Series 24 Cybersecurity Practice Questions
Question 1
Under Regulation S-P, a broker-dealer is required to adopt written policies and procedures reasonably designed to do which of the following?
- A. Safeguard customer records and information against unauthorized access or use.
- B. Guarantee that no cybersecurity breach will ever occur at the firm.
- C. Publicly disclose all customer account balances to other clients for transparency purposes.
- D. Eliminate any need to encrypt customer data while it is in transit.
Show answer and explanation
Correct answer: A. Safeguard customer records and information against unauthorized access or use.
Regulation S-P's safeguards rule requires firms to adopt written policies and procedures reasonably designed to ensure the security and confidentiality of customer records and information and to protect against anticipated threats and unauthorized access. It is a 'reasonably designed' standard, not a guarantee of a breach-free environment.
- A. Correct — this is the actual reasonableness-based standard under Reg S-P's safeguards rule.
- B. Incorrect — no rule can guarantee a breach will never occur; this absolute framing is the trap.
- C. Incorrect — Reg S-P is about safeguarding customer information, the opposite of disclosing account balances to the public or to other clients.
- D. Incorrect — encryption in transit is a commonly expected safeguard, not something the rule eliminates the need for.
Question 2
A broker-dealer shares customers' nonpublic personal information with nonaffiliated parties only under the statutory exceptions, such as processing transactions, and has not changed its privacy practices since its last notice. Must it deliver an annual privacy notice?
- A. Yes; delivery is required once each calendar year to anyone with a continuing customer relationship
- B. No; the annual notice is not required when sharing stays within the exceptions and the policies are unchanged
- C. Yes; delivery is required within 12 months of the prior notice because the firm collects the information about its customers
- D. No; the notice requirement ended once the firm adopted its identity theft program
Show answer and explanation
Correct answer: B. No; the annual notice is not required when sharing stays within the exceptions and the policies are unchanged
Regulation S-P, as amended after the FAST Act, excepts a firm from the annual privacy notice if it shares customer information with nonaffiliates only under the exceptions to opt-out and has not changed its policies from the last notice. The initial notice at the start of the relationship is still required.
- A. This ignores the statutory exception; calendar-year delivery is required only if the exception does not apply.
- B. Correct: the annual notice exception applies when sharing is within the exceptions and policies are unchanged.
- C. Collecting customer information does not by itself trigger an annual notice when sharing stays within the exceptions and policies are unchanged.
- D. The identity theft program under Regulation S-ID is unrelated to the privacy notice requirement.
Question 3
A longtime customer changes her mailing address online, resets her password, and two days later asks to wire $60,000 to a new third-party bank account. How should the firm's Regulation S-ID program treat this pattern?
- A. As routine activity, since the customer authenticated successfully at login and the wire request came afterward
- B. As a red flag requiring the firm to verify the customer's identity through contact information already on file before processing the wire
- C. As a trigger that requires the firm to file a SAR before it speaks to the customer
- D. As grounds to close the account for 180 days and to report the customer to the state securities regulator
Show answer and explanation
Correct answer: B. As a red flag requiring the firm to verify the customer's identity through contact information already on file before processing the wire
A recent address change and credential reset followed by a request to send funds to a new third party is a classic account takeover pattern. Regulation S-ID requires the program to detect red flags and respond appropriately, such as verifying identity through previously established contact details.
- A. A successful login does not rule out a takeover using stolen credentials; the pattern still warrants verification.
- B. Correct: this is a red flag and the response should include independent verification before the wire is released.
- C. A SAR may follow later, but it does not replace verification and the firm should not skip contacting the customer.
- D. There is no 180-day closure rule, and reporting the customer to a regulator is not the prescribed response.
Considering a career as an advisor?
Explore careers at ParsonexQuestion 4
A broker-dealer outsources the storage of customer data to a third-party cloud vendor. Under Regulation S-P, what is the firm's continuing obligation with respect to that vendor's data safeguards?
- A. Once the vendor contractually agrees to maintain security controls, the firm's Regulation S-P obligations are satisfied
- B. The vendor, not the broker-dealer, becomes the primary regulated entity under Regulation S-P once data is transferred to it
- C. Regulation S-P applies only to data stored on the firm's own premises, so outsourced data is exempt
- D. The firm remains responsible for exercising appropriate due diligence and ongoing oversight of the vendor's safeguards, even though the function is outsourced
Show answer and explanation
Correct answer: D. The firm remains responsible for exercising appropriate due diligence and ongoing oversight of the vendor's safeguards, even though the function is outsourced
Outsourcing a function does not outsource regulatory responsibility. Under Regulation S-P's safeguards rule and long-standing SEC/FINRA vendor-management guidance, a broker-dealer must conduct due diligence before engaging a service provider and maintain ongoing oversight of that provider's data safeguards. A signed contract alone does not satisfy the rule if the firm fails to monitor actual performance; the rule is not limited to on-premises data; and the vendor does not become the regulated broker-dealer merely by holding the data.
- A. A vendor's contractual promise to maintain security controls doesn't by itself discharge the firm's Reg S-P obligations — the firm must still exercise ongoing due diligence and oversight.
- B. Outsourcing data storage doesn't shift primary regulatory responsibility to the vendor — the broker-dealer remains the regulated entity accountable for safeguarding the customer information.
- C. Regulation S-P isn't limited to on-premises data — a firm's obligations extend to customer information it entrusts to third-party service providers as well.
- D. Correct. Under Regulation S-P, the firm remains responsible for exercising appropriate due diligence in selecting the vendor and for ongoing oversight of the vendor's data safeguards, even though the storage function itself is outsourced.