[Sep-2025] Dumps Brief Outline Of The CSP-Assessor Exam - Pass4SureQuiz
CSP-Assessor Training & Certification Get Latest Customer Security Programme (CSP)
Swift CSP-Assessor Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 13
The objective of the Customer Environment Protection control is to separate the user's Swift infrastructure which restricts malicious access from the external world and from the General IT environment of the Swift user.
- A. TRUE
- B. FALSE
Answer: A
Explanation:
This question relates to the objective of Control 1.1 - SWIFT Environment Protection in the CSCF:
* Step 1: Control 1.1 Overview
* Control 1.1 aims to "restrict access to the SWIFT infrastructure by segregating it from the general IT environment and external threats," protecting against unauthorized access and malware.
NEW QUESTION # 14
Is the restriction of Internet access only relevant when having Swift-related components in a secure zone?
- A. No, because there can be in-scope general operator PCs used to access a Swift-related application hosted at a service provider
- B. Yes, because if there is no secure zone then the internet connectivity does not need to be restricted
Answer: A
Explanation:
This question examines the applicability of internet access restrictions under theSwift Customer Security Controls Framework (CSCF) v2024.
Step 1: Understand Internet Access Restrictions
Control 2.6: Internet Accessibility Restrictionof theCSCF v2024requires restricting internet access for Swift-related components to minimize exposure, applicable to both secure zones and other in-scope systems.
Step 2: Analyze the Statement
The question asks if the restriction is only relevant when Swift-related components are in a secure zone, implying a scope limitation.
Step 3: Evaluate Each Option
* A. Yes, because if there is no secure zone then the internet connectivity does not need to be restrictedIncorrect.Control 2.6applies to all in-scope components, not just those in secure zones. For example, operator PCs accessing hosted applications (e.g., via A3 architecture) must have restricted internet access, per theSwift Security Best Practices.Conclusion: Incorrect.
* B. No, because there can be in-scope general operator PCs used to access a Swift-related application hosted at a service providerCorrect. General operator PCs (e.g., Component B in the diagram) are in scope when accessing Swift applications (e.g., hosted by a service provider in A3 architecture).Control 2.6requires internet restriction for these systems, even outside a secure zone, as confirmed in theCSCF v2024andSwift Outsourcing Guidelines.Conclusion: Correct.
Step 4: Conclusion and Verification
The correct answer isB, asControl 2.6mandates internet access restrictions for all in-scope components, including operator PCs accessing hosted Swift applications, not just those in secure zones.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.6: Internet Accessibility Restriction.
* Swift Security Best Practices, Section: Internet Access Controls.
* Swift Outsourcing Guidelines, Section: Operator PC Security.
NEW QUESTION # 15
As a Swift CSP Certified Assessor. Swift contacted me to provide evidence on an assessment I have performed. This is required to support their quality assurance validation process. Is it allowed?
- A. Yes, one of the obligations of the certification programme is that quality assessment can be performed by Swift
- B. No, it's confidential
Answer: A
Explanation:
This question addresses the obligations of a Swift CSP Certified Assessor regarding the provision of evidence to Swift for quality assurance purposes.
Step 1: Understand the Role of a Swift CSP Certified Assessor
A Swift CSP Certified Assessor is an independent professional or entity authorized to conduct CSP assessments under theIndependent Assessment Framework. The certification program, managed by Swift, includes specific obligations to ensure the integrity and quality of assessments.
Step 2: Analyze the Request for Evidence
* Swift has contacted the assessor to provide evidence from an assessment to support their quality assurance validation process. This request implies a review of the assessor's work to ensure compliance with CSP standards.
* TheSwift CSP Assessor Certification Program Guidelinesstate that certified assessors are obligated to cooperate with Swift's quality assurance processes. This includes providingevidence (e.g., assessment reports, workpapers) upon request to verify the accuracy and adherence to methodology, as part of Swift's oversight.
* Confidentiality is a concern, but theCSCF v2024andAssessor Certification Programclarify that assessors must share evidence with Swift under a non-disclosure agreement (NDA) or similar confidentiality framework, ensuring data protection while allowing validation.
Step 3: Evaluate Each Option
* A. Yes, one of the obligations of the certification programme is that quality assessment can be performed by SwiftTheSwift CSP Assessor Certification Program Guidelinesexplicitly outline that Swift may conduct quality assessments, and assessors must provide evidence to support this process.
This is a contractual obligation of certification, aligning with Swift's responsibility to maintain CSP integrity.Conclusion: This is correct.
* B. No, it's confidentialWhile confidentiality is critical (protected underControl 2.3: System Access Controland Swift's privacy policies), the certification program requires assessors to share evidence with Swift for quality assurance, subject to confidentiality agreements. Refusing to provide evidence would breach the assessor's obligations.Conclusion: This is incorrect.
Step 4: Conclusion and Verification
The answer isA, as theSwift CSP Assessor Certification Programmandates that certified assessors must support Swift's quality assurance validation by providing evidence, balancing confidentiality with compliance oversight.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.3: System Access Control.
* Swift CSP Assessor Certification Program Guidelines, Section: Obligations and Quality Assurance.
* Swift Independent Assessment Framework, Section: Assessor Responsibilities.
NEW QUESTION # 16
A Treasury Management System (TMS) application is installed on the same machine as the customer connector (such as MQ server) connecting towards a Service Bureau Are these applications/systems in scope of CSCF?
- A. Only the MO server application is in scope of the CSCF> The TMS application is considered as back- office
- B. The TMS application, the MQ server and hosting system enters the scope of the CSCF advisory and should be placed in a secure zone
- C. The TMS application, the MQ server and hosting system are in the scope of the CSCF and must be placed in a secure zone
- D. The TMS application is the highest risk and must be secured appropriately. The MQ server should be secured on a best effort basis
Answer: A
Explanation:
This question determines the scope of the CSCF for a Treasury Management System (TMS) and an MQ server (customer connector) installed on the same machine.
Step 1: Understand CSCF Scope
TheCSCF v2024defines its scope as systems directly involved in Swift messaging, connectivity, or security (e.
g., customer connectors, messaging interfaces), as perControl 1.1: Swift Environment Protection. Back- office systems, like TMS, are typically out of scope unless they directly process Swift messages.
Step 2: Analyze the Scenario
* TMS Application: A Treasury Management System is a back-office application for financial management, not a Swift messaging component. TheCSCF v2024excludes back-office systems from mandatory scope unless they pose a direct risk to Swift components.
* MQ Server (Customer Connector): This middleware server connects to a Service Bureau, facilitating Swift traffic, making it in scope perControl 1.1.
* Hosting System: The machine hosting both applications is in scope only to the extent it supports the MQ server, not the TMS.
Step 3: Evaluate Each Option
* A. The TMS application, the MQ server and hosting system are in the scope of the CSCF and must be placed in a secure zoneIncorrect. The TMS is out of scope, and the hosting system's inclusion depends on the MQ server, not the TMS.Conclusion: Incorrect.
* B. The TMS application, the MQ server and hosting system enters the scope of the CSCF advisory and should be placed in a secure zoneIncorrect. The CSCF advisory scope applies to best practices, not mandatory controls, and does not mandate a secure zone for out-of-scope TMS.
Conclusion: Incorrect.
* C. Only the MQ server application is in scope of the CSCF. The TMS application is considered as back-officeCorrect. The MQ server is a customer connector, in scope perControl 1.1, while the TMS is a back-office system, excluded from mandatory scope per theCSCF v2024Introduction.Conclusion:
Correct.
* D. The TMS application is the highest risk and must be secured appropriately. The MQ server should be secured on a best effort basisIncorrect. The MQ server, as a Swift component, has higher CSCF priority, while TMS risk is managed outside CSCF scope.Conclusion: Incorrect.
Step 4: Conclusion and Verification
The correct answer isC, as only the MQ server is in scope, and the TMS is a back-office system excluded from CSCF requirements.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection, Introduction Section: Scope.
* Swift CSP FAQ, Section: Back-Office Systems.
NEW QUESTION # 17
A Treasury Management System (TMS) application is installed on the same machine as the customer connector (such as MQ server) connecting towards a Service Bureau Are these applications/systems in scope of CSCF?
- A. The TMS application, the MQ server and hosting system enters the scope of the CSCF advisory and should be placed in a secure zone
- B. The TMS application, the MQ server and hosting system are in the scope of the CSCF and must be placed in a secure zone
- C. The TMS application is the highest risk and must be secured appropriately. The MQ server should be secured on a best effort basis
- D. Only the MO server application is in scope of the CSCF> The TMS application is considered as back-office
Answer: B
NEW QUESTION # 18
The only type of HSM devices offered by Swift are HSM tokens and HSM boxes.
- A. TRUE
- B. FALSE
Answer: A
NEW QUESTION # 19
Can an internal audit department submit and approve their Swift user's attestation on the KYC-SA Swift portal?
- A. No, this is never an option
- B. Yes, with approval from the Chief auditor
- C. Yes, an internal auditor can submit the attestation for approval provided they have the appropriate credentials for switt.com. The CISO remains in charge of the approval of the attestation
- D. Yes, providing this is agreed by the head of IT operations and the CISO
Answer: A
Explanation:
This question examines whether an internal audit department can submit and approve a Swift user's attestation on the KYC-SA Swift portal.
Step 1: Understand Attestation Process
TheIndependent Assessment FrameworkandCSCF v2024require attestations to be submitted by an independent party or authorized user representative, not the internal audit department, to ensure objectivity.
Step 2: Evaluate Each Option
* A. Yes, providing this is agreed by the head of IT operations and the CISOInternal audit cannot submit or approve attestations, regardless of internal agreements, per theIndependent Assessment Framework.Conclusion: Incorrect.
* B. No, this is never an optionTheCSCF v2024andSwift CSP Compliance Guidelinesprohibit internal audit from submitting or approving attestations, as they lack independence from the audited entity.
Conclusion: Correct.
* C. Yes, an internal auditor can submit the attestation for approval provided they have the appropriate credentials for swift.com. The CISO remains in charge of the approval of the attestationIncorrect. Internal auditors cannot submit or approve, even with credentials, due to independence requirements.Conclusion: Incorrect.
* D. Yes, with approval from the Chief auditorIncorrect. Chief auditor approval does not override the independence requirement.Conclusion: Incorrect.
Step 3: Conclusion and Verification
The correct answer isB, as theCSCF v2024andIndependent Assessment Frameworkprohibit internal audit from submitting or approving attestations.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Section: Independent Assessment.
* Swift Independent Assessment Framework, Section: Attestation Submission.
* Swift CSP Compliance Guidelines, Section: Independence Requirements.
NEW QUESTION # 20
A Swift user can only exchange FIN messages via the Swift network.
- A. FALSE
- B. TRUE
Answer: A
NEW QUESTION # 21
A Swift user has moved from one Service Bureau to another What are the obligations of the Swift user in the CSP context?
- A. To inform the SB certification office at Swift WW
- B. To submit an updated attestation reflecting this change within 3 months
- C. None if there is no impact in the architecture tope
- D. To reflect that in the next attestation cycle
Answer: B
Explanation:
This question addresses the obligations of a Swift user who has switched from one Service Bureau (SB) to another under the Customer Security Programme (CSP).
Step 1: Understand CSP Obligations for Changes
TheSwift Customer Security Controls Framework (CSCF) v2024andIndependent Assessment Framework require Swift users to maintain accurate and up-to-date information regarding their infrastructure,including changes in service providers like Service Bureaus. Such changes may impact compliance and architecture types.
Step 2: Evaluate Each Option
* A. To inform the SB certification office at Swift WWThere is no specific "SB certification office" mentioned in theCSCF v2024orSwift CSP Guidelines. Notifications are typically handled through attestation updates, not a dedicated office.Conclusion: Incorrect.
* B. To reflect that in the next attestation cycleWhile changes must be reflected in attestations, delaying this until the next cycle (e.g., annually) is insufficient if the change affects compliance. The Swift CSP Compliance Guidelinesrequire timely updates for significant changes.Conclusion: Incorrect.
* C. None if there is no impact in the architecture typeEven if the architecture type (e.g., A2, A4) remains unchanged, a switch in Service Bureau may affect security controls, vendor management, or connectivity. TheCSCF v2024underControl 1.1: Swift Environment Protectionrequires users to report changes that could impact compliance, regardless of architecture type.Conclusion: Incorrect.
* D. To submit an updated attestation reflecting this change within 3 monthsTheSwift CSP Compliance GuidelinesandIndependent Assessment Frameworkmandate that significant changes (e.g., switching Service Bureaus) be reported through an updated attestation within 3 months. This ensures Swift is informed of potential compliance impacts and allows for review.Conclusion: Correct.
Step 3: Conclusion and Verification
The correct answer isD, as theCSCF v2024andSwift CSP Compliance Guidelinesrequire an updated attestation within 3 months to reflect a change in Service Bureau.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection.
* Swift Independent Assessment Framework, Section: Change Reporting.
* Swift CSP Compliance Guidelines, Section: Timely Updates.
NEW QUESTION # 22
From the outsourcing agent diagram, which components in the diagram are in scope and applicable for the Swift user.
- A. Components A, B, C, D and E
- B. Components A and B
- C. Components C, D and E
- D. None of the above
Answer: A
NEW QUESTION # 23
The Alliance Gateway application is considered a messaging interface.
*Connectivity
*Generic
*Products Cloud
*Products OnPrem
*Security
- A. FALSE
- B. TRUE
Answer: A
Explanation:
Alliance Gateway (SAG) is a SWIFT product that facilitates connectivity between messaging interfaces and the SWIFT network. Let's evaluate the statement:
*A messaging interface in SWIFT terminology refers to applications like Alliance Access (SAA) or Alliance Entry, which are responsible for creating, validating, and processing SWIFT messages (e.g., FIN MT messages). These interfaces handle the business logic of message flows, interfacing with back-office systems and preparing messages for transmission.
*Alliance Gateway, however, is classified as a communication interface. It acts as a hub to consolidate message flows from multiple messaging interfaces (e.g., Alliance Access) and connects them to the SWIFT network via SwiftNet Link (SNL). SAG does not create or process messages; it manages their transport, ensuring secure transmission over the SWIFT Secure IP Network (SIPN). This distinction is clear in SWIFT documentation, where SAG is described as a connectivity layer, not a messaging interface.
*The CSCF reinforces this separation by applying specific controls to messaging interfaces (e.g., "2.1 Internal Data Transmission Security" for Alliance Access) and communication interfaces (e.g., "1.1 SWIFT Environment Protection" for SAG). Since SAG does not perform the functions of a messaging interface, the statement is false.
Summary of Correct answer:
Alliance Gateway is a communication interface, not a messaging interface, making the statement false.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Differentiates messaging interfaces (Control
2.1) from communication interfaces (Control 1.1).
*SWIFT Alliance Gateway Documentation: Describes SAG as a communication interface for SWIFTNet connectivity.
*SWIFT Architecture Glossary: Clarifies the roles of messaging interfaces (e.g., Alliance Access) versus communication interfaces (e.g., Alliance Gateway).
========
NEW QUESTION # 24
Can an assessor re-use an ISAE 3000 report dating back 2 years to support an independent assessment?
- A. No, the SAE 3000 report is no validsurrogateas a rule
- B. No, that is too old, the maximum is 18 months
- C. Yes, provided there is no change to the Swift user's infrastructure
- D. Yes, there is no time limit for an iSAE 3000 report
Answer: A
Explanation:
This question addresses the use of ISAE 3000 reports in CSP assessments:
* Step 1: ISAE 3000 in CSP Context
* ISAE 3000 (International Standard on Assurance Engagements) reports provide assurance on controls but are not specifically tailored to SWIFT CSP requirements. The IAF allows their use as supporting evidence, not as a primary assessment substitute.
NEW QUESTION # 25
What is the purpose of the High-Level Test Plan (HLTP) provided by SWIFT? (Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework - High-Level Test Plan Guidelines
*Outsourcing Agents - Security Requirements Baseline v2025
*CSP Architecture Type - Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift_CSP_Assessment_Report_Template
- A. The HLTP provides the rules to define the sample for testing
- B. The HLTP provides a way of testing and the typical evidence for each control (based on implementation guidelines), testing should be ideally based on it
- C. The HLTP provides a detailed way of control testing
- D. The HLTP provides a way of testing and the typical evidence for each control (based on implementation guidelines) and must be strictly followed
Answer: B
Explanation:
The High-Level Test Plan (HLTP) is outlined in the "Independent Assessment Framework - High-Level Test Plan Guidelines" and serves as a guidance document for assessors. Let's evaluate each option:
*Option A: The HLTP provides a way of testing and the typical evidence for each control (based on implementation guidelines) and must be strictly followed This is incorrect. The HLTP is a recommended framework, not a strict mandate. Assessors have flexibility to adapt testing approaches based on the user's environment, as per the "Independent Assessment Process for Assessors Guidelines."
*Option B: The HLTP provides a way of testing and the typical evidence for each control (based on implementation guidelines), testing should be ideally based on it This is correct. The HLTP offers a standardized methodology and evidence examples for testing CSCF controls, derived from implementation guidelines. The "CSP_controls_matrix_and_high_test_plan_2025" encourages assessors to use it as a best practice, allowing adjustments as needed.
*Option C: The HLTP provides the rules to define the sample for testing This is incorrect. While the HLTP includes sample size guidance (e.g., minimum of 3 for limited testing), its primary purpose is broader, covering testing methods and evidence, not just sampling rules.
*Option D: The HLTP provides a detailed way of control testing
This is incorrect. The HLTP is high-level, not detailed; detailed testing plans are developed by assessors based on the HLTP framework.
Summary of Correct answer:
The HLTP provides testing methods and evidence, and testing should ideally be based on it (B).
References to SWIFT Customer Security Programme Documents:
*Independent Assessment Framework - High-Level Test Plan Guidelines: Defines HLTP purpose.
*CSP_controls_matrix_and_high_test_plan_2025: Recommends HLTP usage.
*Independent Assessment Process for Assessors Guidelines: Allows flexibility.
========
NEW QUESTION # 26
In an entity having a small infrastructure and only 2 operators, the HR manager explains in a short interview how the security training is implemented providing one example. Would it be acceptable?
- A. No. more evidence are required
- B. Yes. it's a risk based testing approach this can be enough in this case
Answer: A
Explanation:
This question assesses whether a short interview with the HR manager providing one example of security training implementation is acceptable for a small infrastructure with only two operators, under the Swift Customer Security Programme (CSP).
Step 1: Understand Security Training Requirements
TheSwift Customer Security Controls Framework (CSCF) v2024, underControl 5.1: Security Training and Awareness, mandates that all personnel with access to Swift-related systems (including operators) receive regular, documented security training. This includes awareness of security policies, procedures, and incident response. The control applies regardless of the size of the infrastructure.
Step 2: Analyze the Scenario
* The entity has a small infrastructure with two operators, and the HR manager provides a short interview with one example of security training implementation.
* TheIndependent Assessment Frameworkrequires assessors to validate the effectiveness of controls, including evidence of training completion, content, frequency, and attendance records. A risk-based approach allows flexibility, but minimum evidence standards must still be met.
Step 3: Evaluate Against CSCF Guidelines
* Control 5.1specifies that training must be documented, with evidence such as training logs, attendance records, or certification. A single interview with one example does not provide sufficient evidence to demonstrate:
* That all operators (both in this case) have been trained.
* The frequency and comprehensiveness of the training program.
* The effectiveness of the training (e.g., understanding and application).
* TheSwift CSP FAQandSecurity Best Practicesnote that even for small entities, assessors must see multiple pieces of evidence (e.g., training schedules, materials, test results) to confirm compliance, especially during an independent assessment.
* A risk-based testing approach (mentioned in option A) allows tailoring the depth of evidence based on risk, but it does not exempt small entities from providing more than a single anecdotal example. The Independent Assessment Frameworkrequires objective evidence, not just verbal assurances.
Step 4: Conclusion and Verification
The answer isB, as a short interview with one example is insufficient to meet the evidence requirements of Control 5.1in theCSCF v2024. More evidence (e.g., training records, attendance logs, or test results) is required to validate compliance, even for a small infrastructure.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 5.1: Security Training and Awareness.
* Swift Independent Assessment Framework, Section: Evidence Requirements.
* Swift Security Best Practices, Section: Training Documentation.
* Swift CSP FAQ, Section: Small Entity Compliance.
NEW QUESTION # 27
Select the correct statement(s).
- A. The public and private keys of a Swift certificate are stored on the Hardware Security Module
- B. The decryption operation uses the encryption private key of the receiver
- C. To verify the signature the SwiftNetLink uses the signing private key of the receiver
- D. The certificate stored on the Swift Hardware Security Module is used during the decryption operation of a message
Answer: A,B
NEW QUESTION # 28
Select the correct statement(s) about the Swift Alliance Gateway. (Choose all that apply.)
- A. It allows the creation and/or modification of some Swift messages (depending on the types &/or formats)
- B. It acts as the single window to SwiftNet messaging services by concentrating your traffic flows
- C. The Alliance Gateway can only be accessed by a SWIFTNet user
- D. It allows sharing of PKI profiles between application or individuals, through the use of virtual profiles
Answer: B,D
NEW QUESTION # 29
How many Swift Security Officers does an organization need at minimum?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION # 30
The SWIFT user has a local communication interface as their main channel to SWIFT. For contingency, the SWIFT user also has a connector as a backup channel. What is the architecture type for this SWIFT user?
(Select the correct answer)
*Swift Customer Security Controls Policy
*Swift Customer Security Controls Framework v2025
*Independent Assessment Framework
*Independent Assessment Process for Assessors Guidelines
*Independent Assessment Framework - High-Level Test Plan Guidelines
*Outsourcing Agents - Security Requirements Baseline v2025
*CSP Architecture Type - Decision tree
*CSP_controls_matrix_and_high_test_plan_2025
*Assessment template for Mandatory controls
*Assessment template for Advisory controls
*CSCF Assessment Completion Letter
*Swift CSP Assessment Report Template
- A. A4
- B. A1
- C. A2
- D. A3
Answer: C
Explanation:
The SWIFT CSP defines architecture types (A1 to A4) based on the components a user owns and manages, as outlined in the "CSP Architecture Type - Decision tree" and "Swift Customer Security Controls Framework v2025." These types determine the applicable security controls and assessment requirements. Let's analyze the scenario:
*A local communication interface refers to a component like Alliance Gateway (SAG), which manages connectivity to the SWIFT network via SwiftNet Link (SNL) and VPN boxes. The user owns this interface locally as their main channel.
*A connector (or customer connector) is a custom application or integration layer that connects to SWIFT services, often used as an alternative or backup channel. In this case, it serves as a contingency backup.
*The architecture types are:
oA1: Full stack (owns messaging interface, communication interface, and network components, e.g., Alliance Access, Alliance Gateway, VPN boxes).
oA2: Owns a customer connector and communication interface, with the messaging interface hosted elsewhere (e.g., by a service bureau or SWIFT).
oA3: Owns only a customer connector, relying on external communication and messaging interfaces.
oA4: Uses a fully hosted solution (e.g., Alliance Cloud or Lite2), owning no local components.
*The scenario indicates the user owns a local communication interface (e.g., SAG) as the primary channel and a connector as a backup. However, there is no mention of owning a messaging interface (e.g., Alliance Access) locally. This suggests the messaging interface is likely hosted externally (e.g., by a service bureau or SWIFT), which aligns with the A2 architecture type. The "CSP Architecture Type - Decision tree" classifies A2 as a user with a communication interface and a customer connector, where the messaging interface is not locally owned. The backup connector does not change the primary architecture type, as it is an additional component within the A2 framework.
*Option A: A1
This is incorrect. A1 requires ownership of a messaging interface (e.g., Alliance Access), which is not mentioned.
*Option B: A2
This is correct. A2 fits the scenario of owning a communication interface and a customer connector, with the messaging interface potentially hosted elsewhere.
*Option C: A3
This is incorrect. A3 involves only a customer connector, not a communication interface.
*Option D: A4
This is incorrect. A4 applies to fully hosted solutions with no local ownership of connectors or interfaces.
The SWIFT user with a local communication interface as the main channel and a connector as a backup is of architecture type A2 (B).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Defines architecture types A1-A4.
*CSP Architecture Type - Decision tree: Classifies A2 for communication interface and customer connector ownership.
*Assessment template for Mandatory controls: Applies to A2 architecture.
========
NEW QUESTION # 31
......
Certification Training for CSP-Assessor Exam Dumps Test Engine: https://www.pass4surequiz.com/CSP-Assessor-exam-quiz.html
Customer Security Programme (CSP) CSP-Assessor Real Exam Questions and Answers FREE Updated: https://drive.google.com/open?id=1X8AervZ2tySaY6YuD4hx03-CD6xt67z-