[Jan-2026] Practice Swift CSP-Assessor exam. Online Exam Practice Tests with detailed explanations! Pass CSP-Assessor with confidence! [Q43-Q62]

This question addresses the types of Hardware Security Module (HSM) devices offered by SWIFT:
* Step 1: SWIFT HSM Overview
* SWIFT provides HSMs to secure Public Key Infrastructure (PKI) certificates and cryptographic operations for its users. The CSCF and related security documentation specify two primary types:
HSM tokens(portable devices) andHSM boxes(rack-mounted hardware).

Alliance Gateway (SAG) is a SWIFT product that facilitates connectivity between messaging interfaces and the SWIFT network. Let’s evaluate the statement:
*A messaging interface in SWIFT terminology refers to applications like Alliance Access (SAA) or Alliance Entry, which are responsible for creating, validating, and processing SWIFT messages (e.g., FIN MT messages). These interfaces handle the business logic of message flows, interfacing with back-office systems and preparing messages for transmission.
*Alliance Gateway, however, is classified as a communication interface. It acts as a hub to consolidate message flows from multiple messaging interfaces (e.g., Alliance Access) and connects them to the SWIFT network via SwiftNet Link (SNL). SAG does not create or process messages; it manages their transport, ensuring secure transmission over the SWIFT Secure IP Network (SIPN). This distinction is clear in SWIFT documentation, where SAG is described as a connectivity layer, not a messaging interface.
*The CSCF reinforces this separation by applying specific controls to messaging interfaces (e.g., “2.1 Internal Data Transmission Security” for Alliance Access) and communication interfaces (e.g., “1.1 SWIFT Environment Protection” for SAG). Since SAG does not perform the functions of a messaging interface, the statement is false.
Summary of Correct answer:
Alliance Gateway is a communication interface, not a messaging interface, making the statement false.
References to SWIFT Customer Security Programme Documents:
*SWIFT Customer Security Controls Framework (CSCF) v2024: Differentiates messaging interfaces (Control
2.1) from communication interfaces (Control 1.1).
*SWIFT Alliance Gateway Documentation: Describes SAG as a communication interface for SWIFTNet connectivity.
*SWIFT Architecture Glossary: Clarifies the roles of messaging interfaces (e.g., Alliance Access) versus communication interfaces (e.g., Alliance Gateway).
========

This question addresses the obligations of Swift users regarding the submission of assessment-related documents to Swift under the Customer Security Programme (CSP).
Step 1: Understand CSP Assessment Submission Requirements
TheSwift Customer Security Controls Framework (CSCF) v2024and theIndependent Assessment Framework outline the process for CSP assessments, including what must be submitted to Swift. The focus is on ensuring compliance through attestation, with specific deliverables defined.
Step 2: Evaluate Each Option
* A. Yes, all documents produced from the assessment must be provided proactively to SwiftThis is incorrect. TheIndependent Assessment Frameworkdoes not require proactive submission of all assessment documents (e.g., detailed reports, working papers). Only the completion letter and attestation are typically submitted unless otherwise requested by Swift.Conclusion: Incorrect.
* B. No, it is not required to provide Swift with any documents by default. However, Swift can request a copy of the Assessment completion letterTheCSCF v2024andIndependent Assessment Frameworkstate that users are not required to proactively submit the full assessment report or other documents. However, Swift retains the right to request the completion letter (certifying assessment completion) or additional evidence during quality assurance reviews. This aligns with theSwift CSP Compliance Guidelines.Conclusion: Correct.
* C. Yes, a copy of (only) the assessment report must be provided to Swift, no other documentsThis is incorrect. The full assessment report is not mandated for proactive submission; only the completion letter is typically required unless requested. TheIndependent Assessment Frameworkemphasizes the completion letter as the key deliverable.Conclusion: Incorrect.
* D. Yes, in cases where a customer performs an Independent assessment rather than an audit then a copy of the assessment report must be provided. However, it is not required for the Swift user to provide any forms when an Internal/External Audit is performedThis is partially misleading. The Independent Assessment Frameworkdoes not distinguish between independent assessments and audits in terms of mandatory report submission. For both, the completion letter is the default submission, with reports requested only if needed. The differentiation based on assessment type is not supported byCSCF v2024guidelines.Conclusion: Incorrect.
Step 3: Conclusion and Verification
The correct answer isB, as theCSCF v2024andIndependent Assessment Frameworkdo not require proactive submission of the full assessment report, but Swift can request the completion letter as part of its oversight process.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Section: Independent Assessment Requirements.
* Swift Independent Assessment Framework, Section: Deliverables and Submission.
* Swift CSP Compliance Guidelines, Section: Document Submission Rules.
This question identifies which operator session flows must be protected for confidentiality and integrity under theSwift Customer Security Controls Framework (CSCF) v2024.
Step 1: Understand Session Protection Requirements
TheCSCF v2024, underControl 2.4: Secure Session Management, mandates that all sessions involving access to Swift-related components or secure zones must be protected using strong encryption (e.g., TLS) and integrity controls to prevent unauthorized access or data tampering. This applies to operator and administrator sessions interacting with the Swift environment.
Step 2: Evaluate Each Option
* A. System administrator sessions towards a host running a Swift related componentAdministrator sessions to hosts running Swift components (e.g., Alliance Access, Gateway) are in scope, as they require protection perControl 2.4to ensure confidentiality and integrity of administrative actions.
Conclusion: Correct.
* B. All sessions to and from a jump server used to access a component in a secure zoneJump servers are used to access secure zones (perControl 1.1: Swift Environment Protection), and all sessions to and from them must be encrypted and integrity-protected, as specified inControl 2.4.Conclusion:
Correct.
* C. All sessions towards a secure zone (on-premises or hosted by a third-party or a Cloud Provider) Secure zones, whether on-premises or hosted (e.g., by outsourcing agents or cloud providers), contain Swift components and must have all incoming sessions protected perControl 2.4andControl 1.1.
Conclusion: Correct.
* D. All sessions towards a Swift related application run by an Outsourcing Agent, a Service Bureau or an L2BA ProviderSessions to Swift-related applications managed by outsourcing agents or service bureaus (e.g., Components C, D, E in the diagram) are in scope, as they handle Swift traffic and must be secured perControl 2.4and theSwift Outsourcing Guidelines.Conclusion: Correct.
Step 3: Conclusion and Verification
All options (A, B, C, D) are correct, asControl 2.4of theCSCF v2024requires protection of all listed session types to ensure confidentiality and integrity across the Swift ecosystem, including secure zones, hosted environments, and outsourced applications.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.4: Secure Session Management, Control 1.1: Swift Environment Protection.
* Swift Security Best Practices, Section: Session Security.
* Swift Outsourcing Guidelines, Section: Session Protection.

This question concerns the location and management of Swift HSM boxes, which are critical for secure key management.
Step 1: Understand the Role of Swift HSM
The Hardware Security Module (HSM) in the Swift environment is used to store and manage cryptographic keys, as perControl 2.5B: Cryptographic Key Managementof theCSCF v2024. The HSM ensures the security of Swift transactions by protecting private keys.
Step 2: Evaluate Each Option
* A. Are located at the network partner premises and managed by SwiftNetwork partners (e.g., service providers) may host connectivity infrastructure, but HSMs are typically located at the user’s premises for direct control, as perSwift Security Best Practices. Swift does not manage user HSMs; users are responsible for their operation.Conclusion: This is incorrect.
* B. Are located at the Swift user premises and managed by SwiftWhile HSMs are located at the user’ s premises, Swift does not manage them. Users are responsible for HSM management, as outlined in Control 2.5B, which requires users to secure and maintain their HSMs.Conclusion: This is incorrect.
* C. Are located at the Swift user premises and managed by the Swift userTheCSCF v2024andSwift HSM Deployment Guidespecify that HSMs are deployed at the Swift user’s premises to ensure local control and security. Users are responsible for managing and maintaining the HSM, including key generation and backups, as part of their compliance obligations.Conclusion: This is correct.
* D. Are located at the network partner premises and managed by Swift the network partnerHSMs are not managed by network partners or Swift. Users retain control, and network partners only facilitate connectivity, not HSM management.Conclusion: This is incorrect.
Step 3: Conclusion and Verification
The verified answer isC, as it accurately reflects the standard deployment and management model for Swift HSMs, consistent with Swift CSP documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.5B: Cryptographic Key Management.
* Swift HSM Deployment Guide, Section: Installation and Management.
* Swift Security Best Practices, Section: HSM Location and Control.

This question explores the process for updating an attestation after remediating an exception identified by an assessor:
* Step 1: CSP Attestation and Remediation Process
* The SWIFT CSP requires users to submit an annual attestation via the KYC Security Attestation (KYC-SA) application, reflecting compliance with CSCF controls. If anexception (non- compliance) is reported, remediation must occur, followed by validation before updating the attestation.

The “Independent Assessment Process for Assessors Guidelines” and “Independent Assessment Framework” outline conditions for relying on previous assessments. Let’s evaluate each option:
*Option A: The control compliance conclusion must have already been relied on the past two years This does not apply. There is no requirement that reliance has been used for two prior years; reliance is assessed annually based on current conditions, per the “Independent Assessment Framework.”
*Option B: The previous assessment was performed on the CSCF version of the previous year (at least) This does not apply. The CSCF version must match the current assessment year (e.g., v2025 for a 2025 assessment), not the previous year, to ensure alignment with updated controls, as per the “Swift Customer Security Controls Framework v2025.”
*Option C: The control definition has not changed
This applies. Reliance is permitted only if the control’s definition remains unchanged from the previous assessment, ensuring the prior conclusion remains relevant, as noted in the
“CSP_controls_matrix_and_high_test_plan_2025.”
*Option D: The control design and implementation are the same
This applies. The assessor must confirm that the control’s design and implementation have not changed since the last assessment, as required by the “Independent Assessment Process for Assessors Guidelines” to validate ongoing compliance.
Summary of Correct Answers:
Reliance is allowed if the control definition has not changed (C) and the control design and implementation are the same (D).
References to SWIFT Customer Security Programme Documents:
*Independent Assessment Process for Assessors Guidelines: Lists conditions for reliance.
*Independent Assessment Framework: Requires unchanged definitions and designs.
*CSP_controls_matrix_and_high_test_plan_2025: Supports reliance criteria.
========

CSCF Control “4.2 Intrusion Detection” requires SWIFT users to detect unauthorized access or activities within the SWIFT environment. The “Swift Customer Security Controls Framework v2025” allows flexibility in meeting this control using various technologies. Let’s evaluate each option:
*Option A: NIDS (Network Intrusion Detection System)
This is valid. NIDS monitors network traffic to detect intrusions (e.g., on VPN boxes), aligning with Control
“4.2” by identifying external threats.
*Option B: HIDS (Host Intrusion Detection System)
This is valid. HIDS monitors individual hosts (e.g., servers running Alliance Access) for suspicious activities, supporting Control “4.2” for internal threat detection.
*Option C: EDR and XDR (Endpoint Detection and Response, Extended Detection and Response) This is valid. EDR and XDR provide advanced monitoring and response capabilities for endpoints and across environments, meeting Control “4.2” requirements for detecting and responding to intrusions.
*Option D: A combination of all of the above
This is correct. The CSCF encourages a layered security approach, and the
“CSP_controls_matrix_and_high_test_plan_2025” and “Assessment template for Mandatory controls” accept a combination of NIDS, HIDS, EDR, and XDR to comprehensively meet Control “4.2,” depending on the architecture and risk profile.
Summary of Correct answer:
Intrusion Detection Control can be met through a combination of NIDS, HIDS, EDR, and XDR (D).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 4.2 allows multiple detection technologies.
*CSP_controls_matrix_and_high_test_plan_2025: Supports combined approaches.
*Assessment template for Mandatory controls: Includes various intrusion detection methods.
========

The CSCF and “Outsourcing Agents – Security Requirements Baseline v2025” define responsibilities for securing virtualization or cloud platforms hosting SWIFT-related components. Let’s evaluate each combination:
*Option A: For on-premises virtualization platform: by the platform provider This is not correct. An on-premises virtualization platform (e.g., VMware or Hyper-V hosting Alliance Gateway) is managed by the SWIFT user, not the platform provider (e.g., VMware). The “platform provider” supplies the software, but the user is responsible for securing the on-premises environment, including hardening, patching, and compliance with CSCF Control “2.3 System Hardening.”
*Option B: For virtualization platform deployed at a third party on which user’s SWIFT-related components are virtually hosted: by the third party This is correct. If the virtualization platform is hosted by a third party (e.g., a service provider hosting SWIFT components), the third party is responsible for securing the platform, as per the “Outsourcing Agents – Security Requirements Baseline v2025” and CSCF Control “1.1.”
*Option C: For on-premises container platform: by the SWIFT user
This is correct. An on-premises container platform (e.g., Docker or Kubernetes hosting SWIFT applications) is the user’s responsibility to secure, aligning with CSCF Control “1.1” and the user’s ownership of on- premises infrastructure.
*Option D: For Cloud Provider: the cloud provider
This is correct. In a cloud model (e.g., IaaS like Alliance Cloud on AWS), the cloud provider (e.g., AWS) is responsible for securing the underlying platform, as outlined in the “Outsourcing Agents – Security Requirements Baseline v2025.” Summary of Correct answer:
The combination that is not correct is A, as the SWIFT user, not the platform provider, is responsible for securing an on-premises virtualization platform.
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Control 1.1 defines responsibilities for on-premises platforms.
*Outsourcing Agents – Security Requirements Baseline v2025: Specifies third-party and cloud provider responsibilities.
*Independent Assessment Framework: Confirms user responsibility for on-premises setups.

This question identifies the components with which the SwiftNet Link (SNL) communicates, based on its role in the Swift ecosystem under theSwift Customer Security Controls Framework (CSCF) v2024.
Step 1: Understand the Role of SwiftNet Link (SNL)
The SNL is a communication layer that facilitates secure connectivity between a Swift user’s environment and the Swift network. It handles encrypted data transmission and interacts with specific infrastructure components, as detailed in theSwift Alliance Gateway Technical DocumentationandControl 1.1: Swift Environment Protectionof theCSCF v2024.
Step 2: Evaluate Each Option
* A. The Graphical User InterfaceThe GUI (e.g., operator interface) is used by personnel to interact with Swift applications (e.g., Alliance Access), but it does not directly communicate with the SNL. The SNL operates at the network and security layer, not the user interface layer, per theSwift User Handbook
.Conclusion: Incorrect.
* B. The VPN boxesThe SNL communicates with VPN boxes to establish secure tunnels (e.g., using NTLS) for data transmission to the Swift network, as specified in theSwift Security Best Practicesand Control 2.6: Internet Accessibility Restriction.Conclusion: Correct.
* C. The HSM deviceThe SNL interacts with the Hardware Security Module (HSM) to manage cryptographic keys and secure communications, as outlined inControl 2.5B: Cryptographic Key Managementand theSwift Alliance Gateway Technical Documentation.Conclusion: Correct.
* D. The messaging interface (such as Alliance Access)The SNL connects to the messaging interface (e.
g., Alliance Access or Entry) to transmit and receive Swift messages, a core function described in the CSCF v2024underControl 1.1.Conclusion: Correct.
Step 3: Conclusion and Verification
The correct answers areB, C, and D, as the SNL communicates with VPN boxes, HSM devices, and messaging interfaces to ensure secure and functional connectivity to the Swift network, consistent withCSCF v2024and related documentation.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection, Control 2.5B: Cryptographic Key Management, Control 2.6: Internet Accessibility Restriction.
* Swift Alliance Gateway Technical Documentation, Section: SNL Communication.
* Swift Security Best Practices, Section: Network Infrastructure.

The SWIFT CSP defines architecture types (A1 to A4) based on the components a user owns and manages, as outlined in the “CSP Architecture Type – Decision tree” and “Swift Customer Security Controls Framework v2025.” These types determine the applicable security controls and assessment requirements. Let’s analyze the scenario:
*A local communication interface refers to a component like Alliance Gateway (SAG), which manages connectivity to the SWIFT network via SwiftNet Link (SNL) and VPN boxes. The user owns this interface locally as their main channel.
*A connector (or customer connector) is a custom application or integration layer that connects to SWIFT services, often used as an alternative or backup channel. In this case, it serves as a contingency backup.
*The architecture types are:
oA1: Full stack (owns messaging interface, communication interface, and network components, e.g., Alliance Access, Alliance Gateway, VPN boxes).
oA2: Owns a customer connector and communication interface, with the messaging interface hosted elsewhere (e.g., by a service bureau or SWIFT).
oA3: Owns only a customer connector, relying on external communication and messaging interfaces.
oA4: Uses a fully hosted solution (e.g., Alliance Cloud or Lite2), owning no local components.
*The scenario indicates the user owns a local communication interface (e.g., SAG) as the primary channel and a connector as a backup. However, there is no mention of owning a messaging interface (e.g., Alliance Access) locally. This suggests the messaging interface is likely hosted externally (e.g., by a service bureau or SWIFT), which aligns with the A2 architecture type. The “CSP Architecture Type – Decision tree” classifies A2 as a user with a communication interface and a customer connector, where the messaging interface is not locally owned. The backup connector does not change the primary architecture type, as it is an additional component within the A2 framework.
*Option A: A1
This is incorrect. A1 requires ownership of a messaging interface (e.g., Alliance Access), which is not mentioned.
*Option B: A2
This is correct. A2 fits the scenario of owning a communication interface and a customer connector, with the messaging interface potentially hosted elsewhere.
*Option C: A3
This is incorrect. A3 involves only a customer connector, not a communication interface.
*Option D: A4
This is incorrect. A4 applies to fully hosted solutions with no local ownership of connectors or interfaces.
The SWIFT user with a local communication interface as the main channel and a connector as a backup is of architecture type A2 (B).
References to SWIFT Customer Security Programme Documents:
*Swift Customer Security Controls Framework v2025: Defines architecture types A1-A4.
*CSP Architecture Type – Decision tree: Classifies A2 for communication interface and customer connector ownership.
*Assessment template for Mandatory controls: Applies to A2 architecture.
========

The “Independent Assessment Framework” and “Independent Assessment Process for Assessors Guidelines” mandate that CSP assessments and attestations be conducted by an independent, certified assessor, not the user’s internal audit department. Let’s evaluate each option:
*Option A: Yes, providing this is agreed by the head of IT operations and the CISO This is incorrect. Internal agreement does not override the CSP’s requirement for independence.
*Option B: No, this is never an option
This is correct. The CSP prohibits internal audit departments from submitting or approving attestations on the KYC-SA portal, as they lack the independence required by the “Independent Assessment Framework.” Only an external, certified assessor can perform and approve the assessment, with the CISO or designated user submitting the attestation based on the assessor’s report.
*Option C: Yes, an internal auditor can submit the attestation for approval provided they have the appropriate credentials for swift.com. The CISO remains in charge of the approval of the attestation This is incorrect. Internal auditors cannot submit or approve attestations, even with credentials, due to the independence requirement.
*Option D: Yes, with approval from the Chief Auditor
This is incorrect. Chief Auditor approval does not satisfy the CSP’s independence mandate.
Summary of Correct answer:
An internal audit department cannot submit or approve the attestation (B).
References to SWIFT Customer Security Programme Documents:
*Independent Assessment Framework: Requires independent assessors.
*Independent Assessment Process for Assessors Guidelines: Prohibits internal assessments for attestation.
*Swift_CSP_Assessment_Report_Template: Specifies external assessor input.
========

SWIFT, which stands for Society for Worldwide Interbank Financial Telecommunication, is a global member- owned cooperative that provides a network for financial institutions to securely exchange information, primarily for financial transactions. Let’s break down the options and evaluate them against SWIFT’s official services as outlined in the SWIFT Customer Security Programme (CSP) and related documentation.
* Option A: A platform for messagingThis is correct. SWIFT’s core function is to provide a secure, standardized messaging platform for financial institutions to exchange information. SWIFT operates a messaging network that enables banks, financial institutions, and other entities to send and receive standardized financial messages (such as payment instructions, securities transactions, and trade messages). This is facilitated through services like SWIFTNet, which is the messaging infrastructure that ensures secure and reliable communication. The SWIFT Customer Security Controls Framework (CSCF) emphasizes the security of this messaging platform, with controls designed to protect the integrity, confidentiality, and availability of the messaging environment. For example, the CSCF includes controls like “1.1 SWIFT Environment Protection,” which ensures the messaging platform is isolated and secure.
* Option B: Standards for communicatingThis is also correct. SWIFT is well-known for developing and maintaining global standards for financial messaging, most notably the SWIFT message types (MT) and the newer ISO 20022 standard, which is increasingly being adopted for cross-border payments and reporting. These standards define the format and structure of messages, ensuring consistency and interoperability across the global financial community. For instance, a payment instruction sent via SWIFT follows a standardized format (e.g., MT103 for a customer payment), which ensures that the sending and receiving institutions can process it efficiently. The SWIFT CSP documentation, including the CSCF, indirectly references these standards by focusing on the secure transmission of standardized messages, as seen in controls like “2.1 Internal Data Transmission Security,” which ensures data integrity during communication.
* Option C: Hosting for financial institutionsThis is incorrect. SWIFT does not provide hosting services for financial institutions. SWIFT’s role is focused on messaging and standards, not on hosting infrastructure like data centers or cloud services for financial institutions. While SWIFT does offer some cloud-based connectivity options (e.g., Alliance Cloud for smaller institutions to connect to the SWIFT network), this is not the same as providing hosting services for the institutions’ broader IT operations. Hosting infrastructure is typically managed by the institutions themselves or third-party providers, and the CSCF emphasizes that institutions are responsible for securing their own environments (e.g., Control “6.1 Security Awareness” highlights the need for institutions to manage their own security).
* Option D: A high-level programming languageThis is incorrect. SWIFT does not provide a programming language. SWIFT’s focus is on messaging protocols and standards, not on developing or providing programming languages.Financial institutions may use various programming languages (like Java, Python, or C++) to integrate with SWIFT’s messaging system via APIs or interfaces like SWIFT Alliance Access, but SWIFT itself does not develop or distribute programming languages. The CSCF does not reference programming languages as a SWIFT offering; instead, it focuses on secure integration with SWIFT services, such as Control “2.3 System Hardening,” which ensures that systems interacting with SWIFT are secure.
Summary of Correct Answers:SWIFT provides a platform for messaging (Option A) through its SWIFTNet network and standards for communicating (Option B) via its message formats like MT and ISO 20022. The other options-hosting services and a high-level programming language-are not part of SWIFT’s offerings.
References to SWIFT Customer Security Programme Documents:
* SWIFT Customer Security Controls Framework (CSCF) v2024: The CSCF outlines the security controls that protect the SWIFT messaging environment, emphasizing SWIFT’s role in secure messaging (e.g., Control 1.1, 2.1).
* SWIFT User Handbook: Details SWIFT’s messaging services and standards, including SWIFTNet and message types like MT and ISO 20022.
* SWIFT CSP Implementation Guide: Highlights that institutions are responsible for their own infrastructure, ruling out hosting as a SWIFT service.

This question focuses on the authentication method for online SwiftNet Security Officers (SOs), who manage security-related functions for a Swift user.
Step 1: Understand the Role of SwiftNet Security Officers
SwiftNet Security Officers are responsible for managing security settings, such as PKI certificates and user roles, within the Swift environment. Their authentication is critical to ensure secure access, as outlined in Control 2.3: System Access Controlof theCSCF v2024.
Step 2: Evaluate Each Option
* A. Via their PKI certificatePKI certificates are used for securing message exchanges and connectivity within the SwiftNet environment (e.g., signing messages), but they are not the primary method for authenticating Security Officers when accessing SwiftNet services online (e.g., via swift.com). Security Officerstypically use a user account for such access, not a PKI certificate directly.Conclusion: This is incorrect.
* B. Via their swift.com account and secure code cardSwiftNet Security Officers authenticate to swift.
com using their swift.com account credentials combined with a secure code card (a physical token that generates one-time codes). This two-factor authentication method is standard for high-privilege roles like Security Officers, as detailed in theSwift Security Best PracticesandControl 2.3, which mandates multi-factor authentication for privileged users.Conclusion: This is correct.
* C. Via their swift.com accountWhile a swift.com account is part of the authentication process, relying solely on the account (e.g., username and password) does not meet Swift’s security requirements for Security Officers. Multi-factor authentication, including a secure code card, is required for such roles.
Conclusion: This is incorrect.
Step 3: Conclusion and Verification
The correct answer isB, as SwiftNet Security Officers are authenticated using their swift.com account and a secure code card, aligning with Swift’s multi-factor authentication requirements for privileged users.
References
* Swift Customer Security Controls Framework (CSCF) v2024, Control 2.3: System Access Control.
* Swift Security Best Practices, Section: Authentication for Security Officers.
* Swift User Handbook, Section: Security Officer Authentication.