Question 1

What does the CSCF expect in terms of Database Integrity? (Choose all that apply.)

Options :

A :

Nothing is needed when the messaging or connector integrates/embeds an integrity check functionality at each Swift transaction record level.

B :

When a database is used by a messaging interface or connector, the related hosted database and its supporting system must be protected as a Swift-related component and exceptions alerted

C : Alerts generated from performed integrity checks are captured and analysed for appropriate treatment

Answer: B,C

Question 2

A Swift user has remediated an exception reported by the assessor. What are their obligations before updating

and submitting an attestation reflecting the new compliance level?

Options :

A :

The exception must be re-assessed by an independent assessor. The assessor can be different to the one who initially raised the exception

B : The exception must be re-assessed by the same independent assessor that raised the exception

C : The first line of defense can confirm their level of compliance using a self-assessment approach

D :

None, if the remediation has been completed, a new attestation can be submitted reflecting the compliance of the control

Answer: A

Question 3

A Swift user has moved from one Service Bureau to another What are the obligations of the Swift user in the CSP context?

Options :

A : To inform the SB certification office at Swift WW

B : To reflect that in the next attestation cycle

C : None if there is no impact in the architecture tope

D : To submit an updated attestation reflecting this change within 3 months

Answer: D

Question 4

When hesitant on the applicability of a CSCF control to a particular component? What steps should you take? (Choose all that apply.)

Options :

A : Call your Swift contact

B : Check appendix F of the CSCF

C : Check carefully the Introduction section of the CSCF

D :

Open a case with Swift support via the case manager on swift com if further information or solution cannot be found in the documentation

Answer: A,B,C,D

Question 5

Can an assessor re-use an ISAE 3000 report dating back 2 years to support an independent assessment?

Options :

A : No, that is too old, the maximum is 18 months

B : Yes, there is no time limit for an iSAE 3000 report

C : No, the SAE 3000 report is no validsurrogateas a rule

D : Yes, provided there is no change to the Swift user-s infrastructure

Answer: A