I85PREP
⌘ K
IIBF Certified Information System Banker study materials
IIBF Certified Information System Banker study resources

IIBF Certified Information System Banker practice questions

One question at a time. Build your IIBF Certified Information System Banker understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

In a Core Banking Solution (CBS), the module that maintains customer master data and the relationship between a customer and multiple accounts is best described as which of the following?

  1. The Clearing House Interface
  2. The Customer Information File (CIF) Correct answer.
  3. The Loan Origination System
  4. The General Ledger module

Explanation

The Customer Information File (CIF) is the central repository in a CBS that stores customer demographic and KYC data and links each customer to all accounts held across branches. It enables a single customer view and relationship pricing. Other modules handle accounting, clearing, or loan processing rather than customer master data.

Question 2Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank wants customers to transact on a single platform across branches, ATMs, internet banking and mobile banking with consistent balances. Which CBS capability enables this?

  1. Offline transaction queuing at each channel
  2. Centralised online real-time processing with a single data store Correct answer.
  3. Batch end-of-day processing only
  4. Standalone branch servers with nightly consolidation

Explanation

Centralised online real-time processing means every channel posts to one authoritative database so balances and limits are consistent instantly. Standalone or offline models create reconciliation lags and risk of inconsistent data. Batch-only processing cannot support real-time channel access.

Question 3Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

In banking technology, the term 'channel' most accurately refers to which of the following?

  1. The regulatory reporting format submitted to the central bank
  2. A physical network switch inside the data centre
  3. The database schema used by the CBS
  4. The interface through which a customer interacts with the bank's systems Correct answer.

Explanation

Delivery channels are the customer-facing interfaces such as branch counters, ATMs, POS, internet banking, mobile banking and call centres. They connect customers to back-end systems. Network switches, database schemas and regulatory formats are infrastructure or reporting artefacts, not channels.

Question 4Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following best describes Straight-Through Processing (STP) in a banking environment?

  1. Routing all transactions to a branch for approval
  2. Processing transactions only during batch windows
  3. Manual re-keying of transactions by operations staff
  4. Automatic end-to-end processing of a transaction without manual intervention Correct answer.

Explanation

STP means a transaction flows from capture through validation, posting and settlement automatically, with no manual re-keying or intervention. It reduces errors and turnaround time. Manual re-keying, batch-only processing and mandatory branch approval all defeat straight-through flow.

Question 5Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's ATM switch receives a withdrawal request and must authorise it against the customer's available balance before dispensing cash. Which system typically performs this authorisation?

  1. The regulatory reporting engine
  2. The core banking system, accessed through the channel switch Correct answer.
  3. The cheque clearing system
  4. The document management system

Explanation

The ATM switch routes the request to the core banking system, which validates the account, checks available balance and limits, and returns an authorisation response. Clearing, reporting and document systems do not authorise cash withdrawals. Authorisation must occur before the ATM dispenses cash.

Question 6Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following is the primary purpose of a payment switch (such as an interbank switch) in the banking technology landscape?

  1. To generate the general ledger trial balance
  2. To compute the bank's capital adequacy ratio
  3. To store customer KYC documents
  4. To route and authorise payment messages between acquirers, issuers and networks Correct answer.

Explanation

A payment switch routes payment messages between participants such as acquirers, issuers, ATM networks and card networks, and manages authorisation and switching. It does not store KYC documents, compute capital ratios or produce trial balances. Those functions belong to other systems.

Question 7Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank deploys a mobile banking app that caches the last known balance for offline display. Which risk does this design most directly create?

  1. The CBS will fail to post transactions
  2. The customer may see a stale balance that differs from the CBS balance Correct answer.
  3. The bank's general ledger will not close
  4. The ATM network will lose connectivity

Explanation

Caching balances on the device means the displayed figure can lag behind the authoritative CBS record, so customers may act on stale information. It does not itself stop CBS posting, break ATM connectivity or prevent ledger closing. The control is to refresh from the server and label cached data clearly.

Question 8Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

In a core banking implementation, 'parameterisation' allows a bank to do which of the following?

  1. Avoid maintaining any product documentation
  2. Eliminate the need for user access controls
  3. Configure products, interest rules and charges through maintained parameters rather than code changes Correct answer.
  4. Rewrite the vendor's source code for each product

Explanation

Parameterisation lets banks define products, interest tiers, charges and workflows through configuration tables maintained by business users. This reduces custom code and speeds product launch. It does not remove documentation needs or access controls, and source code changes are usually avoided.

Question 9Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's internet banking channel uses a hardware token for transaction signing. Which security objective does transaction signing most directly support?

  1. Non-repudiation and integrity of the transaction instruction Correct answer.
  2. Scalability of the reporting database
  3. Confidentiality of stored account statements
  4. Availability of the ATM network

Explanation

Transaction signing with a hardware token cryptographically binds the customer to the specific transaction details, supporting integrity and non-repudiation. It does not primarily protect stored statements, nor does it address network availability or database scalability. The signature lets the bank verify the instruction was authorised.

Question 10Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following best explains why banks maintain a reconciliation process between the CBS and the general ledger in some architectures?

  1. To ensure every posted transaction is reflected in financial accounting records Correct answer.
  2. To increase the interest rate on deposits
  3. To reduce the number of delivery channels
  4. To replace the need for internal audit

Explanation

Where the CBS posts sub-ledger transactions and the general ledger is maintained separately, reconciliation confirms that all transactions are reflected in financial records and that differences are investigated. It does not set interest rates, replace internal audit or reduce channels. Reconciliation is a control over data integrity.

Question 11Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank introduces an API-based banking platform that exposes account and payment services to third-party fintechs. Which control is most important to include at the API gateway?

  1. Manual signature verification of paper forms
  2. Physical vault access logging
  3. Strong authentication, authorisation scopes and rate limiting Correct answer.
  4. Batch file upload scheduling

Explanation

An API gateway for open banking must authenticate callers, enforce scoped authorisation for each API, and apply rate limiting and monitoring to prevent abuse. Batch scheduling, paper signature checks and vault logging do not govern programmatic API access. These controls protect data and availability.

Question 12Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following is a key reason a bank might adopt a service-oriented or microservices architecture for its digital channels?

  1. To make each business capability independently deployable and scalable Correct answer.
  2. To eliminate the need for a database
  3. To avoid regulatory compliance obligations
  4. To remove the need for testing

Explanation

Service-oriented and microservices architectures decompose capabilities into independently deployable services that can scale and be changed separately. They still require databases, compliance and testing. The benefit is agility and resilience, not exemption from controls.

Question 13Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's business continuity plan for its CBS requires a recovery time objective (RTO) of two hours. What does this RTO specify?

  1. The maximum acceptable time to restore the service after disruption Correct answer.
  2. The number of staff required during a disaster
  3. The maximum amount of data that may be lost
  4. The frequency of backup tape rotation

Explanation

RTO defines the maximum tolerable time to restore a service after disruption. Data loss tolerance is the recovery point objective (RPO). Staffing and backup rotation are operational details, not the definition of RTO. RTO drives the choice of resilience architecture such as active-active data centres.

Question 14Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

In a cheque truncation system (CTS), what is the principal change compared with the traditional physical cheque clearing process?

  1. Cheques are cleared only at the issuing branch
  2. Cash is dispensed instead of clearing the cheque
  3. Cheques are cleared without any image capture
  4. Cheque images and data replace physical movement of cheques for clearing Correct answer.

Explanation

Cheque truncation captures an image and MICR data at the presenting bank and transmits them electronically, so the physical cheque no longer moves for clearing. This speeds clearing and reduces logistics. It still requires image quality standards and signature verification by the paying bank.

Question 15Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank notices that its mobile banking channel shows a much higher login failure rate than internet banking. Which investigation is most appropriate first?

  1. Recalibrating the ATM cash dispensers
  2. Recomputing the bank's capital adequacy ratio
  3. Reviewing the cheque clearing cut-off times
  4. Reviewing the mobile app's authentication flow, session handling and device compatibility logs Correct answer.

Explanation

A channel-specific failure pattern points to the mobile authentication flow, session management or device and OS compatibility. Analysing channel logs and app behaviour isolates the cause. Capital ratios, ATM dispensers and cheque cut-off times do not explain mobile login failures.

Question 16Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following best describes the role of a middleware layer in a bank's integration architecture?

  1. It replaces the need for a core banking system
  2. It performs statutory audits of the bank
  3. It stores the bank's physical cash reserves
  4. It mediates communication and data transformation between disparate systems Correct answer.

Explanation

Middleware such as message queues, enterprise service buses or integration platforms mediates communication between systems, transforming formats and routing messages reliably. It does not hold cash, replace the CBS or perform audits. It reduces point-to-point coupling between applications.

Question 17Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank wants to offer a new deposit product with tiered interest rates and a promotional rate for the first three months. Which CBS design feature is most relevant?

  1. Manual calculation by branch staff for each account
  2. Product parameterisation with effective-dated interest rules Correct answer.
  3. A separate spreadsheet maintained by the treasury desk
  4. Hard-coding the rate in the channel application

Explanation

Effective-dated product parameters let the CBS apply tiered rates and a time-bound promotional rate automatically from the correct date. Manual calculation, spreadsheets and hard-coding create errors and inconsistency across channels. Parameterisation also supports audit and change control.

Question 18Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following is the most significant operational risk of relying on a single data centre for the core banking system?

  1. Interest rates may be calculated incorrectly
  2. Customers may receive duplicate statements
  3. The bank may issue too many ATM cards
  4. A site-wide failure could halt all channels with no automatic failover Correct answer.

Explanation

A single data centre creates a single point of failure; a site incident could stop all channel access without failover capability. Duplicate statements, rate errors and card issuance volumes are separate control issues. Resilience typically requires a disaster recovery site or active-active architecture.

Question 19Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

In the context of banking delivery channels, what does a 'thin client' branch architecture typically mean?

  1. Branch staff use paper ledgers only
  2. Branch terminals rely on central servers for application logic and data Correct answer.
  3. All processing occurs on the customer's mobile device
  4. Each branch runs its own independent core banking database

Explanation

A thin client architecture keeps application logic and data on central servers while branch terminals act mainly as presentation devices. This centralises control, simplifies updates and supports consistent data. Independent branch databases and paper ledgers are the opposite of thin client design.

Question 20Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank plans to migrate from a legacy CBS to a new platform. Which risk mitigation is most important during parallel run?

  1. Running both systems and reconciling outputs daily before final switch-over Correct answer.
  2. Freezing all customer transactions during migration
  3. Disabling reconciliation to speed up the cutover
  4. Switching off the legacy system on day one

Explanation

A parallel run compares outputs from legacy and new systems and reconciles differences daily, building confidence before cutover. Disabling reconciliation or switching off the legacy system prematurely risks undetected errors. Freezing all transactions is impractical and harmful to customers.

Question 21Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank wants to detect fraudulent card transactions in real time at the payment switch. Which approach is most suitable?

  1. Monthly reconciliation of card statements
  2. Rule-based and behavioural scoring engines invoked synchronously during authorisation Correct answer.
  3. Quarterly customer surveys
  4. Annual external audit sampling

Explanation

Real-time fraud detection requires rules and behavioural models evaluated synchronously in the authorisation path so suspicious transactions can be declined or challenged. Monthly reconciliation, annual audit sampling and surveys operate after the event or too slowly. Latency budgets must be respected.

Question 22Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following best explains the concept of 'channel integration' in a bank's omni-channel strategy?

  1. Each channel maintains its own separate customer record
  2. Only the branch channel is allowed to open accounts
  3. Channels are restricted to a single device type
  4. Channels share a common customer and transaction view so interactions continue across channels Correct answer.

Explanation

Omni-channel integration means channels draw on a shared customer and transaction view, so a journey started on mobile can continue at a branch or ATM. Separate records per channel cause inconsistency. Restricting account opening or device types undermines the strategy rather than defining it.

Question 23Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following is a typical function of a bank's treasury management system in relation to the core banking platform?

  1. Capturing customer KYC documents at account opening
  2. Authorising ATM cash withdrawals
  3. Generating customer statements for savings accounts
  4. Managing liquidity, investments and foreign exchange positions with interfaces to the CBS Correct answer.

Explanation

A treasury management system manages liquidity, investment portfolios, foreign exchange and money market positions, interfacing with the CBS for accounting and balances. KYC capture, ATM authorisation and statement generation are core banking or channel functions. Integration ensures treasury positions reconcile with accounting records.

Question 24Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's regulator requires that customer data be stored within the country. Which architectural consideration does this most directly drive?

  1. Choice of data centre location and cloud region for the CBS and channel data stores Correct answer.
  2. Selection of the ATM cassette denomination
  3. Design of the cheque printing font
  4. Frequency of branch cash audits

Explanation

Data localisation requirements determine where databases and backups may reside, affecting data centre and cloud region choices and replication design. ATM denominations, cash audits and cheque fonts are unrelated to data residency. Compliance must be designed into the hosting architecture.

Question 25Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

What does a 'host-to-host' connection between a corporate customer and its bank typically provide?

  1. A card network authorisation path
  2. A direct system-to-system link for payment files and statements without manual re-keying Correct answer.
  3. A branch counter service for cash deposits
  4. A regulatory reporting channel to the central bank

Explanation

Host-to-host connectivity links the corporate's ERP or treasury system directly to the bank for secure exchange of payment files, statements and acknowledgements. This removes manual re-keying and speeds processing. It is distinct from branch cash services, card authorisation and regulatory reporting.

Question 26Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's core banking solution (CBS) maintains the customer master and the deposit ledger. Which function is most centrally performed by the CBS rather than by a delivery channel?

  1. Encrypting the network link between the branch and the data centre
  2. Rendering the mobile app user interface on the customer's handset
  3. Posting interest accruals and maintaining the loan and deposit books of account Correct answer.
  4. Authenticating the customer's biometric fingerprint at login

Explanation

The CBS is the system of record: it holds customer, account and product data and performs the accounting postings such as interest accrual and balance maintenance. Channels only capture and present transactions, while security functions belong to the channel and network layers.

Question 27Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank runs its CBS with end-of-day (EOD) batch processing. Which characteristic best describes this design?

  1. Transactions are accumulated during the day and posted to the books in a scheduled overnight run Correct answer.
  2. Interest is calculated only when the customer requests a statement
  3. Each transaction is posted to the general ledger immediately as it is authorised
  4. Branch staff manually approve each posting before it is stored

Explanation

In EOD batch design, transactions are captured during the day and the accounting and interest runs are executed in a scheduled overnight cycle. This contrasts with real-time or near-real-time posting, where each transaction updates the books immediately.

Question 28Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A customer initiates an IMPS/NEFT-style interbank credit transfer from the bank's mobile app. Which sequence best represents the typical message flow?

  1. Mobile app directly to the beneficiary bank CBS, bypassing all intermediary systems
  2. Mobile app to the treasury system to the payment switch to the beneficiary CBS
  3. Mobile app to channel server to payment switch to beneficiary bank CBS, with the debit confirmed back to the remitter Correct answer.
  4. Mobile app to the ATM switch to the card network to the remitter's CBS

Explanation

A retail interbank transfer travels from the customer channel to the bank's channel server, which validates and forwards it to the payment switch for routing to the beneficiary bank. The remitter's account is debited and the outcome is returned along the same path.

Question 29Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank wants to launch a new savings variant with a different minimum balance and fee structure without changing application code. Which CBS capability is designed for this?

  1. Hard-coding the new rules in the channel application
  2. Product parameterisation through configurable product master definitions Correct answer.
  3. Creating a separate standalone database for the new product
  4. Replacing the CBS with a spreadsheet-based ledger

Explanation

Product parameterisation lets business users define new products by configuring attributes such as interest rules, fees and minimum balances in the product master. This avoids code changes and keeps the change auditable and reversible.

Question 30Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's branch network uses a centralised CBS with branch terminals connected over the WAN. What is the main advantage of this centralised model over each branch running its own server?

  1. Elimination of the need for network connectivity at branches
  2. A single consolidated customer view and consistent product rules across all branches Correct answer.
  3. Automatic exemption from business continuity planning
  4. Lower dependency on the central data centre for branch operations

Explanation

Centralisation gives one customer master and one set of product logic, so balances, limits and relationships are consistent everywhere. The trade-off is greater dependence on the network and the central site, which must be offset by continuity arrangements.

Question 31Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank offers ATM, internet, mobile and branch channels. Which design best delivers a consistent customer experience when a customer starts a term deposit on mobile and completes it in a branch?

  1. Branch staff re-keying the application from a printout of the mobile session
  2. Separate databases for each channel synchronised by nightly file transfers
  3. Each channel storing its own copy of customer data with no reconciliation
  4. A shared customer and product services layer that all channels call, with a common interaction record Correct answer.

Explanation

Omni-channel consistency requires channels to share common services and a common record of the customer's journey, so a partially completed request is visible everywhere. Nightly synchronisation or isolated data stores create conflicting versions of the same customer state.

Question 32Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank plans to expose account balance and payment initiation services to an external aggregator. Which control is most important at the API gateway?

  1. Allowing any caller with a valid IP address to read balances
  2. Publishing the API keys in the developer portal for convenience
  3. Disabling logging to reduce response latency
  4. Strong customer authentication and consent-scoped authorisation for each API call Correct answer.

Explanation

Open banking style APIs must authenticate the caller and verify that the customer has consented to the specific data or payment access requested. Authorisation must be scoped to the consent rather than granted broadly.

Question 33Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's internet banking server is placed in a DMZ while the CBS sits in the internal network. What is the primary security purpose of this arrangement?

  1. To allow the CBS to be administered from the public internet
  2. To ensure a compromise of the externally facing channel does not give direct access to the core ledger Correct answer.
  3. To increase the transaction throughput of the CBS batch runs
  4. To remove the need for firewalls inside the bank

Explanation

The DMZ creates a controlled buffer: the internet-facing channel can be attacked without exposing the CBS directly, and traffic between the two passes through inspected, restricted paths. This limits lateral movement from a compromised channel.

Question 34Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

What does a Straight-Through Processing (STP) rate measure in a bank's payment operations?

  1. The speed of the overnight batch cycle in transactions per second
  2. The proportion of transactions processed end-to-end without manual intervention Correct answer.
  3. The number of channels connected to the payment switch
  4. The percentage of customers enrolled for mobile banking

Explanation

STP rate measures how many payments flow from capture to settlement without manual repair or referral. A low rate signals data quality or validation problems in the channel or the processing chain.

Question 35Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank wants its CBS to support both a legacy character-terminal branch front end and a new web front end during a two-year transition. Which CBS characteristic makes this feasible?

  1. A layered architecture that exposes business services independently of the presentation layer Correct answer.
  2. Requiring all channels to share a single identical user interface
  3. Storing business rules only inside the branch terminal software
  4. Embedding channel-specific logic in the database triggers

Explanation

When business logic is exposed as services separate from presentation, multiple front ends can consume the same functions during a phased migration. This avoids duplicating rules and keeps behaviour consistent across old and new channels.

Question 36Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's ATM channel experiences repeated timeouts when the CBS response exceeds a threshold. Which design change most directly addresses this without altering the core ledger?

  1. Increasing the ATM cash dispenser capacity
  2. Adding more ATMs at each branch
  3. Moving the CBS to a larger data centre building
  4. Introducing a channel-level timeout and fallback response policy with queued reversal handling Correct answer.

Explanation

Timeouts arise from the interaction between the channel and the CBS, so a defined timeout, fallback message and queued reconciliation of uncertain outcomes protects customers and the ledger. Physical capacity changes do not address response-time behaviour.

Question 37Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

Which of the following best describes the role of a data warehouse in a bank that already operates a CBS?

  1. Consolidating data from multiple source systems for management reporting and analytics Correct answer.
  2. Executing the live posting of customer deposits and withdrawals
  3. Routing interbank payment messages between banks
  4. Authenticating customers at the mobile channel

Explanation

The data warehouse extracts and consolidates data from the CBS and other systems to support MIS, regulatory reporting and analytics without loading the transaction systems. It is not the system of record for live postings.

Question 38Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank's treasury system and CBS must reflect the same nostro account position. Which control most directly ensures this?

  1. Allowing each system to maintain independent opening balances
  2. Relying on the treasury dealer's memory of intraday trades
  3. Automated reconciliation of treasury and CBS balances with exception reporting Correct answer.
  4. Reporting the position only at year end

Explanation

Automated reconciliation compares the two systems' records and surfaces breaks for investigation, keeping the nostro position reliable. Manual recollection or infrequent reporting cannot provide the daily accuracy that liquidity management requires.

Question 39Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank is choosing between an on-premise CBS and a hosted CBS for a small rural cooperative. Which consideration weighs most heavily against the hosted option?

  1. The inability to connect ATMs to a hosted CBS
  2. The absence of any need for disaster recovery planning
  3. Dependence on the provider's connectivity and the need for contractual service levels and exit provisions Correct answer.
  4. The impossibility of configuring products in a hosted system

Explanation

Hosting shifts operational dependence to the provider, so network resilience, service levels, audit rights and a viable exit plan become critical. Product configuration and channel connectivity are generally available in hosted models.

Question 40Information Systems in Banking (banking technology landscape, core banking solutions, delivery channels)

A bank wants to reduce the risk of duplicate debits when a customer retries a payment after a slow response. Which mechanism should the payment processing layer implement?

  1. An idempotency key tied to the original request so retries do not create a second posting Correct answer.
  2. A daily report of all payments initiated
  3. Blocking all retries at the mobile app
  4. A longer screen timeout on the customer's device

Explanation

An idempotency key lets the processing layer recognise a repeated request as the same instruction and return the original result instead of posting again. This protects customers from duplicate debits during network or timeout uncertainty.

Question 41Information System Security and Cyber Security Management

In a bank's information security programme, the principle of segregation of duties is primarily intended to achieve which outcome?

  1. Guaranteeing that the bank's systems will not suffer a hardware failure
  2. Allowing one administrator to hold all privileged passwords for faster response
  3. Ensuring that no single individual can both initiate and approve a sensitive transaction or control change Correct answer.
  4. Reducing the total headcount required in the IT operations team

Explanation

Segregation of duties splits critical functions such as initiation, authorisation and reconciliation among different people so that a single actor cannot complete a high-risk action alone. This limits the potential for fraud and undetected error, and is a core control expected in banking IT governance. It does not reduce staffing needs or prevent hardware faults.

Question 42Information System Security and Cyber Security Management

A bank employee receives an email that appears to come from the HR department asking them to click a link and re-enter their corporate credentials to view an updated salary circular. Which attack technique does this best illustrate?

  1. Distributed denial of service
  2. Cross-site scripting
  3. SQL injection
  4. Spear phishing Correct answer.

Explanation

Spear phishing is a targeted phishing attempt crafted for a specific group or individual, often impersonating an internal function such as HR to harvest credentials. The tailored context (salary circular) and credential-harvesting link are characteristic. The other options are network or application attacks that do not describe a deceptive email lure.

Question 43Information System Security and Cyber Security Management

Under the confidentiality, integrity and availability model, which control set best protects integrity of a bank's transaction records?

  1. Restricting physical access to the server room
  2. Encrypting backup tapes stored off site
  3. Provisioning redundant network links to the data centre
  4. Hash totals, checksums and maker-checker validation on data entry Correct answer.

Explanation

Integrity controls ensure data is accurate, complete and unaltered, which hash totals, checksums and maker-checker validation directly enforce at entry and processing stages. Encryption protects confidentiality, redundancy supports availability, and physical access restriction is a broader safeguard not specific to data integrity.

Question 44Information System Security and Cyber Security Management

A bank wants to ensure that a critical internet banking application can continue operating if its primary data centre becomes unavailable. Which control should be prioritised?

  1. An annual penetration test of the application
  2. A stronger password policy for all internet banking users
  3. A tested disaster recovery plan with a defined recovery time objective and a warm standby site Correct answer.
  4. A quarterly review of firewall rule sets

Explanation

Availability of a critical service during site loss depends on a documented and tested recovery capability, including a recovery time objective and an alternate processing site. Password policy, firewall reviews and penetration testing address access and vulnerability concerns rather than continuity of service.

Question 45Information System Security and Cyber Security Management

Which of the following best describes the purpose of a security incident response plan in a bank?

  1. To define roles, escalation paths and steps for detecting, containing, eradicating and recovering from security incidents Correct answer.
  2. To list every piece of software installed on the bank's endpoints
  3. To document the bank's marketing communication strategy
  4. To record the annual leave schedule of the IT security team

Explanation

An incident response plan sets out how incidents are detected, classified, escalated, contained, eradicated and recovered from, together with the responsible roles. It ensures coordinated and timely action under pressure. Software inventories, leave schedules and marketing plans are unrelated documents.

Question 46Information System Security and Cyber Security Management

In access control terminology, granting a user the minimum access necessary to perform their current job is known as which principle?

  1. Role explosion
  2. Least privilege Correct answer.
  3. Privilege creep
  4. Mandatory access control

Explanation

Least privilege means each user receives only the access rights needed for their assigned duties, and no more. It reduces the impact of compromised accounts and accidental misuse. Privilege creep is the opposite drift of accumulating excess rights over time.

Question 47Information System Security and Cyber Security Management

A bank's board asks why cyber risk should be reported in the same enterprise risk framework as credit and market risk. Which reason is most appropriate?

  1. Cyber risk is purely a technical matter that never affects financial statements
  2. Cyber risk can be eliminated entirely by purchasing insurance
  3. Cyber events can cause financial loss, regulatory breach and reputational damage, so they must be quantified and governed alongside other material risks Correct answer.
  4. Cyber risk is managed only by the IT department and needs no board oversight

Explanation

Cyber risk is a material enterprise risk because incidents can produce direct financial loss, regulatory penalties, customer harm and reputational damage. Integrating it into the enterprise risk framework enables consistent identification, measurement, reporting and board oversight. Treating it as purely technical or fully transferable is incorrect.

Question 48Information System Security and Cyber Security Management

Which practice best protects customer data in a bank's mobile banking application against interception while in transit?

  1. Enforcing strong TLS with current cipher suites and certificate validation Correct answer.
  2. Storing the data unencrypted on the handset for faster access
  3. Relying on the mobile operating system's default settings without review
  4. Sending data over plain HTTP to reduce processing overhead

Explanation

Transport encryption using strong TLS with current cipher suites and proper certificate validation protects data in transit from eavesdropping and tampering. Plain HTTP offers no such protection, and unencrypted local storage exposes data at rest. Default settings must be reviewed rather than assumed adequate.

Question 49Information System Security and Cyber Security Management

A bank is implementing multi-factor authentication for its internet banking customers. Which combination correctly constitutes two distinct authentication factors?

  1. A password plus a secret question
  2. A password plus a one-time code generated on a registered mobile device Correct answer.
  3. A PIN plus a password
  4. A password plus a username

Explanation

Multi-factor authentication requires factors from different categories, such as something the user knows (password) and something the user possesses (a registered device generating a one-time code). Combining two knowledge-based secrets or a username with a password stays within a single factor category.

Question 50Information System Security and Cyber Security Management

During a vulnerability assessment, a scanner reports a critical unpatched flaw in an internet-facing server. What should the security team do first?

  1. Disable all logging on the server to reduce noise
  2. Ignore the finding until the next annual audit
  3. Assess exploitability and business impact, then apply the vendor patch or compensating controls within a risk-based timeline Correct answer.
  4. Publish the vulnerability details on the bank's public website

Explanation

Vulnerability management requires triage: confirm the finding, assess exploitability and business impact, and remediate within a defined risk-based timeline, applying compensating controls if patching is delayed. Ignoring findings, disclosing details publicly or disabling logging all increase risk.