CFP CFP Cybersecurity & Data Privacy in Finance 2 — Questions and Answers
Question 1: What is a 'zero-trust' security model in the context of fintech infrastructure?
- Trusting only internal network traffic
- Assuming no user or device is trusted by default and requiring continuous verification (Correct answer)
- Blocking all external API connections
- Granting admin privileges to verified employees only
Correct answer: Assuming no user or device is trusted by default and requiring continuous verification
Zero-trust security operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every access request regardless of network location.
Question 2: Which regulatory body in the U.S. oversees cybersecurity requirements for national banks and federal thrifts?
- FTC
- OCC (Correct answer)
- CFTC
- FDIC
Correct answer: OCC
The Office of the Comptroller of the Currency (OCC) supervises national banks and issues cybersecurity guidance, including heightened standards for large institutions.
Question 3: What is a 'penetration test' in fintech security?
- A test to check API response times under load
- A simulated cyberattack to identify vulnerabilities in systems (Correct answer)
- A database stress test for transaction throughput
- A compliance audit of data retention policies
Correct answer: A simulated cyberattack to identify vulnerabilities in systems
A penetration test (pen test) simulates real-world attacks on a fintech system to uncover exploitable vulnerabilities before malicious actors can.
Question 4: Under GLBA's Safeguards Rule, what is required of non-bank financial institutions?
- Annual third-party audits only
- Developing a written information security program (Correct answer)
- Purchasing cybersecurity insurance
- Filing quarterly breach reports with the FTC
Correct answer: Developing a written information security program
The FTC's Safeguards Rule under GLBA requires non-bank financial institutions to develop, implement, and maintain a comprehensive written information security program.
Question 5: Which type of encryption is most appropriate for protecting data stored in a fintech database?
- Symmetric encryption (AES-256) (Correct answer)
- Base64 encoding
- MD5 hashing
- ROT13 cipher
Correct answer: Symmetric encryption (AES-256)
AES-256 symmetric encryption is the industry standard for protecting data at rest in financial databases due to its strength and performance.
Question 6: What is the primary risk of using third-party APIs in a fintech application?
- Higher transaction fees
- Increased regulatory overhead
- Introducing supply chain vulnerabilities and data exposure (Correct answer)
- Slower processing speeds
Correct answer: Introducing supply chain vulnerabilities and data exposure
Third-party APIs can introduce supply chain vulnerabilities where a compromise in the vendor's systems can expose the fintech's customer data and infrastructure.
CFP CFP Cybersecurity & Data Privacy in Finance 2
What is a 'zero-trust' security model in the context of fintech infrastructure?