Question 1

Which of the following agencies regulates financial institutions not covered by other agencies?

Accepted Answer

The Federal Trade Commission (FTC) is responsible for protecting consumers and competition by preventing anticompetitive, deceptive, and unfair business practices. While not a financial regulator in the traditional sense like the FDIC or NCUA, the FTC does have jurisdiction over certain financial practices and institutions not covered by other financial regulatory agencies, particularly in areas related to consumer protection and antitrust matters.

Question 2

Which of the following agencies regulates state-chartered banks?

Accepted Answer

The Federal Deposit Insurance Corporation (FDIC) regulates state-chartered banks that are not members of the Federal Reserve System. It ensures the stability and public confidence in the U.S. financial system by insuring deposits, examining and supervising financial institutions for safety, soundness, and consumer protection, and managing receiverships.

Question 3

The Federal Reserve Board is responsible for regulating which of the following?

Accepted Answer

The Federal Reserve Board is responsible for regulating bank holding companies and member banks of the Federal Reserve System. Other entities like national banks and federally chartered credit unions are overseen by different regulators, such as the Office of the Comptroller of the Currency (OCC) and the National Credit Union Administration (NCUA), respectively. State-chartered banks may be supervised by state banking authorities and, depending on their membership, by the Federal Reserve or the FDIC.

Question 4

Which of the following statements best describes operational risk?

Accepted Answer

Operational risk refers to the risk of loss resulting from inadequate or failed internal processes, people, or systems, or from external events. This definition includes legal risks but excludes strategic and reputational risks. It encompasses a range of issues including fraud, loss of key personnel, business interruption, and systems failures.

Question 5

Which of the following statements best describes reputational risk?

Accepted Answer

Reputational risk is the risk arising from negative public opinion. This can affect a company's customer base, revenue, and overall standing in the market, often as a result of some form of negative event or perception, whether true or not.

Question 6

Which of the following best describes an assessment?

Accepted Answer

The answer of Which of the following best describes an...

Question 7

Which of the following testing methodologies measures how well controls and safeguards work by subjecting the system to an attack?

Accepted Answer

The answer of Which of the following testing methodologies measures...

Question 8

Which of the following is an evidence-based examination that compares current practices against internal or external criteria?

Accepted Answer

An audit is an evidence-based examination that compares current practices against predefined standards or criteria, which can be internal policies or external regulations. This process is used to ensure compliance and improve efficiency and effectiveness.

Question 9

What is the FTC implementation of the GBLA?

Accepted Answer

The FTC implementation of the Gramm-Leach-Bliley Act (GBLA) is known as the Safeguards Rule. This rule requires financial institutions to have measures in place to keep customer information secure.

Question 10

What is the term used to describe names, addresses, and phone numbers when linked to bank and credit card account information?

Accepted Answer

Nonpublic personal information is the term used to describe sensitive data such as names, addresses, and phone numbers when they are linked with bank and credit card account information, according to privacy laws and regulations.

Question 11

Which of the following threats must financial institutions address?

Accepted Answer

Financial institutions must address all of these threats: denial of service, which can disrupt their operations; unauthorized access, which can lead to data breaches and financial loss; and malware, which can compromise system integrity and steal sensitive information.

Question 12

Which of the following is not considered NPPI?

Accepted Answer

The answer of Which of the following is not considered...

Question 13

According to the Interagency Guidelines, who must approve the bank's written information security program?

Accepted Answer

The Interagency Guidelines require that a bank's written information security program must be approved by its Board of Directors or an appropriate committee of the Board. This ensures that the program aligns with the bank's overall strategic direction and complies with regulatory requirements.

Question 14

Which of the following, also known as social engineering, is a methodology by which an individual impersonates someone else to extract sensitive information from them?

Accepted Answer

Pretexting is a form of social engineering where an attacker creates a fabricated scenario or pretext to engage with their target in order to obtain sensitive information or access to systems. Unlike system infiltration, corporate identity theft, or denial of service attacks, pretexting relies on manipulation and deception of individuals through direct interaction, often by impersonating someone else.

Question 15

Which of the following gives federal financial regulators statutory authority to regulate and examine the services a technology service provider (TSP) performs for FDIC-insured financial institutions?

Accepted Answer

The Bank Service Company Act (BSCA) gives federal financial regulators the statutory authority to regulate and examine the services a technology service provider performs for FDIC-insured financial institutions.

Question 16

Which of the following statements best describes strategic risk?

Accepted Answer

Strategic risk involves the risk arising from adverse business decisions or the failure to implement appropriate business decisions in a manner that aligns with the organization's strategic goals. It is concerned with the high-level decisions and actions that can affect the entire direction and success of an organization.

Question 17

Which of the following is used by regulatory agencies to uniformly assess financial institutions based on a rating scale of 1 to 5, with 1 representing the best rating and least degree of concern, and 5 representing the worst rating and highest degree of concern?

Accepted Answer

URSIT (Uniform Rating System for Information Technology) is used by regulatory agencies to assess financial institutions' technology and cybersecurity strength on a scale of 1 to 5, where 1 is the best rating indicating strong performance and 5 is the worst, indicating significant concerns.

Question 18

Which of the following is an interagency body empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions?

Accepted Answer

The Federal Financial Institutions Examination Council (FFIEC) is the interagency body responsible for prescribing uniform principles, standards, and report forms for the federal examination of financial institutions.

Question 19

Which key part of the NY DFS Cybersecurity Regulation covers training and monitoring?

Accepted Answer

Section 500.14 of the NY DFS Cybersecurity Regulation specifically addresses the requirements for training and monitoring to ensure the cybersecurity program's effectiveness and to mitigate the risk of cyber events.

Question 20

Which of the following refers to the risk arising from problems with service or product delivery?

Accepted Answer

The answer of Which of the following refers to the...

Quiz 13: Regulatory Compliance for Financial Institutions