CFP CFP Cybersecurity & Data Privacy in Finance 1 — Questions and Answers
Question 1: Which U.S. federal law primarily governs the privacy and security of consumer financial data held by financial institutions?
- Gramm-Leach-Bliley Act (GLBA) (Correct answer)
- Sarbanes-Oxley Act
- Dodd-Frank Act
- Bank Secrecy Act
Correct answer: Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their data-sharing practices and protect sensitive consumer information.
Question 2: What type of attack involves cybercriminals intercepting communication between a fintech app and its server to steal credentials?
- Phishing attack
- Man-in-the-middle (MITM) attack (Correct answer)
- SQL injection
- Distributed denial-of-service (DDoS)
Correct answer: Man-in-the-middle (MITM) attack
A man-in-the-middle attack intercepts data in transit, making it critical for fintechs to use TLS/SSL encryption and certificate pinning.
Question 3: Which security framework is most widely adopted by U.S. financial institutions to manage cybersecurity risk?
- ISO 27001
- NIST Cybersecurity Framework (Correct answer)
- SOC 2 Type II
- PCI DSS
Correct answer: NIST Cybersecurity Framework
The NIST Cybersecurity Framework (CSF) is the most widely adopted standard by U.S. financial institutions for identifying, protecting, detecting, responding to, and recovering from cyber threats.
Question 4: What does 'data minimization' mean in the context of fintech data privacy?
- Encrypting all stored data
- Collecting only the data necessary for the specified purpose (Correct answer)
- Compressing data to reduce storage costs
- Deleting data older than 12 months
Correct answer: Collecting only the data necessary for the specified purpose
Data minimization is the principle of collecting and retaining only the personal data strictly necessary for a defined purpose, reducing exposure in case of a breach.
Question 5: Which payment card data security standard must fintech companies handling card transactions comply with?
- ISO 20022
- PCI DSS (Correct answer)
- SWIFT CSCF
- FFIEC CAT
Correct answer: PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) sets requirements for all entities that store, process, or transmit cardholder data.
Question 6: What is the purpose of multi-factor authentication (MFA) in fintech applications?
- To speed up login processes
- To verify user identity using two or more independent factors (Correct answer)
- To encrypt user passwords in the database
- To monitor user behavior for fraud
Correct answer: To verify user identity using two or more independent factors
MFA adds layers of security by requiring users to verify their identity through multiple independent factors such as a password plus a one-time code.
CFP CFP Cybersecurity & Data Privacy in Finance 1
Which U.S. federal law primarily governs the privacy and security of consumer financial data held by financial institutions?