New PrepAwayPDF CSP-Assessor Exam Questions Real CSP-Assessor Dumps Updated on Jul 23, 2025 [Q21-Q45]

NEW QUESTION 21
What does the CSCF expect in terms of Database Integrity? (Choose all that apply.)

Nothing is needed when the messaging or connector integrates/embeds an integrity check functionality at each Swift transaction record level.

When a database is used by a messaging interface or connector, the related hosted database and its supporting system must be protected as a Swift-related component and exceptions alerted

Alerts generated from performed integrity checks are captured and analysed for appropriate treatment

NEW QUESTION 22
The internet connectivity restriction control prevents having internet access on any CSCE m-scope components.

TRUE

FALSE

NEW QUESTION 23
Who can connect to SWIFT? (Select all answers that apply)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Financial institutions, such as banks and securities broker-dealers

Individuals who use online banking for international transfers

Market infrastructures that provide financial institutions with centralized transaction processing

Corporates that work with multiple banking partners

SWIFT (Society for Worldwide Interbank Financial Telecommunication) is a global cooperative that provides a secure messaging network primarily for financial transactions. Its services are designed for entities involved in the financial ecosystem, and access is restricted to members or participants who meet SWIFT’s membership criteria. Let’s evaluate each option:
*Option A: Financial institutions, such as banks and securities broker-dealers This is correct. SWIFT’s core users are financial institutions, including banks, broker-dealers, and other entities regulated under financial authorities. These institutions are direct members of SWIFT or connect through correspondent banking relationships. The SWIFT Customer Security Programme (CSP) and CSCF are tailored to secure the messaging environment for these entities, with controls like “1.1 SWIFT Environment Protection” designed to safeguard their operations. Membership requires adherence to SWIFT’s security standards, and these institutions use SWIFTNet for payments, securities, trade, and treasury services.
*Option B: Individuals who use online banking for international transfers This is incorrect. Individuals, including those using online banking for international transfers, do not connect directly to SWIFT. Instead, they rely on their banks or financial service providers, which act as intermediaries using SWIFT’s network. SWIFT is a business-to-business (B2B) network, not a consumer-facing platform.
The CSCF does not address individual users; its focus is on institutional security controls, such as those protecting the SWIFT secure zone.
*Option C: Market infrastructures that provide financial institutions with centralized transaction processing This is correct. Market infrastructures, such as clearinghouses, central securities depositories (CSDs), and payment systems (e.g., TARGET2 or CHAPS), are eligible to connect to SWIFT. These entities facilitate centralized transaction processing for financial institutions and are part of the broader financial ecosystem.
SWIFT documentation recognizes their role, and they are subject to the same security requirements under the CSP. For example, CSCF Control “1.2 Physical Security” applies to these infrastructures when they host SWIFT-related components.
*Option D: Corporates that work with multiple banking partners
This is correct. Corporates, especially large multinational corporations with complex financial operations, can connect to SWIFT through SWIFT’s corporate connectivity options, such as Alliance Lite2 or SWIFT for Corporates. These services allow corporates to send and receive payment instructions directly via SWIFTNet, bypassing some intermediary steps with banks. This capability is outlined in SWIFT’s corporate access documentation, and such entities must comply with CSP security controls when integrating with the SWIFT network. The CSCF extends to these participants, ensuring their environments are secure (e.g., Control “6.1 Security Awareness”).
Summary of Correct Answers:
Financial institutions (A), market infrastructures (C), and corporates with multiple banking partners (D) can connect to SWIFT, either as direct members or through specific connectivity options. Individuals (B) do not have direct access.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Applies to all SWIFT users, including financial institutions, market infrastructures, and corporates, with security controls tailored to their environments (Controls 1.1, 6.1).
*SWIFT Membership Guidelines: Outlines eligibility for financial institutions, market infrastructures, and corporates, excluding individuals.
*SWIFT for Corporates Documentation: Details corporate connectivity options like Alliance Lite2.

NEW QUESTION 24
The messaging operator in Alliance Lite2… (Select the two correct answers that apply)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Can create and modify messages

Can assign RBAC roles to RMA operators and messaging operators

Can approve the Customer Security Officer change requests

Can approve messages

Alliance Lite2 is a cloud-based solution for smaller institutions, providing a lightweight interface to the SWIFT network. The messaging operator in Alliance Lite2 is a role responsible for managing message-related activities, typically through the Alliance Lite2 Business Application (L2BA) interface. Let’s evaluate each option:
*Option A: Can create and modify messages
This is correct. The primary role of a messaging operator in Alliance Lite2 is to create and modify SWIFT messages, such as payment instructions (e.g., MT103) or other FIN messages. This is a core function of the L2BA interface, which provides a browser-based platform for operators to input, edit, and send messages.
SWIFT documentation for Alliance Lite2 confirms that messaging operators have the necessary permissions to perform these tasks, aligning with the operational workflows supported by the platform.
*Option B: Can assign RBAC roles to RMA operators and messaging operators This is incorrect. Role-Based Access Control (RBAC) role assignment in Alliance Lite2 is typically managed by a security officer or administrator role, not the messaging operator. The messaging operator’s scope is limited to message-related activities, not user or role management. In Alliance Lite2, RBAC is managed through the Alliance Web Platform, where a security officer (e.g., LSO) assigns roles to operators, including RMA (Relationship Management Application) operators and messaging operators. The CSCF Control “6.1 Security Awareness” emphasizes the separation of duties, ensuring that operational roles like messaging operators do not overlap with administrative roles.
*Option C: Can approve the Customer Security Officer change requests
This is incorrect. Approving Customer Security Officer (CSO) change requests is a high-level administrative task that falls under the purview of SWIFT’s security and compliance processes, often involving SWIFT’s support team or a designated administrator within the institution. In Alliance Lite2, this responsibility does not lie with the messaging operator, whose role is focused on message handling. The CSCF mandates strict controls for CSO changes, typically requiring multi-party approval outside the messaging operator’s scope.
*Option D: Can approve messages
This is correct. In Alliance Lite2, messaging operators can approve messages as part of the workflow, depending on the institution’s configuration. For example, a message created by one operator may require approval by another operator (or the same operator if configured with dual roles) before it is sent to the SWIFT network. This approval process ensures accuracy and compliance with internal controls, a feature supported by the L2BA interface in Alliance Lite2. SWIFT documentation highlights this capability as part of the messaging workflow.
Summary of Correct Answers:
The messaging operator in Alliance Lite2 can create and modify messages (A) and can approve messages (D), consistent with their operational role.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 6.1 emphasizes role separation, limiting messaging operators to message-related tasks.
*SWIFT Alliance Lite2 Documentation: Details the messaging operator’s role in creating, modifying, and approving messages via L2BA.
*SWIFT Security Guidelines: Highlights administrative roles for RBAC and CSO changes, excluding messaging operators.

NEW QUESTION 25
The SWIFT user has installed its own Communication Interface on a dedicated virtual machine offered by a public cloud provider. Under which provider category does the public cloud provider fit, and what is the CSP impact? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls

The public cloud provider is considered a L2BA provider, and therefore not in scope of the CSP

The public cloud provider is considered a SWIFT connectivity provider, and therefore not in scope of the CSP

The public cloud provider is considered an outsourcing agent, and therefore in scope of the CSP

This type of implementation is not allowed by the CSP

The “Outsourcing Agents – Security Requirements Baseline v2025” and “Swift Customer Security Controls Framework v2025” define provider categories and CSP impact. Let’s evaluate each option:
*Option A: The public cloud provider is considered a L2BA provider, and therefore not in scope of the CSP This is incorrect. An L2BA (Lite2 Business Application) provider hosts the full SWIFT stack for users, but a public cloud provider offering a virtual machine is not an L2BA provider unless it provides the full service.
The CSP still applies to the provider’s infrastructure.
*Option B: The public cloud provider is considered a SWIFT connectivity provider, and therefore not in scope of the CSP This is incorrect. A SWIFT connectivity provider (e.g., Alliance Connect) is a specific role, but a public cloud provider (e.g., AWS) hosting a communication interface is an outsourcing agent, subject to CSP requirements.
*Option C: The public cloud provider is considered an outsourcing agent, and therefore in scope of the CSP This is correct. The “Outsourcing Agents – Security Requirements Baseline v2025” classifies public cloud providers hosting SWIFT components (e.g., a virtual machine with Alliance Gateway) as outsourcing agents.
The CSP impacts the provider by requiring them to secure the underlying infrastructure (e.g., Control 1.1), while the user secures the communication interface.
*Option D: This type of implementation is not allowed by the CSP
This is incorrect. The CSP permits cloud-based deployments, including user-installed components on public cloud VMs, as long as security controls are met.
Summary of Correct answer:
The public cloud provider is an outsourcing agent, in scope of the CSP (C).
References to SWIFT Customer Security Programme Documents:
*Outsourcing Agents – Security Requirements Baseline v2025: Defines cloud providers as outsourcing agents.
*Swift Customer Security Controls Framework v2025: Applies controls to outsourced environments.
*CSP_controls_matrix_and_high_test_plan_2025: Includes cloud provider assessments.
========

NEW QUESTION 26
Which encryption methods are used to secure the communications between the SNL host and HSM boxes?

NTLS and SSH

Telnet and SSL

NTLS and Telnet

MPLS and SSL

NEW QUESTION 27
The SWIFT VPN boxes are located between the Messaging and Communication interface.
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

TRUE

FALSE

In the SWIFT architecture, VPN boxes (e.g., Alliance Connect boxes or virtual VPN appliances) are network devices that establish a secure connection to the SWIFT Secure IP Network (SIPN) using Virtual Private Network (VPN) technology. Let’s evaluate the statement:
*The “Messaging Interface” refers to components like Alliance Access (SAA), which create, process, and manage SWIFT messages (e.g., MT103). The “Communication Interface” refers to components like Alliance Gateway (SAG), which consolidate message flows and connect to the SWIFT network via SwiftNet Link (SNL).
*The SWIFT VPN boxes are located at the network boundary, connecting the customer’s internal SWIFT environment (including both messaging and communication interfaces) to the external SIPN. They are not positioned between the messaging interface and the communication interface; instead, they sit outside the SWIFT secure zone, linking the entire local infrastructure to SWIFTNet.
*In a typical deployment, the architecture flows as follows: Messaging Interface (e.g., Alliance Access) # Communication Interface (e.g., Alliance Gateway with SNL) # VPN Boxes # SWIFTNet. The VPN boxes are part of the external connectivity layer, not an intermediary between internal components. This is supported by CSCF Control “1.1 SWIFT Environment Protection,” which defines the secure zone as including messaging and communication interfaces, with VPN boxes providing the external link.
*The statement’s implication that VPN boxes separate the messaging and communication interfaces is incorrect, as they are part of the broader connectivity infrastructure.
Summary of Correct answer:
The SWIFT VPN boxes are not located between the Messaging and Communication interface; they connect the entire local SWIFT environment to the SIPN, making the statement false.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.1 defines the secure zone and external connectivity via VPN boxes.
*SWIFT Alliance Gateway Documentation: Describes the placement of VPN boxes outside the communication interface.
*SWIFT Network Architecture Guide: Confirms VPN boxes as the external connection point to SIPN.

NEW QUESTION 28
A Treasury Management System (TMS) application is installed on the same machine as the customer connector (such as MQ server) connecting towards a Service Bureau Are these applications/systems in scope of CSCF?

The TMS application, the MQ server and hosting system are in the scope of the CSCF and must be placed in a secure zone

The TMS application, the MQ server and hosting system enters the scope of the CSCF advisory and should be placed in a secure zone

Only the MO server application is in scope of the CSCF> The TMS application is considered as back- office

The TMS application is the highest risk and must be secured appropriately. The MQ server should be secured on a best effort basis

This question determines the scope of the CSCF for a Treasury Management System (TMS) and an MQ server (customer connector) installed on the same machine.
Step 1: Understand CSCF Scope
TheCSCF v2024defines its scope as systems directly involved in Swift messaging, connectivity, or security (e.
g., customer connectors, messaging interfaces), as perControl 1.1: Swift Environment Protection. Back- office systems, like TMS, are typically out of scope unless they directly process Swift messages.
Step 2: Analyze the Scenario
* TMS Application: A Treasury Management System is a back-office application for financial management, not a Swift messaging component. TheCSCF v2024excludes back-office systems from mandatory scope unless they pose a direct risk to Swift components.
* MQ Server (Customer Connector): This middleware server connects to a Service Bureau, facilitating Swift traffic, making it in scope perControl 1.1.
* Hosting System: The machine hosting both applications is in scope only to the extent it supports the MQ server, not the TMS.
Step 3: Evaluate Each Option
* A. The TMS application, the MQ server and hosting system are in the scope of the CSCF and must be placed in a secure zoneIncorrect. The TMS is out of scope, and the hosting system’s inclusion depends on the MQ server, not the TMS.Conclusion: Incorrect.
* B. The TMS application, the MQ server and hosting system enters the scope of the CSCF advisory and should be placed in a secure zoneIncorrect. The CSCF advisory scope applies to best practices, not mandatory controls, and does not mandate a secure zone for out-of-scope TMS.
Conclusion: Incorrect.
* C. Only the MQ server application is in scope of the CSCF. The TMS application is considered as back-officeCorrect. The MQ server is a customer connector, in scope perControl 1.1, while the TMS is a back-office system, excluded from mandatory scope per theCSCF v2024Introduction.Conclusion:
Correct.
* D. The TMS application is the highest risk and must be secured appropriately. The MQ server should be secured on a best effort basisIncorrect. The MQ server, as a Swift component, has higher CSCF priority, while TMS risk is managed outside CSCF scope.Conclusion: Incorrect.
Step 4: Conclusion and Verification
The correct answer isC, as only the MQ server is in scope, and the TMS is a back-office system excluded from CSCF requirements.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection, Introduction Section: Scope.
* Swift CSP FAQ, Section: Back-Office Systems.

NEW QUESTION 29
A Swift user has remediated an exception reported by the assessor. What are their obligations before updating and submitting an attestation reflecting the new compliance level?

The exception must be re-assessed by an independent assessor. The assessor can be different to the one who initially raised the exception

The exception must be re-assessed by the same independent assessor that raised the exception

The first line of defense can confirm their level of compliance using a self-assessment approach

None, if the remediation has been completed, a new attestation can be submitted reflecting the compliance of the control

NEW QUESTION 30
Select the correct statement(s).

The public and private keys of a Swift certificate are stored on the Hardware Security Module

The certificate stored on the Swift Hardware Security Module is used during the decryption operation of a message

The decryption operation uses the encryption private key of the receiver

To verify the signature the SwiftNetLink uses the signing private key of the receiver

This question involves the role of the Hardware Security Module (HSM) and cryptographic operations in the Swift environment. Let’s evaluate each option.
Step 1: Understand HSM and Cryptographic Operations in Swift
The HSM is a secure device used to manage cryptographic keys and perform encryption/decryption operations, as detailed inControl 2.5B: Cryptographic Key Managementof theCSCF v2024. Swift uses public key infrastructure (PKI) for secure messaging, with HSMs storing keys and certificates.
Step 2: Evaluate Each Option
* A. The public and private keys of a Swift certificate are stored on the Hardware Security Module In the Swift environment, the HSM stores both the private key (for signing/decryption) and the public key (for verification/encryption) as part of the certificate pair. This is a standard practice for secure key management, as confirmed in theSwift Security Best PracticesandControl 2.5B, which mandates secure storage of cryptographic keys in HSMs.Conclusion: This statement is correct.
* B. The certificate stored on the Swift Hardware Security Module is used during the decryption operation of a messageThe HSM uses the private key stored in the certificate to perform decryption of incoming Swift messages. This is part of the secure message handling process, as outlined inControl 2.5 Band theSwift Alliance Gateway Technical Documentation.Conclusion: This statement is correct.
* C. The decryption operation uses the encryption private key of the receiverDecryption uses the private keyof the receiver, not the “encryption private key” (a misnomer). The correct term is the receiver’s private key, which corresponds to the public key used for encryption. This error makes the statement technically incorrect, despite the intended meaning.Conclusion: This statement is incorrect.
* D. To verify the signature the SwiftNetLink uses the signing private key of the receiverSignature verification requires the sender’s public key, not the receiver’s private key. The SwiftNetLink (SNL) uses the public key to verify the signature, as perControl 2.5BandSwift Security Best Practices. The private key is used for signing, not verification.Conclusion: This statement is incorrect.
Step 3: Conclusion and Verification
The verified statements areAandB, as they accurately describe the HSM’s role in key storage and decryption, consistent with Swift CSP documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.5B: Cryptographic Key Management.
* Swift Security Best Practices, Section: HSM Usage.
* Swift Alliance Gateway Technical Documentation, Section: Cryptographic Operations.

NEW QUESTION 31
For which reasons (as per the “CSP Independent Assessment Process for Assessors Guidelines”) is it required to keep minutes of all key meetings related to a CSP assessment process (examples: kick-off, scope definition, exit meeting)? (Select all answers that apply)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

To support quality review (audit) processes

For documentation purpose

To keep key information that can be used as input for the next step in the assessment process

To be uploaded in KYC-SA at the end of the assessment (mandated by SWIFT)

NEW QUESTION 32
As a Swift CSP Certified Assessor. Swift contacted me to provide evidence on an assessment I have performed. This is required to support their quality assurance validation process. Is it allowed?

Yes, one of the obligations of the certification programme is that quality assessment can be performed by Swift

No, it’s confidential

NEW QUESTION 33
The Physical Security protection control is also aimed at protecting the “on call” and “working from home” employees’ equipment used to access the Swift-related components.

TRUE

FALSE

NEW QUESTION 34
The Swift user has an sFTP server to push files to an outsourcing agent hosting the Swift users own Communication interface. What is their architecture type?

A1

B

A3

A4

NEW QUESTION 35
For each of the following setups, the responsible party is identified to protect the virtualization or cloud underlying platform. Which one of the combinations is not correct?
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

For on-premises virtualization platform: by the platform provider

For virtualization platform deployed at a third party on which user’s SWIFT-related components are virtually hosted: by the third party

For on-premises container platform: by the SWIFT user

For Cloud Provider: the cloud provider

The CSCF and “Outsourcing Agents – Security Requirements Baseline v2025” define responsibilities for securing virtualization or cloud platforms hosting SWIFT-related components. Let’s evaluate each combination:
*Option A: For on-premises virtualization platform: by the platform provider This is not correct. An on-premises virtualization platform (e.g., VMware or Hyper-V hosting Alliance Gateway) is managed by the SWIFT user, not the platform provider (e.g., VMware). The “platform provider” supplies the software, but the user is responsible for securing the on-premises environment, including hardening, patching, and compliance with CSCF Control “2.3 System Hardening.”
*Option B: For virtualization platform deployed at a third party on which user’s SWIFT-related components are virtually hosted: by the third party This is correct. If the virtualization platform is hosted by a third party (e.g., a service provider hosting SWIFT components), the third party is responsible for securing the platform, as per the “Outsourcing Agents – Security Requirements Baseline v2025” and CSCF Control “1.1.”
*Option C: For on-premises container platform: by the SWIFT user
This is correct. An on-premises container platform (e.g., Docker or Kubernetes hosting SWIFT applications) is the user’s responsibility to secure, aligning with CSCF Control “1.1” and the user’s ownership of on- premises infrastructure.
*Option D: For Cloud Provider: the cloud provider
This is correct. In a cloud model (e.g., IaaS like Alliance Cloud on AWS), the cloud provider (e.g., AWS) is responsible for securing the underlying platform, as outlined in the “Outsourcing Agents – Security Requirements Baseline v2025.” Summary of Correct answer:
The combination that is not correct is A, as the SWIFT user, not the platform provider, is responsible for securing an on-premises virtualization platform.
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 1.1 defines responsibilities for on-premises platforms.
*Outsourcing Agents – Security Requirements Baseline v2025: Specifies third-party and cloud provider responsibilities.
*Independent Assessment Framework: Confirms user responsibility for on-premises setups.

NEW QUESTION 36
The Swift user would like to perform their CSP assessment in May for the CSCF version that will only be active as from July the same year. Is it allowed?

No, an assessment can only be done on the active version of the CSCF

Yes, the assessment on a particular version can start before the actual activation date

NEW QUESTION 37
What are the possible impacts for a SWIFT user to be non-compliant to CSP? (Select the two correct answers that apply)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

To be reported to their supervisors (if applicable)

To be seen as non-compliant to their counterparts in KYC-SA

To be contacted by SWIFT to provide the CSP assessment report and detailed information about the reason of non-compliance

To be delisted from the BIC directory

NEW QUESTION 38
Using the outsourcing agent diagram. Which components must be placed in a secure zone? (Choose all that apply.)

Component A

Component B

Component C

Component D

NEW QUESTION 39
The Internal Audit and an external assessment company are both involved in a SWIFT user’s assessment.
Both have shared control assessments to cover the full scope (meaning two separate assessment teams). Who needs to provide a completion letter? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

The Internal audit lead assessor and the external company lead assessor

The Internal audit lead assessor only

The External company lead assessor only

None of them, it is not required when an internal department was involved in the assessment

NEW QUESTION 40
Which operator session flows are expected to be protected in terms of confidentiality and integrity? (Choose all that apply.)

System administrator sessions towards a host running a Swift related component

All sessions to and from a jump server used to access a component in a secure zone

All sessions towards a secure zone (on-premises or hosted by a third-party or a Cloud Provider)

All sessions towards a Swift related application run by an Outsourcing Agent, a Service Bureau or an L2BA Provider

NEW QUESTION 41
As a SWIFT CSP Certified Assessor, my external cybersecurity certification (example: CISA) has expired.
Am I still allowed to work as a certified assessor?
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

No, a valid external cybersecurity certification is mandatory to keep the CSP Certified Assessor certification

Yes, if the SWIFT CSP Assessor certification is still valid

NEW QUESTION 42
A Swift user can only exchange FIN messages via the Swift network.

TRUE

FALSE

NEW QUESTION 43
The objective of the Customer Environment Protection control is to separate the user’s Swift infrastructure which restricts malicious access from the external world and from the General IT environment of the Swift user.

TRUE

FALSE

NEW QUESTION 44
Select the correct statement about Alliance Gateway.

It is used to exchange messages over the Swift network

It is used to create messages to send over the Swift network

NEW QUESTION 45
Which operator session flows are expected to be protected in terms of confidentiality and integrity? (Choose all that apply.)

System administrator sessions towards a host running a Swift related component

All sessions to and from a jump server used to access a component in a secure zone

All sessions towards a secure zone (on-premises or hosted by a third-party or a Cloud Provider)

All sessions towards a Swift related application run by an Outsourcing Agent, a Service Bureau or an L2BA Provider

Topic	Details
Topic 1	Understanding the methodology and assessment deliverables: This section is designed for independent auditors working with Swift systems. It tests the candidate’s grasp of the Assessor’s role and obligations when conducting a CSP assessment. The section evaluates knowledge of key elements to consider during the assessment process.
Topic 2	Understanding the Swift Customer Security Programme: This domain is targeted at compliance officers and risk managers involved in Swift operations. It evaluates the candidate’s comprehension of the CSP controls framework and their ability to determine the appropriate architecture type and related scope as outlined in the Customer Security Controls Framework (CSCF).
Topic 3	Understanding Swift: This section of the exam measures the skills of Swift network administrators and covers Swift’s crucial role in the international financial community, including the structure and operations of the Swift network and its infrastructure.

New PrepAwayPDF CSP-Assessor Exam Questions Real CSP-Assessor Dumps Updated on Jul 23, 2025 [Q21-Q45]

Swift CSP-Assessor Exam Syllabus Topics:

admin

Leave a Reply Cancel reply