Swift CSP-Assessor Dumps Updated Mar 09, 2025 WIith 58 Questions [Q28-Q49]

Topic	Details
Topic 1	Understanding the methodology and assessment deliverables: This section is designed for independent auditors working with Swift systems. It tests the candidate’s grasp of the Assessor’s role and obligations when conducting a CSP assessment. The section evaluates knowledge of key elements to consider during the assessment process.
Topic 2	Understanding the Swift Customer Security Programme: This domain is targeted at compliance officers, and risk managers involved in Swift operations. It evaluates the candidate’s comprehension of the CSP controls framework and their ability to determine the appropriate architecture type and related scope as outlined in the Customer Security Controls Framework (CSCF).
Topic 3	Understanding Swift: This section of the exam measures the skills of Swift network administrators and covers Swift’s crucial role in the international financial community, including the structure and operations of the Swift network and its infrastructure.

Q28. Which ones are Alliance Lite2 key components? (Choose all that apply.)

A web interface

An AutoClient

A HSM box

A WebSphere MQ Server

Q29. The cluster of VPN boxes is also called managed-customer premises equipment (M-CPE).

TRUE

FALSE

Q30. When hesitant on the applicability of a CSCF control to a particular component? What steps should you take? (Choose all that apply.)

Call your Swift contact

Check appendix F of the CSCF

Check carefully the Introduction section of the CSCF

Open a case with Swift support via the case manager on swift com if further information or solution cannot be found in the documentation

Q31. Can a Swift user choose to implement the security controls (example: logging and monitoring) in systems which are not directly in scope of the CSCE?

Yes

Q32. Is it necessary to formally explain to the Swift user the testing methodology that will be used for the CSP assessment during the kick-off?

Yes

Q33. What is expected regarding Token Management when (physical or software-based) tokens are used? (Choose all that apply.)

Similar to user accounts, individual assignment and ownership for accurate traceability and revocation in case of potential tampering, loss or in case of user role change

Have in place a strict token assignment process. This avoids the need to perform g a regular review of assigned tokens

Individuals must not share their tokens. Tokens must remain under the control and supervision of its owner

All tokens must be stored in a safe when not used

Q34. Where is the implementation of multi-factor authentication deemed sufficient to support control 4.2 compliance? (Choose all that apply.)

When accessing an outsourcing agent or an L2BA Swift-related application

When logging-in on an interface, a connector, or the system running such component

When login on the jump server filtering access to local Swift secure zone

On the General Operator PC used to access a Swift-related component

Q35. The Swift user has an sFTP server to push files to an outsourcing agent hosting the Swift users own Communication interface. What is their architecture type?

Q36. Select the correct statement(s).

The public and private keys of a Swift certificate are stored on the Hardware Security Module

The certificate stored on the Swift Hardware Security Module is used during the decryption operation of a message

The decryption operation uses the encryption private key of the receiver

To verify the signature the SwiftNetLink uses the signing private key of the receiver

Q37. What type of control effectiveness needs to be validated for an independent assessment?

Effectiveness is never validated only the control design

An independent assessment is a point in time review with possible reviews of older evidence as appropriate

Operational effectiveness needs to be validated

None of the above

Q38. The Alliance Web Platform Administrator uses both the GUI and command line to perform configuration and monitoring tasks on AWP SE.

TRUE

FALSE

Q39. Must all CSCF controls be subject to an assessment?

Yes

No, only the mandatory controls

No, only the attested controls (with as a minimum the mandatory ones]

No, the control selection is defined between the Swift User and their assessor

Q40. Select the correct statement about Alliance Gateway.

It is used to exchange messages over the Swift network

It is used to create messages to send over the Swift network

Q41. What must a Swift user implement to comply with a CSCF security control?

A solution that maps the implementation guidelines described for a controls in scope components

A solution that meets the control objectives and addresses the risk drivers for the in scope components)

Q42. Alliance Lite2 only supports the sending and receiving of FIN messages.

TRUE

FALSE

Q43. A Swift user has moved from one Service Bureau to another What are the obligations of the Swift user in the CSP context?

To reflect that in the next attestation cycle

None if there is no impact in the architecture tope

To inform the SB certification office at Swift WW

To submit an updated attestation reflecting this change within 3 months

Q44. Which encryption methods are used to secure the communications between the SNL host and HSM boxes?

NTLS and SSH

Telnet and SSL

NTLS and Telnet

MPLS and SSL

Q45. How are online SwiftNet Security Officers authenticated?

Via their PKI certificate

Via their swift.com account and secure code card

Via their swift.com account

Q46. Can an assessor re-use an ISAE 3000 report dating back 2 years to support an independent assessment?

No, that is too old, the maximum is 18 months

Yes, there is no time limit for an iSAE 3000 report

No, the SAE 3000 report is no valid surrogate as a rule

Yes, provided there is no change to the Swift user’s infrastructure

Q47. What are the conditions required to permit reliance on the compliance conclusion of a control assessed in the previous year? (Choose all that apply.)

The control compliance conclusion must have already been relied on the past two years

The previous assessment was performed on the (correct) CSCF version of the previous year

The control definition has not changed

The control-design and implementation are the same

Q48. Penetration testing must be performed at application level against the Swift-related components, such as the interfaces, Swift and customer connectors?

True, those are key components

False, only the components as defined in Swift Testing Policy

Q49. The only type of HSM devices offered by Swift are HSM tokens and HSM boxes.

TRUE

FALSE