2026 Current CSP-Assessor dumps Preparation through Our Practice Test [Q30-Q53]

Topic	Details
Topic 1	Understanding the Swift Customer Security Programme: This domain is targeted at compliance officers and risk managers involved in Swift operations. It evaluates the candidate’s comprehension of the CSP controls framework and their ability to determine the appropriate architecture type and related scope as outlined in the Customer Security Controls Framework (CSCF).
Topic 2	Understanding the methodology and assessment deliverables: This section is designed for independent auditors working with Swift systems. It tests the candidate’s grasp of the Assessor’s role and obligations when conducting a CSP assessment. The section evaluates knowledge of key elements to consider during the assessment process.
Topic 3	Understanding Swift: This section of the exam measures the skills of Swift network administrators and covers Swift’s crucial role in the international financial community, including the structure and operations of the Swift network and its infrastructure.

QUESTION 30
Can an internal audit department submit and approve their Swift user’s attestation on the KYC-SA Swift portal?

Yes, providing this is agreed by the head of IT operations and the CISO

No, this is never an option

Yes, an internal auditor can submit the attestation for approval provided they have the appropriate credentials for switt.com. The CISO remains in charge of the approval of the attestation

Yes, with approval from the Chief auditor

QUESTION 31
Which of the following statements best describes the difference between an audit and an assessment as per SWIFT CSP definitions? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

An audit is a comprehensive review of a customer’s controls to ensure they meet regulatory requirements, while an assessment is a very high-level review of controls to identify potential weaknesses

An audit looks at the defined controls design and implementation compliance and follows recognized international audit standards, whereas an assessment is less strict but aims the same common objectives

An audit is a one-time event, while an assessment is an ongoing process of monitoring and improving security controls

An audit and an assessment can be used interchangeably

The “Independent Assessment Framework” and “Independent Assessment Process for Assessors Guidelines” distinguish between audits and assessments within the SWIFT CSP context. Let’s evaluate each option:
*Option A: An audit is a comprehensive review of a customer’s controls to ensure they meet regulatory requirements, while an assessment is a very high-level review of controls to identify potential weaknesses This is incorrect. The CSP assessment is a detailed, independent evaluation of CSCF compliance, not a high- level review. Audits may focus on broader regulatory compliance, but the CSP assessment is specific to CSCF controls.
*Option B: An audit looks at the defined controls design and implementation compliance and follows recognized international audit standards, whereas an assessment is less strict but aims the same common objectives This is correct. The CSP defines an assessment as a structured, independent process to verify CSCF control compliance, guided by SWIFT-specific guidelines rather than international audit standards (e.g., ISAE 3000).
Audits, while thorough, follow broader standards and may not align with CSP’s tailored objectives. The
“Independent Assessment Process for Assessors Guidelines” supports this distinction, noting assessments are CSP-specific with a focus on effectiveness.
*Option C: An audit is a one-time event, while an assessment is an ongoing process of monitoring and improving security controls This is incorrect. Both audits and assessments can be one-time or periodic. The CSP assessment is an annual requirement, not an ongoing process, per the “Independent Assessment Framework.”
*Option D: An audit and an assessment can be used interchangeably
This is incorrect. The CSP clearly differentiates between the two, with assessments being the mandated method for CSCF compliance.
An audit follows international standards for control compliance, while an assessment is CSP-specific with similar objectives but less strict standards (B).
References to SWIFT Customer Security Programme Documents:
*Independent Assessment Process for Assessors Guidelines: Defines assessment scope.
*Independent Assessment Framework: Distinguishes assessment from audit.
*Swift_CSP_Assessment_Report_Template: Outlines assessment process.
========

QUESTION 32
Must all CSCF controls be subject to an assessment?

Yes

No, only the mandatory controls

No, only the attested controls (with as a minimum the mandatory ones]

No, the control selection is defined between the Swift User and their assessor

QUESTION 33
The outsourcing agent of the SWIFT user provided them with an independent assessment report covering the CSP components in their scope, and using the latest CSCF version for testing. Is it enough to support the CSP attestation for the outsourced components? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

Yes, after confirmation and validation of the scope

Yes, only if the outsourcing agent is a global trusted provider and published the report on their compliance portal

No, an audit report (and not an assessment) is required from the outsourcing agent as an external provider

No, except if the cloud provider components are partially covered by the SWIFT Alliance Connect Virtual programme

QUESTION 34
Select the correct statement about Alliance Gateway.

It is used to exchange messages over the Swift network

It is used to create messages to send over the Swift network

QUESTION 35
A Swift user has remediated an exception reported by the assessor. What are their obligations before updating and submitting an attestation reflecting the new compliance level?

The exception must be re-assessed by an independent assessor. The assessor can be different to the one who initially raised the exception

The exception must be re-assessed by the same independent assessor that raised the exception

The first line of defense can confirm their level of compliance using a self-assessment approach

None, if the remediation has been completed, a new attestation can be submitted reflecting the compliance of the control

QUESTION 36
The SwiftNet Link (SNL) software is always required for the Swift Alliance Gateway to operate.
SIL Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

TRUE

FALSE

SwiftNet Link (SNL) is a critical component of the SWIFT infrastructure, serving as the mandatory network interface for accessing SWIFTNet services. The Swift Alliance Gateway (SAG) is a communication interface that consolidates message flows from various applications and connects them to the SWIFT network.
According to SWIFT documentation, SAG is a modular software package installed on top of SNL, meaning SNL is a foundational requirement for SAG to operate.
SNL provides essential functionalities such as transport, formatting, security, and service management, enabling secure and interoperable communication over the SWIFT Secure IP Network (SIPN). SAG uses SNL to establish this connectivity, as it does not have direct network access capabilities on its own. For example, SAG relies on SNL to handle SWIFT message types like FIN, InterAct, and FileAct, ensuring secure communication with the SWIFT network. This dependency is evident in architectures where SAG is deployed, such as in the Alliance Connect Virtual solutions, where SNL is always included alongside SAG to facilitate connectivity.
The mention of “SIL Connectivity” in the question refers to the SWIFT Integration Layer (SIL), which is often part of cloud-based deployments like Alliance Cloud. However, even in such setups, SNL remains a requirement for SAG to function, as SIL itself interacts with SAG/SNL to manage message flows. The categories “Generic,” “Products Cloud,” “Products OnPrem,” and “Security” likely refer to the context of SWIFT services, but they do not alter the fundamental requirement of SNL for SAG operation.
There are no exceptions in SWIFT’s official documentation where SAG can operate without SNL. Even in cloud-based solutions like Alliance Cloud or Alliance Lite2, SNL is either embedded or provided as part of the connectivity stack. For instance, in Alliance Connect Virtual deployments, SAG and SNL are deployed together to ensure connectivity to SWIFTNet. Therefore, the statement is unequivocally true.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: The CSCF mandates secure connectivity components like SNL within the SWIFT secure zone (Control 1.1 SWIFT Environment Protection).
*SWIFT Alliance Gateway Documentation: SAG is described as requiring SNL for connectivity to SWIFTNet, as it acts as an interface on top of SNL.
*SWIFTNet Link Documentation: SNL is the mandatory network interface for all external SWIFTNet communications, including those facilitated by SAG.

QUESTION 37
The objective of the Customer Environment Protection control is to separate the user’s Swift infrastructure which restricts malicious access from the external world and from the General IT environment of the Swift user.

TRUE

FALSE

QUESTION 38
In the illustration, identify which components are in scope of the CSCF? (Choose all that apply.)

Components A, B, K

Components J, K, I

Components F, G, H

Components C, E, M

QUESTION 39
The internet connectivity restriction control prevents having internet access on any CSCE m-scope components.

TRUE

FALSE

This question addresses the internet connectivity restriction control and its application to CSCF in-scope components. Let’s verify this against Swift CSP guidelines.
Step 1: Understand the Internet Connectivity Restriction Control
TheSwift Customer Security Controls Framework (CSCF) v2024, underControl 2.6: Internet Accessibility Restriction, mandates that in-scope components (e.g., Swift messaging interfaces, communication interfaces) must not have direct internet access to prevent exposure to external threats. However, this control allows for exceptions under specific conditions.
Step 2: Analyze the Statement
The statement claims that the internet connectivity restriction control “prevents having internet access on any CSCF in-scope components.” The key is to determine if this is an absolute prohibition or if exceptions exist.
Step 3: Evaluate Against CSCF Guidelines
* Control 2.6: Internet Accessibility Restrictionrequires that Swift-related systems be isolated from the internet to minimize attack surfaces. This includes components like messaging interfaces (e.g., Alliance Access) and communication interfaces (e.g., SNL).
* However, theCSCF v2024andSwift CSP FAQallow for controlled internet access under specific circumstances, such as:
* Use of secure tunnels (e.g., VPNs) or proxies for authorized management purposes.
* Temporary access for software updates or patches, provided it is tightly controlled and monitored (perControl 6.1: Security Event Logging).
* The control does not impose an absolute ban but requires that any internet access be restricted, audited, and justified. Thus, the statement that it “prevents having internet access on any CSCF in-scope components” is too absolute.
Step 4: Conclusion and Verification
The statement isFALSEbecause, while internet access is heavily restricted for in-scope components, it is not entirely prevented under all circumstances (e.g., controlled access for maintenance). This aligns with the flexible yet secure approach of theCSCF v2024.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.6: Internet Accessibility Restriction.
* Swift CSP FAQ, Section: Internet Access Exceptions.

QUESTION 40
When hesitant on the applicability of a CSCF control to a particular component? What steps should you take?
(Choose all that apply.)

Call your Swift contact

Check appendix F of the CSCF

Check carefully the Introduction section of the CSCF

Open a case with Swift support via the case manager on swift com if further information or solution cannot be found in the documentation

This question addresses the process for resolving uncertainty about the applicability of a CSCF control to a specific component.
Step 1: Understand the CSCF Documentation Structure
TheSwift Customer Security Controls Framework (CSCF) v2024provides detailed guidance on control applicability, including sections like the Introduction and appendices, as well as support mechanisms for users.
Step 2: Evaluate Each Option
* A. Call your Swift contactWhile contacting a Swift representative might be helpful, it is not the first recommended step inthe CSCF documentation. The framework prioritizes self-service through documentation and support channels like swift.com before direct contact.Conclusion: This is not a primary step.
* B. Check appendix F of the CSCFAppendix F of theCSCF v2024provides detailed guidance on control applicability, including scenarios, architecture types, and component mappings. It is a key resource for clarifying whether a control applies to a specific component.Conclusion: This is correct.
* C. Check carefully the Introduction section of the CSCFThe Introduction section of theCSCF v2024 outlines the scope, objectives, and applicability of controls, including definitions of in-scope components and architecture types. It’s a critical starting point for understanding control applicability.
Conclusion: This is correct.
* D. Open a case with Swift support via the case manager on swift.com if further information or solution cannot be found in the documentationIf the CSCF documentation (e.g., Introduction, Appendix F) does not resolve the uncertainty, theSwift CSP FAQandSwift Support Guidelines recommend opening a case via the swift.com case manager. This ensures users can get official clarification from Swift support.Conclusion: This is correct.
Step 3: Conclusion and Verification
The verified steps areB, C, and D, as they align with the recommended process in theCSCF v2024for resolving uncertainty about control applicability: first consult the documentation (Introduction and Appendix F), then escalate to Swift support if needed.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Introduction Section and Appendix F.
* Swift CSP FAQ, Section: Resolving Control Applicability.
* Swift Support Guidelines, Section: Case Manager Usage.

QUESTION 41
In the illustration, identify the component type of each of the numbered components.

1. Customer Connector
2. Bridging Server (Middleware Server)
3. Customer Connector
4. Bridging Server (Middleware Server)

1. Customer Connector
2. Bridging Server (Middleware Server)
3. Customer Connector
4. Customer Connector

1. Bridging Server (Middleware Server)
2. Bridging Server (Middleware Server)
3. Bridging Server (Middleware Server)
4. Bridging Server (Middleware Server)

1. Customer Connector
2. Customer Connector
3. Customer Connector
4. Customer Connector

QUESTION 42
Select the correct statement about Alliance Gateway.

It is used to exchange messages over the Swift network

It is used to create messages to send over the Swift network

QUESTION 43
Penetration testing must be performed at application level against the Swift-related components, such as the interfaces, Swift and customer connectors?

True, those are key components

False, only the components as defined in Swift Testing Policy

QUESTION 44
Which of the following infrastructures has the smallest SWIFT footprint? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Full stack of products up to the Messaging Interface

Alliance Remote Gateway

Lite 2 or Alliance Cloud

A user with a Messaging Interface behind a Service Bureau

The “SWIFT footprint” refers to the extent of SWIFT-related infrastructure (hardware, software, and connectivity components) that a user must manage within their environment. A smaller footprint means less local infrastructure to maintain, typically achieved through cloud-based or managed services. Let’s evaluate each option:
*Option A: Full stack of products up to the Messaging Interface
This refers to an on-premises deployment where the user manages a complete set of SWIFT components, including the messaging interface (e.g., Alliance Access), communication interface (e.g., Alliance Gateway), SwiftNet Link (SNL), HSM, and VPN boxes for connectivity to the SWIFT network. This setup requires significant local infrastructure, including servers, security devices, and network components, resulting in a large SWIFT footprint.
*Option B: Alliance Remote Gateway
Alliance Remote Gateway (ARG) is a service where the Alliance Gateway is hosted remotely by SWIFT or a third party, but the user still maintains a messaging interface (e.g., Alliance Access) locally. While this reduces the footprint slightly by outsourcing the communication interface, the user still manages the messaging interface, HSM, and local connectivity components, resulting in a moderate footprint.
*Option C: Lite 2 or Alliance Cloud
This is the correct answer. Alliance Lite2 and Alliance Cloud are cloud-based solutions designed for smaller institutions or those seeking a minimal local footprint. In Alliance Lite2, the user connects to SWIFT via a lightweight client (Alliance Lite2 AutoClient) or a browser-based interface, with most infrastructure (e.g., messaging interface, communication interface, HSM) hosted by SWIFT in the cloud. Alliance Cloud similarly hosts the full SWIFT stack (including Alliance Access and Alliance Gateway) in a SWIFT-managed cloud environment, requiring only minimal local infrastructure (e.g., a secure connection to the cloud). This results in the smallest SWIFT footprint, as the user manages very little on-premises infrastructure. The CSCF still applies, but many controls are managed by SWIFT (e.g., “1.1 SWIFT Environment Protection”).
*Option D: A user with a Messaging Interface behind a Service Bureau
A Service Bureau is a third-party provider that hosts SWIFT infrastructure (e.g., Alliance Gateway, SNL) for multiple users, but the user still maintains a local messaging interface (e.g., Alliance Access) to connect to the Service Bureau. This setup reduces the footprint compared to a full on-premises deployment, as the user does not manage the communication interface or network connectivity components. However, the local messaging interface and associated security components (e.g., HSM) still constitute a larger footprint than a fully cloud- based solution like Alliance Lite2 or Alliance Cloud.
Summary of Correct answer:
Alliance Lite2 or Alliance Cloud (C) has the smallest SWIFT footprint, as most infrastructure is hosted in the cloud by SWIFT, minimizing the user’s local management responsibilities.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.1 applies to cloud deployments like Alliance Cloud, reducing the user’s local footprint.
*SWIFT Alliance Lite2 Documentation: Describes the minimal infrastructure required for Lite2 users.
*SWIFT Alliance Cloud Documentation: Highlights the fully hosted nature of the solution, minimizing the SWIFT footprint.
========

QUESTION 45
What are the conditions required to allow reliance on the compliance conclusion of a control assessed in the previous year? (Select all answers that apply)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

The control compliance conclusion must have already been relied on the past two years

The previous assessment was performed on the CSCF version of the previous year (at least)

The control definition has not changed

The control design and implementation are the same

QUESTION 46
A Treasury Management System (TMS) application is installed on the same machine as the customer connector (such as MQ server) connecting towards a Service Bureau Are these applications/systems in scope of CSCF?

The TMS application, the MQ server and hosting system are in the scope of the CSCF and must be placed in a secure zone

The TMS application, the MQ server and hosting system enters the scope of the CSCF advisory and should be placed in a secure zone

Only the MO server application is in scope of the CSCF> The TMS application is considered as back- office

The TMS application is the highest risk and must be secured appropriately. The MQ server should be secured on a best effort basis

This question determines the scope of the CSCF for a Treasury Management System (TMS) and an MQ server (customer connector) installed on the same machine.
Step 1: Understand CSCF Scope
TheCSCF v2024defines its scope as systems directly involved in Swift messaging, connectivity, or security (e.
g., customer connectors, messaging interfaces), as perControl 1.1: Swift Environment Protection. Back- office systems, like TMS, are typically out of scope unless they directly process Swift messages.
Step 2: Analyze the Scenario
* TMS Application: A Treasury Management System is a back-office application for financial management, not a Swift messaging component. TheCSCF v2024excludes back-office systems from mandatory scope unless they pose a direct risk to Swift components.
* MQ Server (Customer Connector): This middleware server connects to a Service Bureau, facilitating Swift traffic, making it in scope perControl 1.1.
* Hosting System: The machine hosting both applications is in scope only to the extent it supports the MQ server, not the TMS.
Step 3: Evaluate Each Option
* A. The TMS application, the MQ server and hosting system are in the scope of the CSCF and must be placed in a secure zoneIncorrect. The TMS is out of scope, and the hosting system’s inclusion depends on the MQ server, not the TMS.Conclusion: Incorrect.
* B. The TMS application, the MQ server and hosting system enters the scope of the CSCF advisory and should be placed in a secure zoneIncorrect. The CSCF advisory scope applies to best practices, not mandatory controls, and does not mandate a secure zone for out-of-scope TMS.
Conclusion: Incorrect.
* C. Only the MQ server application is in scope of the CSCF. The TMS application is considered as back-officeCorrect. The MQ server is a customer connector, in scope perControl 1.1, while the TMS is a back-office system, excluded from mandatory scope per theCSCF v2024Introduction.Conclusion:
Correct.
* D. The TMS application is the highest risk and must be secured appropriately. The MQ server should be secured on a best effort basisIncorrect. The MQ server, as a Swift component, has higher CSCF priority, while TMS risk is managed outside CSCF scope.Conclusion: Incorrect.
Step 4: Conclusion and Verification
The correct answer isC, as only the MQ server is in scope, and the TMS is a back-office system excluded from CSCF requirements.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection, Introduction Section: Scope.
* Swift CSP FAQ, Section: Back-Office Systems.

QUESTION 47
Select the components a SwiftNet Link (SNL) may communicate with. (Choose all that apply.)

The Graphical User Interface

The VPN boxes

The HSM device

The messaging interface (such as Alliance Access)

QUESTION 48
On which one of the following components must a Password/PIN Policy not be defined and implemented as per the CSCF? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls

Operator PCs, (physical or virtual) systems running SWIFT-related components, network devices protecting the secure zone(s), bridging servers

Jump server(s), SWIFT-related components at application level

Personal tokens or mobile devices used as a possession factor

All equipment within the user environment

The CSCF, under Control “6.1 Security Awareness” and related security controls, mandates the definition and implementation of a Password/PIN Policy for components requiring user authentication to protect the SWIFT environment. Let’s evaluate each option:
*Option A: Operator PCs, (physical or virtual) systems running SWIFT-related components, network devices protecting the secure zone(s), bridging servers This requires a Password/PIN Policy. Operator PCs, systems running SWIFT components (e.g., Alliance Access), network devices (e.g., VPN boxes), and bridging servers need authentication policies to secure access, as per CSCF Control “2.3 System Hardening” and “6.1.”
*Option B: Jump server(s), SWIFT-related components at application level This requires a Password/PIN Policy. Jump servers and application-level components (e.g., Alliance Gateway) must have authentication mechanisms to protect the secure zone, aligning with CSCF Control “1.1 SWIFT Environment Protection.”
*Option C: Personal tokens or mobile devices used as a possession factor This does not require a Password/PIN Policy. Personal tokens or mobile devices (e.g., secure code cards or soft tokens) are possession factors used in multi-factor authentication (MFA), typically alongside a password or PIN. However, the CSCF does not mandate defining a Password/PIN Policy for thetokens/devices themselves, as their security relies on physical possession and manufacturer hardening, not user-defined policies. The “Outsourcing Agents – Security Requirements Baseline v2025” supports this by focusing policy requirements on systems, not possession factors.
*Option D: All equipment within the user environment
This requires a Password/PIN Policy. The CSCF applies policies to all in-scope equipment to ensure comprehensive security, contradicting the question’s intent to identify an exception.
Summary of Correct answer:
A Password/PIN Policy must not be defined and implemented for personal tokens or mobile devices used as a possession factor (C).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 6.1 and 2.3 mandate password policies for systems.
*Outsourcing Agents – Security Requirements Baseline v2025: Excludes possession factors from policy requirements.
*Assessment template for Mandatory controls: Focuses on system authentication policies.
========

QUESTION 49
The only type of HSM devices offered by Swift are HSM tokens and HSM boxes.

TRUE

FALSE

QUESTION 50
A SWIFT user owns a customer connector and a communication interface. What architecture type is the SWIFT user? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework – High-Level Test Plan Guidelines
*Outsourcing Agents – Security Requirements Baseline v2025
*CSP Architecture Type – Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template

A1

A2

A3

A4

The SWIFT CSP defines architecture types (A1 to A4) based on the components a user owns and manages, as outlined in the “CSP Architecture Type – Decision tree” and “Swift Customer Security Controls Framework v2025.” These types determine the applicable security controls and assessment requirements. Let’s analyze the scenario and options:
*A customer connector is a component (e.g., a custom application or integration layer) that connects to SWIFT services, such as through the SWIFT API or a messaging interface. It handles data flows but is not a standard SWIFT-provided interface.
*A communication interface refers to a component like Alliance Gateway (SAG), which manages connectivity to the SWIFT network via SwiftNet Link (SNL) and VPN boxes.
*The architecture types are:
oA1: Full stack (owns messaging interface, communication interface, and network components, e.g., Alliance Access, Alliance Gateway, VPN boxes).
oA2: Owns a customer connector and communication interface, with the messaging interface hosted elsewhere (e.g., by a service bureau or SWIFT).
oA3: Owns only a customer connector, relying on external communication and messaging interfaces.
oA4: Uses a fully hosted solution (e.g., Alliance Cloud or Lite2), owning no local components.
*In this case, the user owns a customer connector and a communication interface but does not mention owning a messaging interface (e.g., Alliance Access). This matches the A2 architecture type, where the user manages a custom integration (connector) and the communication layer (e.g., SAG), while the messaging interface is provided by another party (e.g., a service bureau or SWIFT-hosted environment). The “CSP Architecture Type – Decision tree” confirms this classification, and the “Assessment template for Mandatory controls” applies A2-specific requirements.
*Option A: A1
This is incorrect. A1 requires ownership of a messaging interface (e.g., Alliance Access), which is not mentioned.
*Option B: A2
This is correct. A2 fits the scenario of owning a customer connector and communication interface without a messaging interface.
*Option C: A3
This is incorrect. A3 involves only a customer connector, not a communication interface.
*Option D: A4
This is incorrect. A4 applies to fully hosted solutions with no local ownership of connectors or interfaces.
Summary of Correct answer:
The SWIFT user with a customer connector and a communication interface is of architecture type A2 (B).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Defines architecture types A1-A4.
*CSP Architecture Type – Decision tree: Classifies A2 for customer connector and communication interface ownership.
*Assessment template for Mandatory controls: Applies to A2 architecture.

QUESTION 51
The SwiftNet Link (SNL) software is always required for the Swift Alliance Gateway to operate.
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

TRUE

FALSE

QUESTION 52
A Swift user has moved from one Service Bureau to another What are the obligations of the Swift user in the CSP context?

To inform the SB certification office at Swift WW

To reflect that in the next attestation cycle

None if there is no impact in the architecture tope

To submit an updated attestation reflecting this change within 3 months

This question addresses the obligations of a Swift user who has switched from one Service Bureau (SB) to another under the Customer Security Programme (CSP).
Step 1: Understand CSP Obligations for Changes
TheSwift Customer Security Controls Framework (CSCF) v2024andIndependent Assessment Framework require Swift users to maintain accurate and up-to-date information regarding their infrastructure,including changes in service providers like Service Bureaus. Such changes may impact compliance and architecture types.
Step 2: Evaluate Each Option
* A. To inform the SB certification office at Swift WWThere is no specific “SB certification office” mentioned in theCSCF v2024orSwift CSP Guidelines. Notifications are typically handled through attestation updates, not a dedicated office.Conclusion: Incorrect.
* B. To reflect that in the next attestation cycleWhile changes must be reflected in attestations, delaying this until the next cycle (e.g., annually) is insufficient if the change affects compliance. The Swift CSP Compliance Guidelinesrequire timely updates for significant changes.Conclusion: Incorrect.
* C. None if there is no impact in the architecture typeEven if the architecture type (e.g., A2, A4) remains unchanged, a switch in Service Bureau may affect security controls, vendor management, or connectivity. TheCSCF v2024underControl 1.1: Swift Environment Protectionrequires users to report changes that could impact compliance, regardless of architecture type.Conclusion: Incorrect.
* D. To submit an updated attestation reflecting this change within 3 monthsTheSwift CSP Compliance GuidelinesandIndependent Assessment Frameworkmandate that significant changes (e.g., switching Service Bureaus) be reported through an updated attestation within 3 months. This ensures Swift is informed of potential compliance impacts and allows for review.Conclusion: Correct.
Step 3: Conclusion and Verification
The correct answer isD, as theCSCF v2024andSwift CSP Compliance Guidelinesrequire an updated attestation within 3 months to reflect a change in Service Bureau.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection.
* Swift Independent Assessment Framework, Section: Change Reporting.
* Swift CSP Compliance Guidelines, Section: Timely Updates.

QUESTION 53
How are online SwiftNet Security Officers authenticated? (Select the correct answer)
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security

Via their PKI certificate

Via their swift.com account and secure code card

Via their swift.com account

SwiftNet Security Officers (e.g., Local Security Officer [LSO] or Remote Security Officer [RSO]) are responsible for managing security functions in the SWIFT environment, such as configuring accesscontrols and managing PKI certificates. Authentication for online access to SwiftNet services (e.g., via the Alliance Web Platform) is a critical security measure. Let’s evaluate each option:
*Option A: Via their PKI certificate
This is incorrect. While PKI certificates are used for authenticating and signing SWIFT messages or securing communications, they are not the primary method for authenticating security officers’ online access to SwiftNet management interfaces. PKI certificates are managed by the HSM and used by applications or users for message-level security, not for logging into administrative portals.
*Option B: Via their swift.com account and secure code card
This is correct. Online SwiftNet Security Officers are authenticated using a combination of their swift.com account (a username and password managed through SWIFT’s customer portal) and a secure code card (a physical or virtual token providing a one-time password or multi-factor authentication code). This two-factor authentication (2FA) method ensures robust access control, aligning with CSCF Control “6.1 Security Awareness” and SWIFT’s emphasis on multi-layered security. SWIFT documentation for the Alliance suite and SwiftNet confirms this authentication process for security officers accessing online tools.
*Option C: Via their swift.com account
This is incorrect. Relying solely on a swift.com account (username and password) is insufficient for authenticating security officers, as it lacks the additional security layer required for sensitive administrative access. SWIFT mandates multi-factor authentication, typically involving a secure code card, to comply with security standards.
Summary of Correct answer:
Online SwiftNet Security Officers are authenticated via their swift.com account and secure code card (B), ensuring secure access to management functions.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Control 6.1 supports multi-factor authentication for security officers.
*SWIFT Alliance Security Documentation: Details the use of swift.com accounts and secure code cards for LSO/RSO authentication.
*SWIFT SwiftNet Guidelines: Confirms 2FA for online security officer access.
========