An FTC Safeguards Rule-covered lender is not exempt from section 314.4(d)(2). It has neither effective continuous monitoring nor other systems that detect ongoing information-system changes that may create vulnerabilities. After its January annual penetration test, what additional assessment requirement applies?
Correct Answer
C) Vulnerability assessments at least every six months and when material changes or relevant material security circumstances arise
C. Vulnerability assessments remain required on both scheduled and event-driven bases. The annual penetration test and vulnerability assessments are complementary requirements under the assumed monitoring arrangement. A material change can require assessment before the next six-month interval; January testing does not discharge every later obligation. Scope and exceptions: Scope follows the risk assessment. This scenario expressly excludes the alternative monitoring route and the limited exemption; it does not claim all institutions must use identical testing schedules. Source: Section 314.4(d)(1)–(2) — https://www.ecfr.gov/current/title-16/section-314.4
Why This Is the Correct Answer
C. Vulnerability assessments remain required on both scheduled and event-driven bases. The annual penetration test and vulnerability assessments are complementary requirements under the assumed monitoring arrangement. A material change can require assessment before the next six-month interval; January testing does not discharge every later obligation. Scope and exceptions: Scope follows the risk assessment. This scenario expressly excludes the alternative monitoring route and the limited exemption; it does not claim all institutions must use identical testing schedules.
Why the Other Options Are Wrong
Option A: Only another penetration test, with no vulnerability assessments
Another penetration test does not replace vulnerability assessments.
Option B: Vulnerability assessments exactly every 30 days in every case
The rule does not prescribe a universal 30-day interval.
Option D: No further testing because January's penetration test covers everything
It incorrectly treats the annual test as complete year-round coverage.
Exam Tip
Maintain periodic assessments and respond to material changes between them.
More Federal Laws Questions
Before the team acts on a production meeting, a training manager must address SCRA Interest Rate Cap. Which response is most defensible?
A team member asks about RESPA Kickbacks and Referrals in an investor-delivery review while trying to confirm the rule-based response. Which response should the loan team use?
During a disclosure desk review, the loan team encounters an RESPA Servicing Transfer issue. Which response should avoid a shortcut that would misapply the rule?
A disciplinary-risk review raises a question about TILA APR and finance-charge rules. Which action should the renewal specialist recommend?
An MLO is reviewing procedures for a case where a compliance analyst asks why covered mortgage application data is collected. What is the proper handling?
A consumer complaint response raises a question about GLBA privacy requirements. Which action should the state compliance officer recommend?
Before the team acts on a branch training session, a policy analyst must address RESPA Servicing Transfer Notice. Which response is most defensible?
A training manager is resolving RESPA Referral Fees during an internal audit sample. Which action best fits the rule?
An operations lead is resolving ECOA Prohibited Discrimination Bases during a loan-team coaching session. Which action best fits the rule?
In a file escalation meeting, a disclosure specialist sees facts tied to TILA Closing Disclosure. What should the file reflect?
People Also Study
General Mortgage Knowledge
20% of exam
Mortgage Loan Origination Activities
27% of exam
Ethics, Fraud & Consumer Protection
18% of exam
Uniform State Test Content
11% of exam
Related Study Resources
Previous Question
An MLO is reviewing procedures for a case where an MLO wants to pull a consumer report for curiosity before an application purpose exists. What is the proper handling?
Next Question
The branch manager compares the file facts with FCRA Risk Based Pricing during a borrower follow-up call. Which conclusion is accurate?