NMLS CE Assessment Test Questions with
Verified Correct Answers
Which of the following is true about privacy notices to consumers or customers?
- You must provide annual notices to consumers until you have removed their data from your
information system under your record retention and destruction policy.
- You only need to send annual notices to current customers.
- If an existing customer buys a new product or service from you, your last notice to the
customer will suffice as long as you gave it within the last 12 months.
- You must send a revised privacy notice to consumers if your data sharing policy changes
within 12 months after your last contact with them.
- You only need to send annual notices to current customers.
Which of the following is not an example of behavior that might be a red flag activity for
purposes of the Red Flag Rule?
- A customer begins to make extra payments on a mortgage after a history of making only
required payments.
- A mortgage loan applicant submits documents that appear to have been altered or forged.
- A loan applicant does not have a Social Security number.
- Receiving a notice from a customer, law enforcement agency, or consumer reporting agency
of possible identity theft activity connected with a customer's application or account.
- A customer begins to make extra payments on a mortgage after a history of making only
required payments.
Which of the following best describes the relationship between state data privacy protection
laws and the GLB Act?
- State privacy protection laws that provide more consumer and customer protections than
the GLB Act are inconsistent with the GLB Act and are unenforceable.
- State privacy protection laws that provide more consumer and customer protections than
the GLB Act are consistent with the GLB Act.
- The GLB Act supersedes all state data privacy protection laws for financial institutions.
- States have authority to enforce the GLB Act in addition to the FTC and the CFPB.
- State privacy protection laws that provide more consumer and customer protections than the
GLB Act are consistent with the GLB Act.
,An outsider who targets one or more individuals in your company to approach with an
attempted phishing scam is engaged in what kind of behavior?
- Exploitation
- Whaling
- Initial compromise
- Reconnaissance
- Reconnaissance
Which of the following is not an example of a vulnerability exploit?
- Outdated software
- Misconfigured software
- Malicious software
- A zero-day software flaw
- Malicious software
Which of the following is not required before a financial institution can disclose consumer or
customer information to a nonaffiliated third party?
- Give the consumer or customer reasonable opportunity to opt out before disclosing NPI.
- Give the consumer or customer notice of the right to opt out.
- Provide an initial privacy notice to the consumer or customer.
- Register with the NMLS and have a written information security program in place
beforehand
- Register with the NMLS and have a written information security program in place beforehand
Which of the following best describes "The Red Flag Rule?"
- The Red Flag Rule requires financial institutions to implement a written Theft Prevention
Program to identify warning signs of identity theft.
- The Red Flag Rule requires financial institutions to issue revised privacy notices to existing
customers when they purchase a new product or service from the financial institution.
- The Red Flag rule governs the actions that a financial institution must take if an
unauthorized disclosure of consumer or customer NPI to a nonaffiliated third party happens.
- The Red Flag Rule requires financial institutions to report mortgage fraud or mortgage-
related money laundering activities to the FBI.
- The Red Flag Rule requires financial institutions to implement a written Theft Prevention
Program to identify warning signs of identity theft.
Which of the following is not true about the distinction between consumers and customers?
- A person can be a consumer or a customer, but not both.
, - A former customer can be a consumer.
- A customer has an ongoing relationship with you.
- All customers are consumers.
- A person can be a consumer or a customer, but not both.
Which of the following is least likely to be considered as personally identifiable information?
- A Social Security number
- An individual's address
- A person's address
- A phone number listed in a telephone directory
- A phone number listed in a telephone directory
Which of the following best describes the relationship between non-public personal
information and personally identifiable information?
- Personally identifiable information is separate from non-public personal information.
- Personally identifiable information is a type of non-public personal information.
- Personally identifiable information is publicly available.
- You only have a duty to protect personally identifiable information, not non-public personal
information.
- Personally identifiable information is a type of non-public personal information.
Which of the following best describes the difference between the Privacy Rule and the
Safeguarding Rule?
- The FTC is responsible for administering the Privacy Rule, while the CFPB is responsible for
administering the Safeguarding Rule.
- The Privacy Rule applies to consumer NPI, while the Safeguarding Rule applies to customer
NPI.
- The Privacy Rule applies to disclosures of consumer or customer NPI to nonaffiliated third
parties, while the Safeguarding Rule requires financial institutions to maintain an information
security program.
- All financial institutions subject to the Dodd-Frank Act are required to have an information
security program under the Safeguarding Rule.
- The Privacy Rule applies to disclosures of consumer or customer NPI to nonaffiliated third
parties, while the Safeguarding Rule requires financial institutions to maintain an information
security program.
A written risk assessment is part of which of the following?
- An information security program.
Verified Correct Answers
Which of the following is true about privacy notices to consumers or customers?
- You must provide annual notices to consumers until you have removed their data from your
information system under your record retention and destruction policy.
- You only need to send annual notices to current customers.
- If an existing customer buys a new product or service from you, your last notice to the
customer will suffice as long as you gave it within the last 12 months.
- You must send a revised privacy notice to consumers if your data sharing policy changes
within 12 months after your last contact with them.
- You only need to send annual notices to current customers.
Which of the following is not an example of behavior that might be a red flag activity for
purposes of the Red Flag Rule?
- A customer begins to make extra payments on a mortgage after a history of making only
required payments.
- A mortgage loan applicant submits documents that appear to have been altered or forged.
- A loan applicant does not have a Social Security number.
- Receiving a notice from a customer, law enforcement agency, or consumer reporting agency
of possible identity theft activity connected with a customer's application or account.
- A customer begins to make extra payments on a mortgage after a history of making only
required payments.
Which of the following best describes the relationship between state data privacy protection
laws and the GLB Act?
- State privacy protection laws that provide more consumer and customer protections than
the GLB Act are inconsistent with the GLB Act and are unenforceable.
- State privacy protection laws that provide more consumer and customer protections than
the GLB Act are consistent with the GLB Act.
- The GLB Act supersedes all state data privacy protection laws for financial institutions.
- States have authority to enforce the GLB Act in addition to the FTC and the CFPB.
- State privacy protection laws that provide more consumer and customer protections than the
GLB Act are consistent with the GLB Act.
,An outsider who targets one or more individuals in your company to approach with an
attempted phishing scam is engaged in what kind of behavior?
- Exploitation
- Whaling
- Initial compromise
- Reconnaissance
- Reconnaissance
Which of the following is not an example of a vulnerability exploit?
- Outdated software
- Misconfigured software
- Malicious software
- A zero-day software flaw
- Malicious software
Which of the following is not required before a financial institution can disclose consumer or
customer information to a nonaffiliated third party?
- Give the consumer or customer reasonable opportunity to opt out before disclosing NPI.
- Give the consumer or customer notice of the right to opt out.
- Provide an initial privacy notice to the consumer or customer.
- Register with the NMLS and have a written information security program in place
beforehand
- Register with the NMLS and have a written information security program in place beforehand
Which of the following best describes "The Red Flag Rule?"
- The Red Flag Rule requires financial institutions to implement a written Theft Prevention
Program to identify warning signs of identity theft.
- The Red Flag Rule requires financial institutions to issue revised privacy notices to existing
customers when they purchase a new product or service from the financial institution.
- The Red Flag rule governs the actions that a financial institution must take if an
unauthorized disclosure of consumer or customer NPI to a nonaffiliated third party happens.
- The Red Flag Rule requires financial institutions to report mortgage fraud or mortgage-
related money laundering activities to the FBI.
- The Red Flag Rule requires financial institutions to implement a written Theft Prevention
Program to identify warning signs of identity theft.
Which of the following is not true about the distinction between consumers and customers?
- A person can be a consumer or a customer, but not both.
, - A former customer can be a consumer.
- A customer has an ongoing relationship with you.
- All customers are consumers.
- A person can be a consumer or a customer, but not both.
Which of the following is least likely to be considered as personally identifiable information?
- A Social Security number
- An individual's address
- A person's address
- A phone number listed in a telephone directory
- A phone number listed in a telephone directory
Which of the following best describes the relationship between non-public personal
information and personally identifiable information?
- Personally identifiable information is separate from non-public personal information.
- Personally identifiable information is a type of non-public personal information.
- Personally identifiable information is publicly available.
- You only have a duty to protect personally identifiable information, not non-public personal
information.
- Personally identifiable information is a type of non-public personal information.
Which of the following best describes the difference between the Privacy Rule and the
Safeguarding Rule?
- The FTC is responsible for administering the Privacy Rule, while the CFPB is responsible for
administering the Safeguarding Rule.
- The Privacy Rule applies to consumer NPI, while the Safeguarding Rule applies to customer
NPI.
- The Privacy Rule applies to disclosures of consumer or customer NPI to nonaffiliated third
parties, while the Safeguarding Rule requires financial institutions to maintain an information
security program.
- All financial institutions subject to the Dodd-Frank Act are required to have an information
security program under the Safeguarding Rule.
- The Privacy Rule applies to disclosures of consumer or customer NPI to nonaffiliated third
parties, while the Safeguarding Rule requires financial institutions to maintain an information
security program.
A written risk assessment is part of which of the following?
- An information security program.
