CSP-Assessor Exam Study Guide Free Practice Test LAST UPDATED DATE Mar 07, 2026 [Q60-Q80]

NO.60 The SWIFT user has a local communication interface as their main channel to SWIFT. For contingency, the SWIFT user also has a connector as a backup channel. What is the architecture type for this SWIFT user?
(Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift CSP Assessment Report Template

A1

A2

A3

A4

The SWIFT CSP defines architecture types (A1 to A4) based on the components a user owns and manages, as outlined in the “CSP Architecture Type – Decision tree” and “Swift Customer Security Controls Framework v2025.” These types determine the applicable security controls and assessment requirements. Let’s analyze the scenario:
*A local communication interface refers to a component like Alliance Gateway (SAG), which manages connectivity to the SWIFT network via SwiftNet Link (SNL) and VPN boxes. The user owns this interface locally as their main channel.
*A connector (or customer connector) is a custom application or integration layer that connects to SWIFT services, often used as an alternative or backup channel. In this case, it serves as a contingency backup.
*The architecture types are:
oA1: Full stack (owns messaging interface, communication interface, and network components, e.g., Alliance Access, Alliance Gateway, VPN boxes).
oA2: Owns a customer connector and communication interface, with the messaging interface hosted elsewhere (e.g., by a service bureau or SWIFT).
oA3: Owns only a customer connector, relying on external communication and messaging interfaces.
oA4: Uses a fully hosted solution (e.g., Alliance Cloud or Lite2), owning no local components.
*The scenario indicates the user owns a local communication interface (e.g., SAG) as the primary channel and a connector as a backup. However, there is no mention of owning a messaging interface (e.g., Alliance Access) locally. This suggests the messaging interface is likely hosted externally (e.g., by a service bureau or SWIFT), which aligns with the A2 architecture type. The “CSP Architecture Type – Decision tree” classifies A2 as a user with a communication interface and a customer connector, where the messaging interface is not locally owned. The backup connector does not change the primary architecture type, as it is an additional component within the A2 framework.
*Option A: A1
This is incorrect. A1 requires ownership of a messaging interface (e.g., Alliance Access), which is not mentioned.
*Option B: A2
This is correct. A2 fits the scenario of owning a communication interface and a customer connector, with the messaging interface potentially hosted elsewhere.
*Option C: A3
This is incorrect. A3 involves only a customer connector, not a communication interface.
*Option D: A4
This is incorrect. A4 applies to fully hosted solutions with no local ownership of connectors or interfaces.
The SWIFT user with a local communication interface as the main channel and a connector as a backup is of architecture type A2 (B).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Defines architecture types A1-A4.
*CSP Architecture Type – Decision tree: Classifies A2 for communication interface and customer connector ownership.
*Assessment template for Mandatory controls: Applies to A2 architecture.
========

NO.61 The cluster of VPN boxes is also called managed-customer premises equipment (M-CPE).

TRUE

FALSE

This question addresses the terminology related to VPN boxes in the Swift environment and their association with managed-customer premises equipment (M-CPE). Let’s verify this based on Swift CSP documentation.
Step 1: Understand VPN Boxes and M-CPE in Swift Context
In the Swift ecosystem, VPN boxes are typically part of the connectivity infrastructure used to establish secure tunnels (e.g., Network Transport Layer Security – NTLS) for communication with the Swift network.
The term “managed-customer premises equipment (M-CPE)” generally refers to hardware or devices managed by a service provider or third party on the customer’s premises, often in telecommunications or IT contexts. TheSwift Customer Security Controls Framework (CSCF) v2024and related technical documentation provide insights into Swift’s infrastructure terminology.
Step 2: Analyze the Statement
The statement claims that the “cluster of VPN boxes is also called managed-customer premises equipment (M- CPE).” We need to determine if this is an official or recognized designation within the Swift CSP.
Step 3: Evaluate Against Swift CSP Guidelines
* TheSwift Alliance Gateway Technical DocumentationandSwift Security Best Practicesdescribe VPN boxes (or similar connectivity devices) as part of the SwiftNet Link (SNL) infrastructure, often deployed at the user’s premises to secure communications. These devices are typically managed by the Swift user or a designated service provider, depending on the architecture (e.g., A2 or A4).
* The term “M-CPE” is not specifically defined or used in Swift CSP documentation (e.g.,CSCF v2024, Swift User Handbook, orSwift Network Security Guidelines). Instead, Swift refers to such equipment as part of the “customer premises equipment (CPE)” when managed by the user, or as “managed services” when outsourced to a provider. However, “M-CPE” as a specific term for a cluster of VPN boxes is not corroborated.
* In some IT contexts outside Swift, M-CPE might imply managed equipment, but Swift’s documentation does not adopt this terminology for VPN clusters, which are considered part of the broader connectivity infrastructure.
Step 4: Conclusion and Verification
The statement isFALSEbecause theCSCF v2024and related Swift documentation do not use “managed- customer premises equipment (M-CPE)” as a term for a cluster of VPN boxes. The correct terminology aligns with “customer premises equipment” or “managed connectivity devices,” depending on the setup, but not specifically M-CPE.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection.
* Swift Alliance Gateway Technical Documentation, Section: Connectivity Infrastructure.
* Swift Security Best Practices, Section: Network Security Devices.

NO.62 The Alliance Web Platform Administrator uses both the GUI and command line to perform configuration and monitoring tasks on AWP SE.

TRUE

FALSE

NO.63 Using the outsourcing agent diagram, which components (including the components in SWIFT user premises) must be placed in a secure zone? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template
*Next Service Provider(s)
*SWIFT User
*Outsourcing Agent(s)
*Connector*
*SWIFT
*SWIFT network

Components A, B, and C

All components

Components A, C, D, and E

Components A, C, and D

The diagram shows a SWIFT user environment with an outsourcing agent and next service provider(s).
Components are labeled as follows:
*A: Middleware connector (customer connector) – Part of the SWIFT user premises.
*B: Operator GUI – Part of the SWIFT user premises, used for operator interaction.
*C: SWIFT-related application, Admin users, client – Part of the outsourcing agent’s environment.
*D: Connectors or interfaces – Part of the outsourcing agent’s environment, connecting to SWIFT.
*E: Application PC, Admin PC – Part of the outsourcing agent’s environment.
*Next Service Provider(s), SWIFT, SWIFT network – External entities.
CSCF Control “1.1 SWIFT Environment Protection” requires that all SWIFT-related components handling sensitive data or connectivity within the user’s control be placed in a secure zone. The “Outsourcing Agents – Security Requirements Baseline v2025” extends this to components managed by outsourcing agents. Let’s analyze:
*SWIFT User premises (A, B): The middleware connector (A) must be in a secure zone as it handles SWIFT data. The Operator GUI (B) is typically outside the secure zone unless it directly processes SWIFT data, but best practice includes securing it.
*Outsourcing Agent(s) (C, D, E): The SWIFT-related application and connectors/interfaces (C, D) must be in a secure zone, as they process SWIFT transactions. Application/Admin PCs (E) are support systems and may not require secure zone placement unless directly involved.
*External entities (Next Service Provider(s), SWIFT, SWIFT network): These are out of the user’s control and not placed in the user’s secure zone.
The question asks for components in the SWIFT user premises and outsourcing agent environment. Per CSCF, the secure zone includes:
*A (Middleware connector): Must be in the secure zone.
*C (SWIFT-related application): Must be in the secure zone (outsourcing agent’s responsibility).
*D (Connectors/interfaces): Must be in the secure zone (outsourcing agent’s responsibility).
*B (Operator GUI) and E (Application/Admin PCs): Typically outside unless integrated into the secure zone.
Option D (Components A, C, D) aligns with the mandatory secure zone components (middleware connector, SWIFT application, and connectors/interfaces), excluding non-essential support systems.
Summary of Correct answer:
Components A, C, and D must be placed in a secure zone (D).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 1.1 defines secure zone requirements.
*Outsourcing Agents – Security Requirements Baseline v2025: Extends secure zone to outsourced components.
*CSP_controls_matrix_and_high_test_plan_2025: Specifies secure zone placement.
========

NO.64 Is it necessary to formally explain to the Swift user the testing methodology that will be used for the CSP assessment during the kick-off?

Yes

No

NO.65 The Swift user would like to perform their CSP assessment in May for the CSCF version that will only be active as from July the same year. Is it allowed?

No, an assessment can only be done on the active version of the CSCF

Yes, the assessment on a particular version can start before the actual activation date

This question examines the timing of a CSP assessment relative to the activation of a new CSCF version, a key aspect of compliance under the Swift Customer Security Programme.
Step 1: Understand CSP Assessment Timing
TheSwift Customer Security Controls Framework (CSCF)requires users to perform an independent assessment annually or as mandated, based on the active version of the CSCF at the time of attestation. The Independent Assessment FrameworkandSwift CSP Compliance Guidelinesprovide rules on version applicability and assessment scheduling.
Step 2: Analyze the Scenario
The scenario states that the Swift user wants to perform their CSP assessment in May for a CSCF version that will become active in July of the same year. We need to determine if this is permissible.
Step 3: Evaluate Against Swift CSP Guidelines
* TheCSCF v2024andSwift CSP FAQallow users to prepare for upcoming CSCF versions before their activation date. Swift releases new versions with advance notice (typically 6-12 months), and users are encouraged to align their compliance efforts with the upcoming version to ensure readiness.
* TheIndependent Assessment Frameworkspecifies that assessments must be based on the CSCF version in effect at the time of attestation (e.g., submission to Swift). However, users can conduct preparatory assessments or self-assessments on a future version before its activation date to plan and implement necessary changes. The official attestation must still align with the active version, but early assessment is not prohibited.
* For example, if the assessment in May is a preparatory exercise (e.g., a pre-assessment or gap analysis) for the July version, it is allowed. The final attestation would then be submitted once the version is active (e.g., in July or later), ensuring compliance with the active framework.
Step 4: Conclusion and Verification
The answer isB, as theCSCF v2024andIndependent Assessment Frameworkpermit users to start assessments on a particular version before its activation date for planning purposes, provided the official attestation aligns with the active version at the time of submission.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Section: Assessment Timing.
* Swift Independent Assessment Framework, Section: Version Applicability.
* Swift CSP FAQ, Section: Assessment Scheduling and Version Updates.

NO.66 Which encryption methods are used to secure the communications between the SNL host and HSM boxes?

NTLS and SSH

Telnet and SSL

NTLS and Telnet

MPLS and SSL

This question focuses on the encryption methods securing communications between the SwiftNet Link (SNL) host and Hardware Security Module (HSM) boxes in the Swift environment.
Step 1: Understand SNL and HSM Communication
The SwiftNet Link (SNL) facilitates secure connectivity to the Swift network, while the HSM manages cryptographic keys. Secure communication between the SNL host and HSM is critical, as outlined inControl
2.5B: Cryptographic Key Managementof theCSCF v2024. These communications must use strong encryption protocols.
Step 2: Evaluate Each Option
* A. NTLS and SSH
* NTLS (Network Transport Layer Security): This is Swift’s proprietary protocol for securing communications over the SwiftNet network, including between SNL and HSM. It provides end- to-end encryption and is widely used in Swift infrastructure, as confirmed in theSwift Alliance Gateway Technical Documentation.
* SSH (Secure Shell): SSH is used for secure management and administration of HSMs and SNL hosts, enabling encrypted remote access and configuration, as noted inSwift Security Best Practices.This combination aligns with Swift’s security requirements for protecting HSM communications.Conclusion: This is correct.
* B. Telnet and SSL
* Telnet: An unencrypted protocol, unsuitable for secure communications, and not used in Swift’s security framework perControl 2.6: Internet Accessibility Restriction.
* SSL (Secure Sockets Layer): An older encryption protocol, largely replaced by TLS in modern systems. Swift does not specify SSL for SNL-HSM communications, favoring NTLS.Conclusion: This is incorrect.
* C. NTLS and Telnet
* NTLS: As above, this is valid for SwiftNet communications.
* Telnet: As an unencrypted protocol, it is not acceptable for securing HSM communications, per Control 2.5B.Conclusion: This is incorrect.
* D. MPLS and SSL
* MPLS (Multiprotocol Label Switching): A networking technology for routing, not an encryption method, and not relevant to SNL-HSM security.
* SSL: As above, not used in this context by Swift.Conclusion: This is incorrect.
Step 3: Conclusion and Verification
The correct answer isA, as NTLS secures the data communication and SSH provides secure management access between the SNL host and HSM, consistent withCSCF v2024and Swift technical documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.5B: Cryptographic Key Management, Control 2.6: Internet Accessibility Restriction.
* Swift Alliance Gateway Technical Documentation, Section: Network Security Protocols.
* Swift Security Best Practices, Section: HSM and SNL Configuration.

NO.67 The only type of HSM devices offered by Swift are HSM tokens and HSM boxes.

TRUE

FALSE

NO.68 What does SWIFT provide? (Select the two correct answers that apply)

A platform for messaging

Standards for communicating

Hosting for financial institutions

A high-level programming language

SWIFT, which stands for Society for Worldwide Interbank Financial Telecommunication, is a global member- owned cooperative that provides a network for financial institutions to securely exchange information, primarily for financial transactions. Let’s break down the options and evaluate them against SWIFT’s official services as outlined in the SWIFT Customer Security Programme (CSP) and related documentation.
* Option A: A platform for messagingThis is correct. SWIFT’s core function is to provide a secure, standardized messaging platform for financial institutions to exchange information. SWIFT operates a messaging network that enables banks, financial institutions, and other entities to send and receive standardized financial messages (such as payment instructions, securities transactions, and trade messages). This is facilitated through services like SWIFTNet, which is the messaging infrastructure that ensures secure and reliable communication. The SWIFT Customer Security Controls Framework (CSCF) emphasizes the security of this messaging platform, with controls designed to protect the integrity, confidentiality, and availability of the messaging environment. For example, the CSCF includes controls like “1.1 SWIFT Environment Protection,” which ensures the messaging platform is isolated and secure.
* Option B: Standards for communicatingThis is also correct. SWIFT is well-known for developing and maintaining global standards for financial messaging, most notably the SWIFT message types (MT) and the newer ISO 20022 standard, which is increasingly being adopted for cross-border payments and reporting. These standards define the format and structure of messages, ensuring consistency and interoperability across the global financial community. For instance, a payment instruction sent via SWIFT follows a standardized format (e.g., MT103 for a customer payment), which ensures that the sending and receiving institutions can process it efficiently. The SWIFT CSP documentation, including the CSCF, indirectly references these standards by focusing on the secure transmission of standardized messages, as seen in controls like “2.1 Internal Data Transmission Security,” which ensures data integrity during communication.
* Option C: Hosting for financial institutionsThis is incorrect. SWIFT does not provide hosting services for financial institutions. SWIFT’s role is focused on messaging and standards, not on hosting infrastructure like data centers or cloud services for financial institutions. While SWIFT does offer some cloud-based connectivity options (e.g., Alliance Cloud for smaller institutions to connect to the SWIFT network), this is not the same as providing hosting services for the institutions’ broader IT operations. Hosting infrastructure is typically managed by the institutions themselves or third-party providers, and the CSCF emphasizes that institutions are responsible for securing their own environments (e.g., Control “6.1 Security Awareness” highlights the need for institutions to manage their own security).
* Option D: A high-level programming languageThis is incorrect. SWIFT does not provide a programming language. SWIFT’s focus is on messaging protocols and standards, not on developing or providing programming languages.Financial institutions may use various programming languages (like Java, Python, or C++) to integrate with SWIFT’s messaging system via APIs or interfaces like SWIFT Alliance Access, but SWIFT itself does not develop or distribute programming languages. The CSCF does not reference programming languages as a SWIFT offering; instead, it focuses on secure integration with SWIFT services, such as Control “2.3 System Hardening,” which ensures that systems interacting with SWIFT are secure.
Summary of Correct Answers:SWIFT provides a platform for messaging (Option A) through its SWIFTNet network and standards for communicating (Option B) via its message formats like MT and ISO 20022. The other options-hosting services and a high-level programming language-are not part of SWIFT’s offerings.
References to SWIFT Customer Security Programme Documents:
* SWIFT Customer Security Controls Framework (CSCF) v2024: The CSCF outlines the security controls that protect the SWIFT messaging environment, emphasizing SWIFT’s role in secure messaging (e.g., Control 1.1, 2.1).
* SWIFT User Handbook: Details SWIFT’s messaging services and standards, including SWIFTNet and message types like MT and ISO 20022.
* SWIFT CSP Implementation Guide: Highlights that institutions are responsible for their own infrastructure, ruling out hosting as a SWIFT service.

NO.69 In an entity having a small infrastructure and only 2 operators, the HR manager explains in a short interview how the security training is implemented providing one example. Would it be acceptable?

Yes. it’s a risk based testing approach this can be enough in this case

No. more evidence are required

This question assesses whether a short interview with the HR manager providing one example of security training implementation is acceptable for a small infrastructure with only two operators, under the Swift Customer Security Programme (CSP).
Step 1: Understand Security Training Requirements
TheSwift Customer Security Controls Framework (CSCF) v2024, underControl 5.1: Security Training and Awareness, mandates that all personnel with access to Swift-related systems (including operators) receive regular, documented security training. This includes awareness of security policies, procedures, and incident response. The control applies regardless of the size of the infrastructure.
Step 2: Analyze the Scenario
* The entity has a small infrastructure with two operators, and the HR manager provides a short interview with one example of security training implementation.
* TheIndependent Assessment Frameworkrequires assessors to validate the effectiveness of controls, including evidence of training completion, content, frequency, and attendance records. A risk-based approach allows flexibility, but minimum evidence standards must still be met.
Step 3: Evaluate Against CSCF Guidelines
* Control 5.1specifies that training must be documented, with evidence such as training logs, attendance records, or certification. A single interview with one example does not provide sufficient evidence to demonstrate:
* That all operators (both in this case) have been trained.
* The frequency and comprehensiveness of the training program.
* The effectiveness of the training (e.g., understanding and application).
* TheSwift CSP FAQandSecurity Best Practicesnote that even for small entities, assessors must see multiple pieces of evidence (e.g., training schedules, materials, test results) to confirm compliance, especially during an independent assessment.
* A risk-based testing approach (mentioned in option A) allows tailoring the depth of evidence based on risk, but it does not exempt small entities from providing more than a single anecdotal example. The Independent Assessment Frameworkrequires objective evidence, not just verbal assurances.
Step 4: Conclusion and Verification
The answer isB, as a short interview with one example is insufficient to meet the evidence requirements of Control 5.1in theCSCF v2024. More evidence (e.g., training records, attendance logs, or test results) is required to validate compliance, even for a small infrastructure.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 5.1: Security Training and Awareness.
* Swift Independent Assessment Framework, Section: Evidence Requirements.
* Swift Security Best Practices, Section: Training Documentation.
* Swift CSP FAQ, Section: Small Entity Compliance.

NO.70 Is the control 2. 11 “RMA Business Controls” only about the process of validating the defined counterparty relationships?

Yes

No

This question examines the scope ofControl 2.11: RMA Business Controlswithin theCustomer Security Controls Framework (CSCF) v2024, specifically whether it is limited to validating defined counterparty relationships.
Step 1: Understand Control 2.11 RMA Business Controls
Control 2.11 focuses on securing the Relationship Management Application (RMA) process, which manages counterparty relationships for Swift messaging. TheCSCF v2024defines this control underControl Objective
2: Protect Critical Systems, aiming to prevent unauthorized or fraudulent message exchanges.
Step 2: Analyze the Scope of Control 2.11
* The statement suggests that Control 2.11 is “only about the process of validating the defined counterparty relationships.” While validating counterparty relationships (e.g., ensuring only authorized parties are in the RMA list) is a key component, the control’s scope is broader.
* According to theCSCF v2024,Control 2.11requires:
* Validation of counterparty relationships to ensure they are legitimate and authorized.
* Monitoring and detection of anomalies in RMA-related activities (e.g., unexpected changes to relationships).
* Implementation of segregation of duties and access controls to prevent misuse of RMA privileges.
* Regular review and approval processes for RMA updates.
* TheSwift Security Best PracticesandCSCF v2024guidance emphasize that RMA Business Controls extend beyond mere validation to include ongoing management, security, and oversight of the RMA process to mitigate risks like unauthorized access or fraud.
Step 3: Conclusion and Verification
The answer isB, as Control 2.11 is not limited to validating counterparty relationships; it encompasses a comprehensive set of measures to secure and manage the RMA process, as specified in theCSCF v2024.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.11: RMA Business Controls.
* Swift Security Best Practices, Section: RMA Management.
* Swift User Handbook, Section: RMA Security Requirements.

NO.71 Which of the following infrastructures has the smallest Swift footprint?

Full stack of products up to the Messaging Interface

Alliance Remote Gateway

Alliance Lite2

Full stack of products includinq IPLA

NO.72 What are the conditions required to allow reliance on the compliance conclusion of a control assessed in the previous year? (Select all answers that apply)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

The control compliance conclusion must have already been relied on the past two years

The previous assessment was performed on the CSCF version of the previous year (at least)

The control definition has not changed

The control design and implementation are the same

NO.73 What are the conditions required to permit reliance on the compliance conclusion of a control assessed in the previous year? (Choose all that apply.)

The control compliance conclusion must have already been relied on the past two years

The previous assessment was performed on the (correct) CSCF version of the previous year

The control definition has not changed

The control-design and implementation are the same

NO.74 Which operator session flows are expected to be protected in terms of confidentiality and integrity? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

System administrator sessions towards a host running a SWIFT-related component (on-premises or remote)

All sessions to and from a jump server used to access a component in a secure zone

All sessions towards a SWIFT-related application run by an Outsourcing Agent, a Service Bureau, or an L2BA Provider

All of the other answers are valid

The CSCF requires protection of operator session flows to ensure confidentiality and integrity, particularly for sessions involving SWIFT-related components. This is addressed under Control “2.1 Internal Data Transmission Security” and “2.2 External Transmission Security.” Let’s evaluate each option:
*Option A: System administrator sessions towards a host running a SWIFT-related component (on-premises or remote) This is valid. System administrator sessions to hosts running SWIFT components (e.g., Alliance Gateway on- premises or in the cloud) must be protected using encryption (e.g., TLS) and authentication to prevent unauthorized access or data breaches, aligning with CSCF Control “2.1.”
*Option B: All sessions to and from a jump server used to access a component in a secure zone This is valid. Jump servers (bastion hosts) used to access the secure zone (e.g., for managing Alliance Access) must have all sessions encrypted and integrity-checked, as required by CSCF Control “1.1 SWIFT Environment Protection” and “2.2” to secure access points.
*Option C: All sessions towards a SWIFT-related application run by an Outsourcing Agent, a Service Bureau, or an L2BA Provider This is valid. Sessions to applications hosted by third parties (e.g., Alliance Lite2 Business Application by an L2BA Provider) must be protected, as per CSCF Control “2.2” and the “Outsourcing Agents – Security Requirements Baseline v2025,” which mandates secure transmission regardless of location.
*Option D: All of the other answers are valid
This is correct. Since A, B, and C all describe session flows that require protection under the CSCF, the comprehensive answer is that all listed session types must be secured for confidentiality and integrity.
Summary of Correct answer:
All operator session flows listed (A, B, and C) are expected to be protected, making D the correct choice.
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Controls 2.1 and 2.2 mandate session protection.
*Outsourcing Agents – Security Requirements Baseline v2025: Extends protection to third-party-hosted applications.
*CSP_controls_matrix_and_high_test_plan_2025: Includes all listed session types in security testing.
========

NO.75 Which encryption methods are used to secure the communications between the SNL host and HSM boxes?

NTLS and SSH

Telnet and SSL

NTLS and Telnet

MPLS and SSL

NO.76 The SwiftNet Link (SNL) software is always required for the Swift Alliance Gateway to operate.
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

TRUE

FALSE

NO.77 How are online SwiftNet Security Officers authenticated?

Via their PKI certificate

Via their swift.com account and secure code card

Via their swift.com account

NO.78 As a Swift CSP Certified Assessor, I left the listed provider and started to work independently. Can I continue to perform CSP assessments?

Yes. during the certification validity period

No, this is not allowed

Yes. but not as a Swift CSP Certified assessor

[No, except if Swift formally provides you permission

NO.79 In the case that nothing has changed in the SWIFT user’s infrastructure, is it possible to rely on a previous Independent assessment report without performing another independent assessment? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

Yes, full reliance can be provided without the need of an independent assessment if nothing has changed

No, even if nothing has changed, an independent assessor needs to assess the conditions before being able to rely on the previous year’s assessment

No, even if nothing has changed, an independent assessor needs to perform a full assessment including full testing every year

Yes, full reliance can be provided if the CISO of the SWIFT user signs a letter which confirms that nothing has changed

NO.80 Application Hardening basically applies the following principles. (Choose all that apply.)

Least Privileges

Access on a need to have

Reduced footprint for less potential vulnerabilities

Enhanced Straight Through Processing

Free Cram & Latest Exams Dumps

CSP-Assessor Exam Study Guide Free Practice Test LAST UPDATED DATE Mar 07, 2026 [Q60-Q80]

leave a comment Cancel reply

Recent Posts

Archives

Categories