CFP CFP Cybersecurity & Data Privacy in Finance 2

Question 1

What is a 'zero-trust' security model in the context of fintech infrastructure?

Accepted Answer

Assuming no user or device is trusted by default and requiring continuous verification

Answer

Zero-trust security operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every access request regardless of network location.

Question 2

Which regulatory body in the U.S. oversees cybersecurity requirements for national banks and federal thrifts?

Accepted Answer

OCC

Answer

The Office of the Comptroller of the Currency (OCC) supervises national banks and issues cybersecurity guidance, including heightened standards for large institutions.

Question 3

What is a 'penetration test' in fintech security?

Accepted Answer

A simulated cyberattack to identify vulnerabilities in systems

Answer

A penetration test (pen test) simulates real-world attacks on a fintech system to uncover exploitable vulnerabilities before malicious actors can.

Question 4

Under GLBA's Safeguards Rule, what is required of non-bank financial institutions?

Accepted Answer

Developing a written information security program

Answer

The FTC's Safeguards Rule under GLBA requires non-bank financial institutions to develop, implement, and maintain a comprehensive written information security program.

Question 5

Which type of encryption is most appropriate for protecting data stored in a fintech database?

Accepted Answer

Symmetric encryption (AES-256)

Answer

AES-256 symmetric encryption is the industry standard for protecting data at rest in financial databases due to its strength and performance.

(CFP) Certified Fintech Practitioner Practice Test

(CFP) Certified Fintech Practitioner Practice Test

CFP CFP Cybersecurity & Data Privacy in Finance 2