- An adviser designs AML controls; what are the essential components of an AML compliance program for investment advisers?
Answer: A written program tailored to risk, with oversight, training, testing, and suspicious activity escalation
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight designing AML controls. The correct answer is valid because it accurately reflects a written program with oversight, training, and testing as detailed in the passage. A common distractor fails by suggesting client self-certification replaces verification, undermining CIP requirements. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- In an AML compliance scenario, which process best supports consistent implementation across the firm?
Answer: Written policies, periodic training, and designated compliance oversight
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight consistent AML implementation. The correct answer is valid because it accurately reflects written policies and training as detailed in the passage. A common distractor fails by relying on unwritten, variable practices. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65. Group discussions on policy development build skills.
- Which business continuity item best supports client service continuity when key personnel become unavailable?
Answer: Cross-training, delegation plans, and updated contact lists
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight continuity when personnel are unavailable. The correct answer is valid because it accurately reflects cross-training and plans as detailed in the passage. A common distractor fails by limiting knowledge to one employee. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- A client requests data deletion; how do privacy laws like GDPR affect the operations of investment advisers?
Answer: They require a process to evaluate requests while meeting legal retention and confidentiality duties
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight client data deletion requests under GDPR. The correct answer is valid because it accurately reflects evaluating requests while meeting legal duties as detailed in the passage. A common distractor fails by requiring deletion even against retention laws, conflicting with compliance obligations. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- A firm updates policies annually; which cybersecurity measure is most effective in protecting client data?
Answer: Use security awareness training and phishing simulations to reduce credential theft risk
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight updating policies annually for cybersecurity. The correct answer is valid because it accurately reflects security awareness training and phishing simulations as detailed in the passage. A common distractor fails by allowing email forwarding to personal accounts, heightening data exposure risks. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- An adviser implements CIP and monitoring; what are the essential components of an AML compliance program for investment advisers?
Answer: CIP, risk-based monitoring, escalation, training, and independent testing with documented oversight
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight implementing CIP and monitoring in AML programs. The correct answer is valid because it accurately reflects CIP, risk-based monitoring, escalation, training, and independent testing as detailed in the passage. A common distractor fails by suggesting outsourcing removes adviser responsibility, which is a misconception of accountability. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- Which cybersecurity practice most supports system integrity by reducing known software vulnerabilities?
Answer: Timely patching and vulnerability management processes
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight reducing software vulnerabilities. The correct answer is valid because it accurately reflects timely patching as detailed in the passage. A common distractor fails by delaying updates indefinitely. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- A hurricane forces an investment adviser to evacuate its main office. The firm activates its BCP and relocates key personnel to a backup facility in another state. This action demonstrates the BCP component of:
Answer: Alternate processing site.
A key component of a robust Business Continuity Plan is having a pre-arranged alternate processing site or location where the firm can continue its critical operations if the primary site becomes unavailable. This ensures continuity of service for clients.
- An IAR receives an email that appears to be from a senior partner, urgently requesting a wire transfer for a confidential deal. The email address is slightly different from the partner's actual address. This is a common example of what type of cyber threat?
Answer: Spear phishing.
This is a classic example of spear phishing, which is a targeted attempt to steal money or information by impersonating a known or trusted individual. It differs from general phishing in that it is highly targeted at a specific person or organization.
- Which practice best supports cybersecurity by reducing the impact of compromised employee credentials?
Answer: Least-privilege access and role-based permissions
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight practices to limit impact from compromised credentials. The correct answer is valid because it accurately reflects least-privilege access as detailed in the passage. A common distractor fails by allowing unrestricted software installations that heighten risks. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- Which AML practice best addresses higher-risk clients, such as complex ownership structures or unusual funding sources?
Answer: Enhanced due diligence and more frequent monitoring
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight handling higher-risk AML clients. The correct answer is valid because it accurately reflects enhanced due diligence as detailed in the passage. A common distractor fails by avoiding reviews to prevent discrimination. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- An investment adviser can forego sending an annual privacy notice to its customers if it meets certain conditions. One of these conditions is that the firm:
Answer: Has not changed its privacy policies and practices from the last notice provided.
Under an amendment to Regulation S-P, a firm is not required to provide an annual privacy notice if it does not share NPI with nonaffiliated third parties (beyond what is allowed by exceptions) AND it has not changed its privacy policies since the last notice was delivered to customers.
- The primary objective of an investment adviser's Business Continuity and Disaster Recovery Plan (BCP) is to:
Answer: Ensure the firm can continue to conduct its essential business functions during and after a significant disruption.
A Business Continuity Plan (BCP) is designed to allow a firm to maintain or resume critical operations in the face of a disaster or disruption, such as a natural disaster, power outage, or cyber-attack. Its goal is operational resilience, not preventing all risks or guaranteeing performance.
- Which cybersecurity practice most helps protect client data on employee laptops used for travel?
Answer: Full-disk encryption and strong device access controls
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight protecting data on mobile devices. The correct answer is valid because it accurately reflects encryption and controls as detailed in the passage. A common distractor fails by recommending unsecured public Wi-Fi use. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65. Hands-on device security demos are effective.
- After a ransomware event, what is the role of business continuity planning in an investment advisory firm?
Answer: Provide incident response, backups, and recovery steps to restore services and communicate with clients
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight recovery after a ransomware event. The correct answer is valid because it accurately reflects incident response, backups, and recovery steps as detailed in the passage. A common distractor fails by suggesting it replaces AML monitoring, confusing distinct compliance areas. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- A hurricane closes the office; what is the role of business continuity planning in an investment advisory firm?
Answer: Shift to remote operations, protect records, and maintain client service using preplanned alternatives
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight office closure due to a hurricane. The correct answer is valid because it accurately reflects shifting to remote operations and maintaining service as detailed in the passage. A common distractor fails by focusing only on physical security, neglecting technology recovery. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- In an AML compliance scenario, which step aligns with a risk-based customer identification process?
Answer: Verify identity using reliable documents or data sources
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight customer identification processes in AML. The correct answer is valid because it accurately reflects verifying identity with reliable sources as detailed in the passage. A common distractor fails by accepting verbal assurances without documentation. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65. Role-playing verification scenarios can enhance understanding.
- How do privacy rules and cybersecurity controls differ most in an adviser's compliance program?
Answer: Privacy governs permitted use and sharing; cybersecurity protects systems and data from compromise
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight differences between privacy and cybersecurity. The correct answer is valid because it accurately reflects their distinct roles as detailed in the passage. A common distractor fails by claiming privacy replaces access controls. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65. Comparing regulatory texts clarifies distinctions.
- A firm shares data with vendors; how do privacy laws like GDPR affect the operations of investment advisers?
Answer: They require controls over processors, appropriate contracts, and limits on use consistent with disclosures
This question tests Series 65 understanding of AML, cybersecurity, privacy, and business continuity obligations. These areas are crucial for protecting client information and maintaining regulatory compliance. In the context of this question, specific details from the passage highlight sharing data with vendors under GDPR. The correct answer is valid because it accurately reflects controls, contracts, and disclosure consistency as detailed in the passage. A common distractor fails by allowing unsafeguarded international transfers for accredited clients, violating protection standards. Teaching strategies include reviewing real-world compliance examples and practicing identifying regulatory requirements relevant to Series 65.
- An investment adviser discovers its computer network has been breached, and client nonpublic personal information was potentially compromised. According to cybersecurity best practices, the firm's immediate priority should be to:
Answer: Contain the breach to prevent further unauthorized access and assess the extent of the incident.
In the event of a cybersecurity breach, the first priority is to contain the threat and investigate the scope. This involves securing the systems, determining what information was compromised, and identifying affected clients. Notifying clients and regulators are subsequent, important steps, but containment comes first.
