # 48
The outsourcing agent of the SWIFT user provided them with an independent assessment report covering the CSP components in their scope, and using the latest CSCF version for testing. Is it enough to support the CSP attestation for the outsourced components? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework - High-Level Test Plan Guidelines
*Outsourcing Agents - Security Requirements Baseline v2025
*CSP Architecture Type - Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

• A. Yes, only if the outsourcing agent is a global trusted provider and published the report on their compliance portal
• B. No, an audit report (and not an assessment) is required from the outsourcing agent as an external provider
• C. Yes, after confirmation and validation of the scope
• D. No, except if the cloud provider components are partially covered by the SWIFT Alliance Connect Virtual programme

Answer: C

Explanation:
The "Outsourcing Agents - Security Requirements Baseline v2025" and "Independent Assessment Framework" address reliance on outsourcing agents' assessments. Let's evaluate each option:
*Option A: Yes, after confirmation and validation of the scope
This is correct. The SWIFT user can rely on the outsourcing agent's independent assessment report if it covers the relevant CSP components and uses the latest CSCF version. However, the user's assessor must confirm and validate the scope and findings to ensure alignment with the user's attestation, as per the "Independent Assessment Process for Assessors Guidelines."
*Option B: Yes, only if the outsourcing agent is a global trusted provider and published the report on their compliance portal This is incorrect. The CSP does not require the outsourcing agent to be a "global trusted provider" or publish the report publicly; validation by the user's assessor is sufficient.
*Option C: No, an audit report (and not an assessment) is required from the outsourcing agent as an external provider This is incorrect. An independent assessment report is acceptable, not necessarily an audit report, as long as it meets CSCF standards, per the "Outsourcing Agents - Security Requirements Baseline v2025."
*Option D: No, except if the cloud provider components are partially covered by the SWIFT Alliance Connect Virtual programme This is incorrect. The Alliance Connect Virtual programme's coverage is irrelevant; the key is the report's validity and scope validation.
Summary of Correct answer:
The report is sufficient after confirmation and validation of the scope (A).
References to SWIFT Customer Security Programme Documents:
*Outsourcing Agents - Security Requirements Baseline v2025: Allows reliance on agent assessments.
*Independent Assessment Process for Assessors Guidelines: Requires scope validation.
*Swift_CSP_Assessment_Report_Template: Supports integrated reporting.
========

NEW QUESTION # 49
Application Hardening basically applies the following principles. (Choose all that apply.)

• A. Access on a need to have
• B. Least Privileges
• C. Reduced footprint for less potential vulnerabilities
• D. Enhanced Straight Through Processing

Answer: A,B,C

Explanation:
Application Hardening is a key concept within theSwift Customer Security Controls Framework (CSCF), specifically addressed under security controls related to protecting systems and reducing vulnerabilities. The CSCF outlines principles to secure applications by minimizing risks, particularly in the context of Swift- related systems. Let's break down the options and verify them against Swift CSP guidelines.
Step 1: Understand Application Hardening in the Context of Swift CSP
Application Hardening refers to the process of securing an application by reducing its attack surface, limiting access, and mitigating potential vulnerabilities. This aligns with Swift CSP's overarching goal of enhancing the security of the Swift user community, as outlined in theCSCF v2024(and prior versions like CSCF v2023).
Relevant controls fall under domains likeControl Objective 2: Protect Critical SystemsandControl Objective 6: Detect Anomalous Activity.
Step 2: Evaluate Each Option Against Swift CSP Principles
* A. Least PrivilegesThe principle of least privilege is a core tenet of application hardening. It ensures that applications (and users) only have the minimum permissions necessary to perform their functions, reducing the risk of misuse or exploitation. This is explicitly referenced in theCSCF v2024, under Control 2.1: Operating System Privileged Account Control, which emphasizes restricting privileges to the minimum required. Application Hardening extends this to software processes, ensuring they run with minimal rights.Conclusion: This applies.
* B. Access on a need to haveThis principle, often phrased as "need-to-know" or "need-to-have" in security contexts, ensures that access to applications or their components is granted only to entities that require it for their role. In the Swift CSP, this aligns withControl 2.3: System Access Control, which mandates that access to Swift-related systems (including applications) is restricted to authorized users or processes. Application Hardening incorporates this by ensuring that applications only expose interfaces or resources to authorized entities.Conclusion: This applies.
* C. Reduced footprint for less potential vulnerabilitiesReducing the attack surface (or "footprint") of an application is a fundamental hardening technique. This involves disabling unnecessary features, services, or modules that could be exploited. TheCSCF v2024addresses this underControl 2.5A:
Application Hardening, which explicitly requires users to minimize the attack surface of Swift-related applications by removing unused components and limiting exposed services. This directly correlates with reducing potential vulnerabilities.Conclusion: This applies.
* D. Enhanced Straight Through Processing (STP)Straight Through Processing refers to the automated, end-to-end processing of transactions without manual intervention, a concept often associated with operational efficiency in financial systems. While STP is relevant to Swift's messaging and transaction workflows, it is not a principle of Application Hardening. The CSCF does not link STP to security hardening practices, which focus on reducing vulnerabilities rather than optimizing transaction flows.Conclusion: This does not apply.
Step 3: Conclusion and Verification
Application Hardening, as per theSwift Customer Security Controls Framework (CSCF), focuses on security principles that minimize risks to applications. The verified principles areLeast Privileges (A),Access on a need to have (B), andReduced footprint for less potential vulnerabilities (C). These align with Swift CSP' s emphasis on securing critical systems and reducing attack surfaces.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.5A: Application Hardening.
* Swift Customer Security Programme - Security Best Practices, Section: Application Security.
* CSCF v2024, Control 2.1: Operating System Privileged Account Control, and Control 2.3: System Access Control.

NEW QUESTION # 50
Which operator session flows are expected to be protected in terms of confidentiality and integrity? (Choose all that apply.)

• A. All sessions towards a Swift related application run by an Outsourcing Agent, a Service Bureau or an L2BA Provider
• B. All sessions towards a secure zone (on-premises or hosted by a third-party or a Cloud Provider)
• C. System administrator sessions towards a host running a Swift related component
• D. All sessions to and from a jump server used to access a component in a secure zone

Answer: A,B,C,D

Explanation:
This question addresses the obligations of Swift users regarding the submission of assessment-related documents to Swift under the Customer Security Programme (CSP).
Step 1: Understand CSP Assessment Submission Requirements
TheSwift Customer Security Controls Framework (CSCF) v2024and theIndependent Assessment Framework outline the process for CSP assessments, including what must be submitted to Swift. The focus is on ensuring compliance through attestation, with specific deliverables defined.
Step 2: Evaluate Each Option
* A. Yes, all documents produced from the assessment must be provided proactively to SwiftThis is incorrect. TheIndependent Assessment Frameworkdoes not require proactive submission of all assessment documents (e.g., detailed reports, working papers). Only the completion letter and attestation are typically submitted unless otherwise requested by Swift.Conclusion: Incorrect.
* B. No, it is not required to provide Swift with any documents by default. However, Swift can request a copy of the Assessment completion letterTheCSCF v2024andIndependent Assessment Frameworkstate that users are not required to proactively submit the full assessment report or other documents. However, Swift retains the right to request the completion letter (certifying assessment completion) or additional evidence during quality assurance reviews. This aligns with theSwift CSP Compliance Guidelines.Conclusion: Correct.
* C. Yes, a copy of (only) the assessment report must be provided to Swift, no other documentsThis is incorrect. The full assessment report is not mandated for proactive submission; only the completion letter is typically required unless requested. TheIndependent Assessment Frameworkemphasizes the completion letter as the key deliverable.Conclusion: Incorrect.
* D. Yes, in cases where a customer performs an Independent assessment rather than an audit then a copy of the assessment report must be provided. However, it is not required for the Swift user to provide any forms when an Internal/External Audit is performedThis is partially misleading. The Independent Assessment Frameworkdoes not distinguish between independent assessments and audits in terms of mandatory report submission. For both, the completion letter is the default submission, with reports requested only if needed. The differentiation based on assessment type is not supported byCSCF v2024guidelines.Conclusion: Incorrect.
Step 3: Conclusion and Verification
The correct answer isB, as theCSCF v2024andIndependent Assessment Frameworkdo not require proactive submission of the full assessment report, but Swift can request the completion letter as part of its oversight process.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Section: Independent Assessment Requirements.
* Swift Independent Assessment Framework, Section: Deliverables and Submission.
* Swift CSP Compliance Guidelines, Section: Document Submission Rules.
This question identifies which operator session flows must be protected for confidentiality and integrity under theSwift Customer Security Controls Framework (CSCF) v2024.
Step 1: Understand Session Protection Requirements
TheCSCF v2024, underControl 2.4: Secure Session Management, mandates that all sessions involving access to Swift-related components or secure zones must be protected using strong encryption (e.g., TLS) and integrity controls to prevent unauthorized access or data tampering. This applies to operator and administrator sessions interacting with the Swift environment.
Step 2: Evaluate Each Option
* A. System administrator sessions towards a host running a Swift related componentAdministrator sessions to hosts running Swift components (e.g., Alliance Access, Gateway) are in scope, as they require protection perControl 2.4to ensure confidentiality and integrity of administrative actions.
Conclusion: Correct.
* B. All sessions to and from a jump server used to access a component in a secure zoneJump servers are used to access secure zones (perControl 1.1: Swift Environment Protection), and all sessions to and from them must be encrypted and integrity-protected, as specified inControl 2.4.Conclusion:
Correct.
* C. All sessions towards a secure zone (on-premises or hosted by a third-party or a Cloud Provider) Secure zones, whether on-premises or hosted (e.g., by outsourcing agents or cloud providers), contain Swift components and must have all incoming sessions protected perControl 2.4andControl 1.1.
Conclusion: Correct.
* D. All sessions towards a Swift related application run by an Outsourcing Agent, a Service Bureau or an L2BA ProviderSessions to Swift-related applications managed by outsourcing agents or service bureaus (e.g., Components C, D, E in the diagram) are in scope, as they handle Swift traffic and must be secured perControl 2.4and theSwift Outsourcing Guidelines.Conclusion: Correct.
Step 3: Conclusion and Verification
All options (A, B, C, D) are correct, asControl 2.4of theCSCF v2024requires protection of all listed session types to ensure confidentiality and integrity across the Swift ecosystem, including secure zones, hosted environments, and outsourced applications.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.4: Secure Session Management, Control 1.1: Swift Environment Protection.
* Swift Security Best Practices, Section: Session Security.
* Swift Outsourcing Guidelines, Section: Session Protection.

NEW QUESTION # 51
Can an internal audit department submit and approve their Swift user's attestation on the KYC-SA Swift portal?

• A. Yes, with approval from the Chief auditor
• B. Yes, providing this is agreed by the head of IT operations and the CISO
• C. Yes, an internal auditor can submit the attestation for approval provided they have the appropriate credentials for switt.com. The CISO remains in charge of the approval of the attestation
• D. No, this is never an option

Answer: D

Explanation:
This question examines whether an internal audit department can submit and approve a Swift user's attestation on the KYC-SA Swift portal.
Step 1: Understand Attestation Process
TheIndependent Assessment FrameworkandCSCF v2024require attestations to be submitted by an independent party or authorized user representative, not the internal audit department, to ensure objectivity.
Step 2: Evaluate Each Option
* A. Yes, providing this is agreed by the head of IT operations and the CISOInternal audit cannot submit or approve attestations, regardless of internal agreements, per theIndependent Assessment Framework.Conclusion: Incorrect.
* B. No, this is never an optionTheCSCF v2024andSwift CSP Compliance Guidelinesprohibit internal audit from submitting or approving attestations, as they lack independence from the audited entity.
Conclusion: Correct.
* C. Yes, an internal auditor can submit the attestation for approval provided they have the appropriate credentials for swift.com. The CISO remains in charge of the approval of the attestationIncorrect. Internal auditors cannot submit or approve, even with credentials, due to independence requirements.Conclusion: Incorrect.
* D. Yes, with approval from the Chief auditorIncorrect. Chief auditor approval does not override the independence requirement.Conclusion: Incorrect.
Step 3: Conclusion and Verification
The correct answer isB, as theCSCF v2024andIndependent Assessment Frameworkprohibit internal audit from submitting or approving attestations.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Section: Independent Assessment.
* Swift Independent Assessment Framework, Section: Attestation Submission.
* Swift CSP Compliance Guidelines, Section: Independence Requirements.

NEW QUESTION # 52
Application Hardening basically applies the following principles. (Choose all that apply.)

• A. Access on a need to have
• B. Least Privileges
• C. Reduced footprint for less potential vulnerabilities
• D. Enhanced Straight Through Processing

Answer: A,B,C

NEW QUESTION # 53
Where is the implementation of multi-factor authentication deemed sufficient to support control 4.2 compliance? (Choose all that apply.)

• A. When logging-in on an interface, a connector, or the system running such component
• B. On the General Operator PC used to access a Swift-related component
• C. When accessing an outsourcing agent or an L2BA Swift-related application
• D. When login on the jump server filtering access to local Swift secure zone

Answer: A,B,C,D

Explanation:
Control 4.2 of the Swift Customer Security Controls Framework (CSCF) mandates the implementation of Multi-Factor Authentication (MFA) to "prevent compromise of a single authentication factor allowing access to SWIFT systems." The control applies to various access points within the SWIFT environment to ensure robust security. Let's evaluate each option against CSCF v2024 and related guidelines:
* A. When accessing an outsourcing agent or an L2BA Swift-related application
* CSCF v2024 Control 4.2 explicitly states that MFA is required for "SWIFT-related applications or components managed by third-party service providers" (e.g., outsourcing agents) and Level 2 Business Applications (L2BA). This ensures that external entitieshandling SWIFT-related processes adhere to the same security standards. The scope includes any operator access to these applications, making MFA mandatory here.

NEW QUESTION # 54
Select the components a SwiftNet Link (SNL) may communicate with. (Choose all that apply.)

• A. The Graphical User Interface
• B. The VPN boxes
• C. The messaging interface (such as Alliance Access)
• D. The HSM device

Answer: A,C,D

NEW QUESTION # 55
Which operator session flows are expected to be protected in terms of confidentiality and integrity? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework - High-Level Test Plan Guidelines
*Outsourcing Agents - Security Requirements Baseline v2025
*CSP Architecture Type - Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

• A. All of the other answers are valid
• B. System administrator sessions towards a host running a SWIFT-related component (on-premises or remote)
• C. All sessions towards a SWIFT-related application run by an Outsourcing Agent, a Service Bureau, or an L2BA Provider
• D. All sessions to and from a jump server used to access a component in a secure zone

Answer: A

Explanation:
The CSCF requires protection of operator session flows to ensure confidentiality and integrity, particularly for sessions involving SWIFT-related components. This is addressed under Control "2.1 Internal Data Transmission Security" and "2.2 External Transmission Security." Let's evaluate each option:
*Option A: System administrator sessions towards a host running a SWIFT-related component (on-premises or remote) This is valid. System administrator sessions to hosts running SWIFT components (e.g., Alliance Gateway on- premises or in the cloud) must be protected using encryption (e.g., TLS) and authentication to prevent unauthorized access or data breaches, aligning with CSCF Control "2.1."
*Option B: All sessions to and from a jump server used to access a component in a secure zone This is valid. Jump servers (bastion hosts) used to access the secure zone (e.g., for managing Alliance Access) must have all sessions encrypted and integrity-checked, as required by CSCF Control "1.1 SWIFT Environment Protection" and "2.2" to secure access points.
*Option C: All sessions towards a SWIFT-related application run by an Outsourcing Agent, a Service Bureau, or an L2BA Provider This is valid. Sessions to applications hosted by third parties (e.g., Alliance Lite2 Business Application by an L2BA Provider) must be protected, as per CSCF Control "2.2" and the "Outsourcing Agents - Security Requirements Baseline v2025," which mandates secure transmission regardless of location.
*Option D: All of the other answers are valid
This is correct. Since A, B, and C all describe session flows that require protection under the CSCF, the comprehensive answer is that all listed session types must be secured for confidentiality and integrity.
Summary of Correct answer:
All operator session flows listed (A, B, and C) are expected to be protected, making D the correct choice.
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Controls 2.1 and 2.2 mandate session protection.
*Outsourcing Agents - Security Requirements Baseline v2025: Extends protection to third-party-hosted applications.
*CSP_controls_matrix_and_high_test_plan_2025: Includes all listed session types in security testing.
========

NEW QUESTION # 56
In an entity having a small infrastructure and only 2 operators, the HR manager explains in a short interview how the security training is implemented providing one example. Would it be acceptable?

• A. No. more evidence are required
• B. Yes. it's a risk based testing approach this can be enough in this case

Answer: B

NEW QUESTION # 57
......

Free Swift CSP-Assessor Exam 2026 Practice Materials Collection: https://www.actualtestsquiz.com/CSP-Assessor-test-torrent.html

Prepare for your exam certification with our CSP-Assessor Certified Swift: https://drive.google.com/open?id=1EIhQznceRXwjY8jQVnmKX2cJhyskgwOz