Series 99 Operational Risk & Controls 5

Question 1

A broker-dealer's cybersecurity policy requires all employees to use multi-factor authentication (MFA). This is BEST classified as which type of operational control?

Accepted Answer

Preventive control

Answer

MFA is a preventive control because it stops unauthorized access before it can occur, rather than detecting or correcting problems after the fact.

Question 2

Under SEC Regulation SCI, which firms are required to establish, maintain, and enforce written policies for their systems?

Accepted Answer

SCI entities including certain exchanges, clearing agencies, ATSs, and plan processors

Answer

Regulation SCI applies to SCI entities — national securities exchanges, registered clearing agencies, ATSs, plan processors, and exempt clearing agencies — requiring robust systems compliance and integrity policies.

Question 3

A control gap analysis at a broker-dealer identifies that the firm has no procedure for reviewing electronic communications of registered persons. This represents:

Accepted Answer

A regulatory risk and operational control deficiency requiring remediation

Answer

FINRA requires firms to review electronic correspondence of registered persons; the absence of such a procedure is a serious control deficiency and regulatory violation.

Question 4

Which of the following BEST describes 'tail risk' in the context of operational risk management?

Accepted Answer

The risk of low-probability but high-severity events that fall outside normal risk models

Answer

Tail risk refers to extreme, low-probability events with severe consequences that are not adequately captured by standard probability distributions.

Question 5

A broker-dealer's anti-money laundering (AML) program fails to flag a series of structuring transactions. This failure MOST directly represents:

Accepted Answer

An operational control failure with legal and regulatory consequences

Answer

Failure of AML controls to detect structuring is an operational control failure that can result in BSA/FinCEN violations, fines, and reputational damage.

(Series 99) Operations Professional Exam Practice Test

(Series 99) Operations Professional Exam Practice Test

Series 99 Operational Risk & Controls 5