Identify Privacy And Data Security - Nationwide Multistate Licensing System NMLS

1. What federal law requires financial institutions to provide privacy notices and safeguard customer information?

   Gramm-Leach-Bliley Act (GLBA). This legislation mandates financial institutions to explain data-sharing practices and implement measures to protect consumer privacy.

2. Which policy most directly governs how long borrower records are kept and when they are destroyed?

   Records retention and secure disposal policy. It establishes timelines and methods for maintaining and eliminating records to comply with legal and security standards.

3. What is nonpublic personal information (NPI) under GLBA in a mortgage context?

   Personally identifiable financial info not publicly available about a consumer. It encompasses confidential details like account numbers or credit history that could identify individuals in financial transactions.

4. What is the correct secure disposal method for paper documents containing NPI?

   Cross-cut shredding or certified secure destruction. These techniques ensure complete destruction, preventing reconstruction and unauthorized recovery of sensitive details.

5. Which vendor management requirement best protects NPI when using third-party service providers?

   Due diligence and contracts requiring safeguards and confidentiality. It ensures third parties adhere to equivalent security standards, mitigating risks in outsourced operations.

6. What is the best definition of "data in transit" in information security?

   Data being transmitted across a network or between systems. It involves information during transfer, susceptible to interception without protective measures like encryption.

7. Identify the compliant action if a borrower's file with NPI is left on a printer in a public area.

   Retrieve immediately, secure it, and report the incident per policy. This procedure protects sensitive information from exposure and ensures incidents are documented for review.

8. What is the primary purpose of an incident response plan in a security program?

   Define steps to detect, contain, eradicate, and report security incidents. It outlines systematic procedures to manage breaches effectively, ensuring quick response and minimal damage.

9. What is "social engineering" as a data security threat to mortgage staff?

   Manipulating people to disclose information or perform unsafe actions. This tactic exploits human vulnerabilities to bypass technical safeguards, leading to potential data breaches.

10. What consumer right is triggered when a firm shares NPI with nonaffiliated third parties outside exceptions?

    Right to opt out of certain nonaffiliated third-party sharing. This provision allows consumers to prevent unauthorized dissemination of their sensitive data beyond specified exemptions.

11. Which security control protects data in transit from interception on public networks?

    Encryption (for example, TLS/HTTPS or VPN). This method scrambles data during transmission, preventing eavesdroppers from deciphering sensitive information on open networks.

12. When must an initial GLBA privacy notice generally be delivered to a customer?

    At the time the customer relationship is established. Delivery coincides with relationship initiation to ensure timely awareness of privacy policies before data collection begins.

13. What is the best definition of "data at rest" in information security?

    Stored data (for example, on servers, laptops, backups, or removable media). It refers to inactive information vulnerable to physical theft or unauthorized access if not properly secured.

14. What is the purpose of the GLBA Privacy Rule for consumers of financial products or services?

    Requires privacy notices and limits sharing of nonpublic personal information. It ensures consumers are informed about data handling and provides options to control information dissemination to third parties.

15. Which authentication practice best strengthens access to systems containing NPI?

    Multi-factor authentication (MFA). It adds layers of verification beyond passwords, reducing risks of unauthorized entry into protected systems.

16. Which GLBA notice describes a company's information-sharing practices and consumer rights?

    Initial and annual privacy notice. These disclosures inform consumers about data practices and their opt-out rights under federal privacy regulations.

17. What is "phishing" in the context of protecting borrower information?

    Fraudulent messages that trick users into revealing credentials or data. These deceptive communications exploit trust to extract sensitive details, posing significant risks to data integrity.

18. Which concept means sharing only the minimum customer data needed to perform a business function?

    Least privilege / minimum necessary access. It restricts data access to essential levels, minimizing risks of unauthorized exposure or misuse in business operations.

19. Which option is appropriate when a coworker requests borrower NPI but has no job-related need?

    Deny access and report or escalate per least-privilege policy. It enforces access controls, preventing unnecessary exposure and maintaining compliance with privacy protocols.

20. What is the correct secure disposal method for electronic media that stored NPI?

    Secure wipe, degauss, or physical destruction per policy. These processes render data irretrievable, aligning with standards to prevent residual information leaks.

21. Which option best describes a "breach" involving customer information in a mortgage company?

    Unauthorized access to, acquisition of, or disclosure of protected data. It constitutes a security incident where confidential data is compromised, triggering notification and remediation obligations.

22. Which option best protects NPI when working remotely in a public place (for example, café)?

    Use VPN, prevent shoulder-surfing, and avoid public Wi‑Fi without protection. These measures secure connections and prevent visual eavesdropping, upholding data protection in unsecured environments.

23. What is the purpose of the GLBA Safeguards Rule for financial institutions?

    Requires a written information security program to protect customer information. It compels organizations to develop comprehensive strategies for assessing risks and securing sensitive customer data against threats.

24. Identify the best practice for sending borrower documents containing NPI by email.

    Use encrypted email or a secure portal; avoid unencrypted attachments. This approach safeguards sensitive information during electronic transmission, reducing interception risks.

25. Identify the safest immediate action if you suspect your credentials were compromised.

    Report per policy immediately and change credentials using a trusted method. This response minimizes potential damage by alerting authorities and securing accounts through verified channels.

Study these flashcards