Practice Test for CSP-Assessor Certification Real 2025 Mock Exam [Q19-Q40]

NO.19 Which of the following infrastructures has the smallest SWIFT footprint? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Full stack of products up to the Messaging Interface

Alliance Remote Gateway

Lite 2 or Alliance Cloud

A user with a Messaging Interface behind a Service Bureau

The “SWIFT footprint” refers to the extent of SWIFT-related infrastructure (hardware, software, and connectivity components) that a user must manage within their environment. A smaller footprint means less local infrastructure to maintain, typically achieved through cloud-based or managed services. Let’s evaluate each option:
*Option A: Full stack of products up to the Messaging Interface
This refers to an on-premises deployment where the user manages a complete set of SWIFT components, including the messaging interface (e.g., Alliance Access), communication interface (e.g., Alliance Gateway), SwiftNet Link (SNL), HSM, and VPN boxes for connectivity to the SWIFT network. This setup requires significant local infrastructure, including servers, security devices, and network components, resulting in a large SWIFT footprint.
*Option B: Alliance Remote Gateway
Alliance Remote Gateway (ARG) is a service where the Alliance Gateway is hosted remotely by SWIFT or a third party, but the user still maintains a messaging interface (e.g., Alliance Access) locally. While this reduces the footprint slightly by outsourcing the communication interface, the user still manages the messaging interface, HSM, and local connectivity components, resulting in a moderate footprint.
*Option C: Lite 2 or Alliance Cloud
This is the correct answer. Alliance Lite2 and Alliance Cloud are cloud-based solutions designed for smaller institutions or those seeking a minimal local footprint. In Alliance Lite2, the user connects to SWIFT via a lightweight client (Alliance Lite2 AutoClient) or a browser-based interface, with most infrastructure (e.g., messaging interface, communication interface, HSM) hosted by SWIFT in the cloud. Alliance Cloud similarly hosts the full SWIFT stack (including Alliance Access and Alliance Gateway) in a SWIFT-managed cloud environment, requiring only minimal local infrastructure (e.g., a secure connection to the cloud). This results in the smallest SWIFT footprint, as the user manages very little on-premises infrastructure. The CSCF still applies, but many controls are managed by SWIFT (e.g., “1.1 SWIFT Environment Protection”).
*Option D: A user with a Messaging Interface behind a Service Bureau
A Service Bureau is a third-party provider that hosts SWIFT infrastructure (e.g., Alliance Gateway, SNL) for multiple users, but the user still maintains a local messaging interface (e.g., Alliance Access) to connect to the Service Bureau. This setup reduces the footprint compared to a full on-premises deployment, as the user does not manage the communication interface or network connectivity components. However, the local messaging interface and associated security components (e.g., HSM) still constitute a larger footprint than a fully cloud- based solution like Alliance Lite2 or Alliance Cloud.
Summary of Correct answer:
Alliance Lite2 or Alliance Cloud (C) has the smallest SWIFT footprint, as most infrastructure is hosted in the cloud by SWIFT, minimizing the user’s local management responsibilities.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.1 applies to cloud deployments like Alliance Cloud, reducing the user’s local footprint.
*SWIFT Alliance Lite2 Documentation: Describes the minimal infrastructure required for Lite2 users.
*SWIFT Alliance Cloud Documentation: Highlights the fully hosted nature of the solution, minimizing the SWIFT footprint.
========

NO.20 As a Swift CSP Certified Assessor, I left the listed provider and started to work independently. Can I continue to perform CSP assessments?

Yes. during the certification validity period

No, this is not allowed

Yes. but not as a Swift CSP Certified assessor

[No, except if Swift formally provides you permission

NO.21 Is it mandated to perform security awareness and other specific trainings every year for individuals with SWIFT-critical roles? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls

Yes, and a track record must show that both awareness and specific training are performed annually

No, both awareness and specific trainings are planned when deemed required

No, awareness training expected to be performed yearly; specific training to maintain the required knowledge only when needed

No, a track record must show that both awareness and specific training are performed at least bi-yearly (every 2 years)

NO.22 In a fully on-premises infrastructure, which security management profile is not involved? (Select the one correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Alliance Security Officer (LSO/RSO)

HSM Administrator

swift.com Administrator

Customer Security Officer

In a fully on-premises infrastructure, all SWIFT-related components (e.g., Alliance Gateway, SwiftNet Link, HSM) are hosted and managed locally by the customer. This setup contrasts with cloud-based deployments (e.
g., Alliance Cloud), where some management is outsourced to SWIFT or third-party providers. The security management profiles refer to roles responsible for overseeing the security of the SWIFT environment. Let’s evaluate each option:
*Option A: Alliance Security Officer (LSO/RSO)
This is involved. The Local Security Officer (LSO) and Remote Security Officer (RSO) are roles defined by SWIFT for managing security settings within the Alliance suite (e.g., Alliance Gateway, Alliance Access). In an on-premises setup, the LSO/RSO is typically an internal staff member who configures security parameters, manages user access, and ensures compliance with CSCF controls like “6.1 Security Awareness.” These roles are mandatory for on-premises deployments.
*Option B: HSM Administrator
This is involved. The HSM Administrator is responsible for managing the Hardware Security Module, which stores PKI certificates and performs cryptographic operations. In an on-premises environment, the customer maintains the HSM locally, and the HSM Administrator oversees its configuration and security, aligning with CSCF Control “1.3 Cryptographic Failover.” This role is essential for on-premises security management.
*Option C: swift.com Administrator
This is not involved. The “swift.com Administrator” is not a standard SWIFT-defined role. It appears to be a misnomer or typo, possibly intended to refer to a SWIFT-hosted service administrator (e.g., someone managing swift.com-related cloud services). In a fully on-premises infrastructure, there is no reliance on SWIFT-hosted services or cloud management, as all components are locally controlled. SWIFT’s cloud offerings (e.g., Alliance Cloud) involve administrators managing SWIFT-hosted infrastructure, but this is irrelevant in an on-premises context. The CSCF does not reference a “swift.com Administrator” role for on- premises setups.
*Option D: Customer Security Officer
This is involved. The Customer Security Officer is a role mandated by the SWIFT CSP, responsible for overseeing the institution’s compliance with the CSCF. In an on-premises environment, this officer ensures that local security controls (e.g., physical security under Control “1.2”) are implemented and audited, making this role essential.
Summary of Correct answer:
In a fully on-premises infrastructure, the “swift.com Administrator” (Option C) is not involved, as it does not apply to locally managed environments and is likely a reference to a cloud-based role.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Defines roles like LSO/RSO, HSM Administrator, and Customer Security Officer for on-premises security (Controls 1.1, 1.3, 6.1).
*SWIFT Alliance Documentation: Describes the LSO/RSO and HSM Administrator roles in on-premises deployments.
*SWIFT CSP Compliance Guidelines: Mandates the Customer Security Officer role for all SWIFT users, including on-premises setups.
========
Additional Notes
*Typing Corrections: Corrected “ijp” to “P” for consistency in category labels. Adjusted “c” to “C” and “0” to
“D” in question options for proper formatting.
*Context of Categories: The categories (“Connectivity,” “Generic,” “Products Cloud,” “Products OnPrem,”
“Security”) likely indicate the scope of the certification test, with “Products OnPrem” being relevant to Questions 4 and 5.
*SWIFT CSP Alignment: Answers align with the CSP’s focus on security roles and infrastructure types, as documented in the CSCF and SWIFT operational guides.

NO.23 Which ones are Alliance Lite2 key components? (Choose all that apply.)

A web interface

An AutoClient

A HSM box

A WebSphere MQ Server

NO.24 What type of keys does the HSM box store? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Private keys

Public keys

Both private and public keys

A Hardware Security Module (HSM) box in the SWIFT context is a secure device used to manage cryptographic keys and perform security operations, such as signing and encryption for SWIFT transactions.
Let’s evaluate each option:
*Option A: Private keys
This is correct. The primary function of an HSM box in the SWIFT environment is to securely store and manage private keys, which are part of the Public Key Infrastructure (PKI) used for asymmetric cryptography.
Private keys are used for signing messages to ensure authenticity and integrity, and for decryption to maintain confidentiality. The HSM protects these private keys from unauthorized access, aligning with CSCF Control
“1.3 Cryptographic Failover,” which mandates the use of HSMs to safeguard cryptographic materials. SWIFT documentation specifies that private keys are stored within the HSM, while public keys are distributed separately (e.g., via certificates).
*Option B: Public keys
This is incorrect. Public keys are not stored in the HSM box. Instead, they are embedded in PKI certificates and distributed to other parties (e.g., SWIFT or counterparties) for verification and encryption purposes. The HSM’s role is to protect the sensitive private keys, not to store public keys, which are openly shared as part of the PKI ecosystem.
*Option C: Both private and public keys
This is incorrect. While the HSM may temporarily handle public keys during cryptographic operations (e.g., for certificate validation), its primary and secure storage function is limited to private keys. Storing both types of keys is not a standard practice in SWIFT’s HSM usage, as public keys are managed outside the HSM in certificate repositories or directories.
Summary of Correct answer:
The HSM box stores private keys (A), ensuring the security of cryptographic operations in the SWIFT environment.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.3 mandates HSMs for storing private keys securely.
*SWIFT Security Guidelines: Details the HSM’s role in managing private keys for PKI operations.
*SWIFT HSM Documentation: Confirms that private keys are stored in the HSM, with public keys managed externally.
========

NO.25 The control SWIFT Environment Protection supports several objectives. (Select the one that does not apply)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

Restrict malicious access from external sources

Forbids any interactive sessions towards the SWIFT infrastructure

Limit risks of privileged accounts compromise

Limit risks of lateral movement

NO.26 The SwiftNet Link (SNL) software is always required for the Swift Alliance Gateway to operate.
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

TRUE

FALSE

NO.27 Must Swift users submit a copy of their final assessment report to Swift?

Yes, all documents produced from the assessment must be provided proactively to Swift

No, it is not required to provide Swift with any documents by default. However, Swift can request a copy of the Assessment completion letter

Yes, a copy of (only) the assessment report must be provided to Swift, no other documents

Yes, in cases where a customer performs an Independent assessment rather than an audit then a copy of the assessment report must be provided. However, it is not required for the Swift user to provide any forms when an Internal/External Audit is performed

This question addresses the obligations of Swift users regarding the submission of assessment-related documents to Swift under the Customer Security Programme (CSP).
Step 1: Understand CSP Assessment Submission Requirements
TheSwift Customer Security Controls Framework (CSCF) v2024and theIndependent Assessment Framework outline the process for CSP assessments, including what must be submitted to Swift. The focus is on ensuring compliance through attestation, with specific deliverables defined.
Step 2: Evaluate Each Option
* A. Yes, all documents produced from the assessment must be provided proactively to SwiftThis is incorrect. TheIndependent Assessment Frameworkdoes not require proactive submission of all assessment documents (e.g., detailed reports, working papers). Only the completion letter and attestation are typically submitted unless otherwise requested by Swift.Conclusion: Incorrect.
* B. No, it is not required to provide Swift with any documents by default. However, Swift can request a copy of the Assessment completion letterTheCSCF v2024andIndependent Assessment Frameworkstate that users are not required to proactively submit the full assessment report or other documents. However, Swift retains the right to request the completion letter (certifying assessment completion) or additional evidence during quality assurance reviews. This aligns with theSwift CSP Compliance Guidelines.Conclusion: Correct.
* C. Yes, a copy of (only) the assessment report must be provided to Swift, no other documentsThis is incorrect. The full assessment report is not mandated for proactive submission; only the completion letter is typically required unless requested. TheIndependent Assessment Frameworkemphasizes the completion letter as the key deliverable.Conclusion: Incorrect.
* D. Yes, in cases where a customer performs an Independent assessment rather than an audit then a copy of the assessment report must be provided. However, it is not required for the Swift user to provide any forms when an Internal/External Audit is performedThis is partially misleading. The Independent Assessment Frameworkdoes not distinguish between independent assessments and audits in terms of mandatory report submission. For both, the completion letter is the default submission, with reports requested only if needed. The differentiation based on assessment type is not supported byCSCF v2024guidelines.Conclusion: Incorrect.
Step 3: Conclusion and Verification
The correct answer isB, as theCSCF v2024andIndependent Assessment Frameworkdo not require proactive submission of the full assessment report, but Swift can request the completion letter as part of its oversight process.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Section: Independent Assessment Requirements.
* Swift Independent Assessment Framework, Section: Deliverables and Submission.
* Swift CSP Compliance Guidelines, Section: Document Submission Rules.

NO.28 Select the correct statement(s).

The public and private keys of a Swift certificate are stored on the Hardware Security Module

The certificate stored on the Swift Hardware Security Module is used during the decryption operation of a message

The decryption operation uses the encryption private key of the receiver

To verify the signature the SwiftNetLink uses the signing private key of the receiver

This question involves the role of the Hardware Security Module (HSM) and cryptographic operations in the Swift environment. Let’s evaluate each option.
Step 1: Understand HSM and Cryptographic Operations in Swift
The HSM is a secure device used to manage cryptographic keys and perform encryption/decryption operations, as detailed inControl 2.5B: Cryptographic Key Managementof theCSCF v2024. Swift uses public key infrastructure (PKI) for secure messaging, with HSMs storing keys and certificates.
Step 2: Evaluate Each Option
* A. The public and private keys of a Swift certificate are stored on the Hardware Security Module In the Swift environment, the HSM stores both the private key (for signing/decryption) and the public key (for verification/encryption) as part of the certificate pair. This is a standard practice for secure key management, as confirmed in theSwift Security Best PracticesandControl 2.5B, which mandates secure storage of cryptographic keys in HSMs.Conclusion: This statement is correct.
* B. The certificate stored on the Swift Hardware Security Module is used during the decryption operation of a messageThe HSM uses the private key stored in the certificate to perform decryption of incoming Swift messages. This is part of the secure message handling process, as outlined inControl 2.5 Band theSwift Alliance Gateway Technical Documentation.Conclusion: This statement is correct.
* C. The decryption operation uses the encryption private key of the receiverDecryption uses the private keyof the receiver, not the “encryption private key” (a misnomer). The correct term is the receiver’s private key, which corresponds to the public key used for encryption. This error makes the statement technically incorrect, despite the intended meaning.Conclusion: This statement is incorrect.
* D. To verify the signature the SwiftNetLink uses the signing private key of the receiverSignature verification requires the sender’s public key, not the receiver’s private key. The SwiftNetLink (SNL) uses the public key to verify the signature, as perControl 2.5BandSwift Security Best Practices. The private key is used for signing, not verification.Conclusion: This statement is incorrect.
Step 3: Conclusion and Verification
The verified statements areAandB, as they accurately describe the HSM’s role in key storage and decryption, consistent with Swift CSP documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.5B: Cryptographic Key Management.
* Swift Security Best Practices, Section: HSM Usage.
* Swift Alliance Gateway Technical Documentation, Section: Cryptographic Operations.

NO.29 The Alliance Gateway application is considered a messaging interface.
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

TRUE

FALSE

NO.30 Compliance to 2.9 Transaction Business Controls can be obtained through different ways. Which of the following one does not ensure compliance?
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

More than one of the measures proposed in the implementation guidelines are implemented

A customer-designed implementation that encounters the control objective and addresses the risk driver

Reliance on a recent business assessment or regulator response confirming effectiveness of the existing control

Any implementation if approved by the CIO

CSCF Control 2.9 (Transaction Business Controls) requires institutions to implement measures to ensure the accuracy and integrity of SWIFT transactions (e.g., payment validation, authorization). Compliance can be achieved through various methods, as outlined in the “Swift Customer Security Controls Framework v2025” and its implementation guidelines. Let’s evaluate each option:
*Option A: More than one of the measures proposed in the implementation guidelines are implemented This ensures compliance. The CSCF provides implementation guidelines for Control 2.9, suggesting measures like dual authorization or automated validation. Implementing multiple measures meets the control’s objective of ensuring transaction integrity.
*Option B: A customer-designed implementation that encounters the control objective and addresses the risk driver This ensures compliance. The CSCF allows flexibility for customer-designed solutions, provided they meet the control objective (e.g., preventing fraudulent transactions) and address the identified risk drivers (e.g., human error), as validated in the “Assessment template for Mandatory controls.”
*Option C: Reliance on a recent business assessment or regulator response confirming effectiveness of the existing control This ensures compliance. If a recent assessment (e.g., by an internal audit or regulator) confirms that existing controls effectively meet the CSCF 2.9 requirements, this can be accepted as evidence of compliance, per the
“Independent Assessment Framework.”
*Option D: Any implementation if approved by the CIO
This does not ensure compliance. The Chief Information Officer (CIO) approval alone does not guarantee that the implementation meets CSCF requirements. Compliance must be based on objective evidence and alignment with the control’s intent, as assessed against the “CSP_controls_matrix_and_high_test_plan_2025” and validated by an independent assessor, not just internal approval.
Summary of Correct answer:
Reliance on CIO approval alone (D) does not ensure compliance with CSCF 2.9.
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 2.9 and implementation guidelines.
*Independent Assessment Framework: Requires objective validation, not just CIO approval.
*Assessment template for Mandatory controls: Specifies evidence-based compliance.
========

NO.31 The Physical Security protection control is also aimed at protecting the “on call” and “working from home” employees’ equipment used to access the Swift-related components.

TRUE

FALSE

NO.32 Which statements are true of Alliance Messaging Hub (AMH)? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

AMH is highly resilient, and can consist of multiple instances and sites in parallel

AMH provides advanced integration capabilities

AMH is a messaging interface able to connect to other financial networks, not only SWIFT

All of the above

Alliance Messaging Hub (AMH) is a SWIFT product designed as a centralized messaging platform for financial institutions, enabling them to manage multiple messaging flows, including SWIFT and non-SWIFT networks. Let’s evaluate each statement:
*Statement A: AMH is highly resilient, and can consist of multiple instances and sites in parallel This is true. AMH is designed for high availability and resilience, supporting deployments across multiple instances and sites to ensure continuity of operations. This capability is critical for large financial institutions handling high volumes of transactions. SWIFT documentation highlights AMH’s ability to operate in a distributed architecture, with instances running in parallel across primary and backup sites. This aligns with CSCF Control “1.1 SWIFT Environment Protection,” which emphasizes the need for resilient infrastructure to prevent disruptions in the SWIFT environment.
*Statement B: AMH provides advanced integration capabilities
This is true. AMH offers advanced integration features, allowing institutions to connect various back-office systems, payment engines, and other financial applications to a single hub. It supports multiple message standards (e.g., SWIFT MT, ISO 20022) and provides transformation and routing capabilities, making it a versatile integration platform. This is a key selling point of AMH, as noted in SWIFT’s product documentation, enabling seamless interoperability across diverse systems.
*Statement C: AMH is a messaging interface able to connect to other financial networks, not only SWIFT This is true. AMH is not limited to SWIFT messaging; it can connect to other financial networks, such as domestic payment systems, real-time gross settlement (RTGS) systems, or proprietary networks. AMH acts as a universal messaging hub, supporting multiple protocols and standards beyond SWIFT’s ecosystem (e.g., FIX for securities trading). This capability is well-documented in SWIFT’s AMH product overview, positioning it as a flexible solution for institutions with diverse connectivity needs.
*Statement D: All of the above
Since all three statements (A, B, and C) are true, this option is the correct answer. AMH’s design for resilience, advanced integration, and multi-network connectivity makes it a comprehensive messaging solution.
Summary of Correct answer:
All statements about AMH are true, making “All of the above” (D) the correct choice.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.1 emphasizes resilience, which AMH supports through its architecture.
*SWIFT Alliance Messaging Hub Documentation: Highlights AMH’s multi-site resilience, integration capabilities, and support for non-SWIFT networks.
*SWIFT Product Overview: Describes AMH as a universal messaging hub for SWIFT and other financial networks.
========

NO.33 What are the conditions required to permit reliance on the compliance conclusion of a control assessed in the previous year? (Choose all that apply.)

The control compliance conclusion must have already been relied on the past two years

The previous assessment was performed on the (correct) CSCF version of the previous year

The control definition has not changed

The control-design and implementation are the same

NO.34 Using the outsourcing agent diagram. Which components must be placed in a secure zone? (Choose all that apply.)

Component A

Component B

Component C

Component D

NO.35 Select the components a SwiftNet Link (SNL) may communicate with. (Choose all that apply.)

The Graphical User Interface

The VPN boxes

The HSM device

The messaging interface (such as Alliance Access)

This question identifies the components with which the SwiftNet Link (SNL) communicates, based on its role in the Swift ecosystem under theSwift Customer Security Controls Framework (CSCF) v2024.
Step 1: Understand the Role of SwiftNet Link (SNL)
The SNL is a communication layer that facilitates secure connectivity between a Swift user’s environment and the Swift network. It handles encrypted data transmission and interacts with specific infrastructure components, as detailed in theSwift Alliance Gateway Technical DocumentationandControl 1.1: Swift Environment Protectionof theCSCF v2024.
Step 2: Evaluate Each Option
* A. The Graphical User InterfaceThe GUI (e.g., operator interface) is used by personnel to interact with Swift applications (e.g., Alliance Access), but it does not directly communicate with the SNL. The SNL operates at the network and security layer, not the user interface layer, per theSwift User Handbook
.Conclusion: Incorrect.
* B. The VPN boxesThe SNL communicates with VPN boxes to establish secure tunnels (e.g., using NTLS) for data transmission to the Swift network, as specified in theSwift Security Best Practicesand Control 2.6: Internet Accessibility Restriction.Conclusion: Correct.
* C. The HSM deviceThe SNL interacts with the Hardware Security Module (HSM) to manage cryptographic keys and secure communications, as outlined inControl 2.5B: Cryptographic Key Managementand theSwift Alliance Gateway Technical Documentation.Conclusion: Correct.
* D. The messaging interface (such as Alliance Access)The SNL connects to the messaging interface (e.
g., Alliance Access or Entry) to transmit and receive Swift messages, a core function described in the CSCF v2024underControl 1.1.Conclusion: Correct.
Step 3: Conclusion and Verification
The correct answers areB, C, and D, as the SNL communicates with VPN boxes, HSM devices, and messaging interfaces to ensure secure and functional connectivity to the Swift network, consistent withCSCF v2024and related documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection, Control 2.5B: Cryptographic Key Management, Control 2.6: Internet Accessibility Restriction.
* Swift Alliance Gateway Technical Documentation, Section: SNL Communication.
* Swift Security Best Practices, Section: Network Infrastructure.

NO.36 Which of the following statements best describe valid implementations when implementing control 2.9 Transaction Business Controls? (Choose all that apply.)

Multiple measures must be implemented by the Swift user to validate the flows of transactions are in the bounds of the normal expected business

A customer designed implementation or a combination of different measures are deemed valid if they sufficiently mitigate the control risks

Reliance on a recent business assessment or regulator response confirming the effectiveness of the control (as an example CPMI’s_ requirement) is especially poignant to this control

Any solutions is acceptable so long as the CISO approves the implementation

NO.37 The internet connectivity restriction control prevents having internet access on any CSCE m-scope components.

TRUE

FALSE

NO.38 For each of the following setups, the responsible party is identified to protect the virtualization or cloud underlying platform. Which one of the combinations is not correct?
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

For on-premises virtualization platform: by the platform provider

For virtualization platform deployed at a third party on which user’s SWIFT-related components are virtually hosted: by the third party

For on-premises container platform: by the SWIFT user

For Cloud Provider: the cloud provider

The CSCF and “Outsourcing Agents – Security Requirements Baseline v2025” define responsibilities for securing virtualization or cloud platforms hosting SWIFT-related components. Let’s evaluate each combination:
*Option A: For on-premises virtualization platform: by the platform provider This is not correct. An on-premises virtualization platform (e.g., VMware or Hyper-V hosting Alliance Gateway) is managed by the SWIFT user, not the platform provider (e.g., VMware). The “platform provider” supplies the software, but the user is responsible for securing the on-premises environment, including hardening, patching, and compliance with CSCF Control “2.3 System Hardening.”
*Option B: For virtualization platform deployed at a third party on which user’s SWIFT-related components are virtually hosted: by the third party This is correct. If the virtualization platform is hosted by a third party (e.g., a service provider hosting SWIFT components), the third party is responsible for securing the platform, as per the “Outsourcing Agents – Security Requirements Baseline v2025” and CSCF Control “1.1.”
*Option C: For on-premises container platform: by the SWIFT user
This is correct. An on-premises container platform (e.g., Docker or Kubernetes hosting SWIFT applications) is the user’s responsibility to secure, aligning with CSCF Control “1.1” and the user’s ownership of on- premises infrastructure.
*Option D: For Cloud Provider: the cloud provider
This is correct. In a cloud model (e.g., IaaS like Alliance Cloud on AWS), the cloud provider (e.g., AWS) is responsible for securing the underlying platform, as outlined in the “Outsourcing Agents – Security Requirements Baseline v2025.” Summary of Correct answer:
The combination that is not correct is A, as the SWIFT user, not the platform provider, is responsible for securing an on-premises virtualization platform.
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 1.1 defines responsibilities for on-premises platforms.
*Outsourcing Agents – Security Requirements Baseline v2025: Specifies third-party and cloud provider responsibilities.
*Independent Assessment Framework: Confirms user responsibility for on-premises setups.

NO.39 What must a Swift user implement to comply with a CSCF security control?

A solution that maps the implementation guidelines described for a controls in scope components

A solution that meets the control objectives and addresses the risk drivers for the in scope components)

NO.40 How can PKI certificate requests be submitted to SWIFT? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Using both online and offline methods

Using an online method

Using an offline method

None of the above

Practice Test for CSP-Assessor Certification Real 2025 Mock Exam [Q19-Q40]

Leave a Reply Cancel reply