Skip to content

Series 24 Cybersecurity Practice Questions

Official outline
FINRA Series 24 Content Outline
Questions on this page
8
Updated
Nov 3, 2026

  1. Question 1, easy

    Under Regulation S-P, a broker-dealer is required to adopt written policies and procedures reasonably designed to do which of the following?

    • A.Safeguard customer records and information against unauthorized access or use.
    • B.Guarantee that no cybersecurity breach will ever occur at the firm.
    • C.Publicly disclose all customer account balances to other clients for transparency purposes.
    • D.Eliminate any need to encrypt customer data while it is in transit.
    Show answer and explanationHide answer

    Correct answer: A. Safeguard customer records and information against unauthorized access or use.

    Regulation S-P's safeguards rule requires firms to adopt written policies and procedures reasonably designed to ensure the security and confidentiality of customer records and information and to protect against anticipated threats and unauthorized access. It is a 'reasonably designed' standard, not a guarantee of a breach-free environment.

    • A. Correct. This is the actual reasonableness-based standard under Reg S-P's safeguards rule.
    • B. Incorrect. No rule can guarantee a breach will never occur; this absolute framing is the trap.
    • C. Incorrect. Reg S-P is about safeguarding customer information, the opposite of disclosing account balances to the public or to other clients.
    • D. Incorrect. Encryption in transit is a commonly expected safeguard, not something the rule eliminates the need for.

  2. Question 2, easy

    A broker-dealer shares customers' nonpublic personal information with nonaffiliated parties only under the statutory exceptions, such as processing transactions, and has not changed its privacy practices since its last notice. Must it deliver an annual privacy notice?

    • A.Yes; delivery is required once each calendar year to anyone with a continuing customer relationship
    • B.No; the annual notice is not required when sharing stays within the exceptions and the policies are unchanged
    • C.Yes; delivery is required within 12 months of the prior notice because the firm collects the information about its customers
    • D.No; the notice requirement ended once the firm adopted its identity theft program
    Show answer and explanationHide answer

    Correct answer: B. No; the annual notice is not required when sharing stays within the exceptions and the policies are unchanged

    Regulation S-P, as amended after the FAST Act, excepts a firm from the annual privacy notice if it shares customer information with nonaffiliates only under the exceptions to opt-out and has not changed its policies from the last notice. The initial notice at the start of the relationship is still required.

    • A. This ignores the statutory exception; calendar-year delivery is required only if the exception does not apply.
    • B. Correct: the annual notice exception applies when sharing is within the exceptions and policies are unchanged.
    • C. Collecting customer information does not by itself trigger an annual notice when sharing stays within the exceptions and policies are unchanged.
    • D. The identity theft program under Regulation S-ID is unrelated to the privacy notice requirement.

  3. Question 3, medium

    A longtime customer changes her mailing address online, resets her password, and two days later asks to wire $60,000 to a new third-party bank account. How should the firm's Regulation S-ID program treat this pattern?

    • A.As routine activity, since the customer authenticated successfully at login and the wire request came afterward
    • B.As a red flag requiring the firm to verify the customer's identity through contact information already on file before processing the wire
    • C.As a trigger that requires the firm to file a SAR before it speaks to the customer
    • D.As grounds to close the account for 180 days and to report the customer to the state securities regulator
    Show answer and explanationHide answer

    Correct answer: B. As a red flag requiring the firm to verify the customer's identity through contact information already on file before processing the wire

    A recent address change and credential reset followed by a request to send funds to a new third party is a classic account takeover pattern. Regulation S-ID requires the program to detect red flags and respond appropriately, such as verifying identity through previously established contact details.

    • A. A successful login does not rule out a takeover using stolen credentials; the pattern still warrants verification.
    • B. Correct: this is a red flag and the response should include independent verification before the wire is released.
    • C. A SAR may follow later, but it does not replace verification and the firm should not skip contacting the customer.
    • D. There is no 180-day closure rule, and reporting the customer to a regulator is not the prescribed response.

  4. Question 4, medium

    A broker-dealer outsources the storage of customer data to a third-party cloud vendor. Under Regulation S-P, what is the firm's continuing obligation with respect to that vendor's data safeguards?

    • A.Once the vendor contractually agrees to maintain security controls, the firm's Regulation S-P obligations are satisfied
    • B.The vendor, not the broker-dealer, becomes the primary regulated entity under Regulation S-P once data is transferred to it
    • C.Regulation S-P applies only to data stored on the firm's own premises, so outsourced data is exempt
    • D.The firm remains responsible for exercising appropriate due diligence and ongoing oversight of the vendor's safeguards, even though the function is outsourced
    Show answer and explanationHide answer

    Correct answer: D. The firm remains responsible for exercising appropriate due diligence and ongoing oversight of the vendor's safeguards, even though the function is outsourced

    Outsourcing a function does not outsource regulatory responsibility. Under Regulation S-P's safeguards rule and long-standing SEC/FINRA vendor-management guidance, a broker-dealer must conduct due diligence before engaging a service provider and maintain ongoing oversight of that provider's data safeguards. A signed contract alone does not satisfy the rule if the firm fails to monitor actual performance; the rule is not limited to on-premises data; and the vendor does not become the regulated broker-dealer merely by holding the data.

    • A. A vendor's contractual promise to maintain security controls doesn't by itself discharge the firm's Reg S-P obligations. The firm must still exercise ongoing due diligence and oversight.
    • B. Outsourcing data storage doesn't shift primary regulatory responsibility to the vendor. The broker-dealer remains the regulated entity accountable for safeguarding the customer information.
    • C. Regulation S-P isn't limited to on-premises data. A firm's obligations extend to customer information it entrusts to third-party service providers as well.
    • D. Correct. Under Regulation S-P, the firm remains responsible for exercising appropriate due diligence in selecting the vendor and for ongoing oversight of the vendor's data safeguards, even though the storage function itself is outsourced.

  5. Question 5, medium

    A broker-dealer's written Identity Theft Prevention Program, required under Regulation S-ID, must address which four elements?

    • A.Identify relevant red flags, detect those red flags, respond appropriately, and periodically update the program
    • B.Encrypt data, back up data, restrict access, and audit access logs
    • C.Notify customers, notify FINRA, notify the SEC, and notify state regulators
    • D.Verify identity, collect biometric data, retain records, and destroy records after five years
    Show answer and explanationHide answer

    Correct answer: A. Identify relevant red flags, detect those red flags, respond appropriately, and periodically update the program

    Regulation S-ID requires firms to develop and implement a written Identity Theft Prevention Program with reasonable policies and procedures to: (1) identify relevant patterns, practices, and forms of activity that are 'red flags' signaling possible identity theft; (2) detect red flags incorporated into the program; (3) respond appropriately to detected red flags to prevent and mitigate identity theft; and (4) ensure the program is periodically updated to reflect changes in risks.

    • A. Correct. Identify, detect, respond, and update are the four required elements of a Reg S-ID Identity Theft Prevention Program.
    • B. These are general data-security practices associated more with the Safeguards Rule's technical controls, not the specific four elements Reg S-ID requires.
    • C. Multi-regulator notification is not the four-part framework Reg S-ID specifies for the Identity Theft Prevention Program itself.
    • D. Biometric collection and a fixed five-year destruction schedule are not elements Reg S-ID requires.

  6. Question 6, medium

    A member firm discovers unauthorized access to a database containing customer Social Security numbers. Which of the following best describes the firm's supervisory obligation upon discovering this incident?

    • A.The firm has no obligation to act until a customer specifically complains of identity theft or reports unauthorized account activity to the firm.
    • B.The firm may defer any response until its next regularly scheduled WSP review, at which point the incident can be assessed along with other matters.
    • C.The firm must follow its written incident response plan, which should address containment, assessment of the scope of the breach, and applicable notification obligations to affected customers and regulators.
    • D.The firm must immediately terminate every representative who had system access to the affected database, pending completion of any investigation of the breach.
    Show answer and explanationHide answer

    Correct answer: C. The firm must follow its written incident response plan, which should address containment, assessment of the scope of the breach, and applicable notification obligations to affected customers and regulators.

    Firms are expected to maintain and act on a written incident response program addressing detection, containment, investigation of scope, and any required notifications to affected individuals and regulators under applicable federal and state breach notification requirements. This is an immediate, proactive obligation triggered by discovery of the incident itself, not by a subsequent customer complaint or a scheduled review cycle.

    • A. Incorrect. The obligation to respond is triggered by discovery of unauthorized access, not by a customer complaint or report of account activity.
    • B. Incorrect. Breach response cannot be deferred to a routine periodic review; it requires prompt action.
    • C. Correct. This reflects the expected structured incident response and notification process.
    • D. Incorrect. Blanket termination of everyone with access is neither required nor an appropriate substitute for an investigation-driven response.

  7. Question 7, easy

    Which SEC regulation requires broker-dealers to adopt written policies and procedures reasonably designed to safeguard customer records and information?

    • A.Regulation S-P
    • B.Regulation S-ID
    • C.Regulation SCI
    • D.SEC Rule 17a-4
    Show answer and explanationHide answer

    Correct answer: A. Regulation S-P

    Regulation S-P's safeguards rule is the core SEC requirement that broker-dealers adopt written policies and procedures reasonably designed to protect customer records and information. Regulation S-ID addresses identity theft red flags for covered accounts, not general data safeguarding. Regulation SCI applies to exchanges, clearing agencies, and other systemically important market infrastructure, not retail broker-dealers generally. Rule 17a-4 governs recordkeeping retention and format, not data-protection policy.

    • A. Regulation S-P is the SEC rule requiring broker-dealers to adopt written policies reasonably designed to protect the confidentiality and security of customer records and information (the 'Safeguards' and privacy notice rule).
    • B. Regulation S-ID addresses identity theft red flags and covered accounts, not the general safeguarding of customer records.
    • C. Regulation SCI applies to the technology systems of key market infrastructure entities (exchanges, clearing agencies, etc.), not customer-record safeguarding obligations at broker-dealers generally.
    • D. Rule 17a-4 governs the retention format and duration of required books and records; it does not itself impose the customer-information safeguarding obligation described.

  8. Question 8, easy

    A cloud vendor supporting customer account records reports unauthorized access to its administrator credentials. What action should be prioritized?

    • A.Wait for the next scheduled vendor contract renewal cycle before raising the issue with the vendor
    • B.Treat the incident as the vendor's responsibility because the vendor owns and operates the servers
    • C.Publicly disclose affected customers' passwords to speed up the vendor's security testing
    • D.Activate incident response, assess scope and notifications, preserve evidence and mitigate access risk
    Show answer and explanationHide answer

    Correct answer: D. Activate incident response, assess scope and notifications, preserve evidence and mitigate access risk

    A vendor breach affecting customer records can trigger the firm's own safeguarding, supervisory and notification duties. The firm should activate incident response, scope the impact, preserve evidence and contain the access risk.

    • A. Waiting for contract renewal delays containment of an active compromise.
    • B. The firm remains responsible for safeguarding customer information held by its vendors.
    • C. Disclosing passwords publicly would create further harm and violate safeguarding duties.
    • D. Correct: incident response, scoping, notification assessment, evidence preservation and mitigation.

Sources

Federal regulations

Other

Questions are drafted with help from AI and published only after a person reviews and approves them. How these questions are made

More Cybersecurity questions

Practice CybersecurityCustomize Series 24 practice

Keep going

More Series 24 topics

Already working in the field?

Learn about Parsonex