I85PREP
⌘ K
FINOS Financial Services Open Source Developer study materials
FINOS Financial Services Open Source Developer study resources

FINOS Financial Services Open Source Developer practice questions

One question at a time. Build your FINOS Financial Services Open Source Developer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Open source fundamentals and governance in financial services

A bank wants to adopt a project hosted by FINOS. Which statement best describes what FINOS is and what it provides?

  1. A vendor consortium that resells commercial trading software
  2. A regulator that approves software used by banks
  3. A standards body that only publishes ISO-style specifications
  4. A foundation under the Linux Foundation that hosts open source projects for financial services Correct answer.

Explanation

FINOS is the Fintech Open Source Foundation, a nonprofit hosted by the Linux Foundation. It provides neutral governance, hosting, and community infrastructure for open source projects aimed at financial services firms. It does not itself regulate, certify, or sell software.

Question 2Open source fundamentals and governance in financial services

An engineer reads the LICENSE file of a FINOS-hosted library and sees the Apache License 2.0. Which permission does that license grant?

  1. Use and modify the code, but only if every derivative is distributed under the identical license
  2. Use the code freely, but only after registering the deployment with the project's maintainers
  3. Use only inside the firm that contributed the code, with no external redistribution allowed
  4. Use, modify, and redistribute the code, including commercially, subject to notice and attribution conditions Correct answer.

Explanation

Apache 2.0 is a permissive license that allows commercial use, modification, and redistribution. It requires preserving notices and license text and grants an express patent license. It does not impose copyleft on derivative works.

Question 3Open source fundamentals and governance in financial services

A firm contributes a patch to a FINOS project and is asked to sign a Contributor License Agreement. What is the primary purpose of that agreement?

  1. To transfer the contributor's employment contract to the foundation
  2. To certify that the contributed code has been penetration-tested by the firm
  3. To guarantee the contributor a seat on the project's technical steering committee
  4. To record the contributor's legal right to submit the code and grant the project sufficient rights to distribute it Correct answer.

Explanation

A CLA documents that the contributor has the authority to submit the contribution and grants the project or foundation a license or copyright assignment. This protects downstream users from provenance disputes. It does not confer governance roles or security certification.

Question 4Open source fundamentals and governance in financial services

A developer wants to contribute a bug fix to a FINOS project and the repository requires a Developer Certificate of Origin instead of a CLA. What must the developer do?

  1. Publish the patch first on a personal blog to establish prior art
  2. Add a Signed-off-by line to each commit certifying the right to submit the code under the project license Correct answer.
  3. Mail a signed paper contract to the Linux Foundation before opening a pull request
  4. Ask their compliance team to countersign the pull request description

Explanation

The DCO is a lightweight per-commit attestation: the contributor adds a Signed-off-by trailer stating they have the right to submit the code under the project's license. It replaces a separate signed agreement. No paper contract or external publication is involved.

Question 5Open source fundamentals and governance in financial services

Which activity is the clearest example of consuming open source in a way that creates an ongoing obligation for a bank?

  1. Attending a community call about a project roadmap
  2. Reading a project's documentation on a public wiki
  3. Embedding an Apache 2.0 library in a distributed client application Correct answer.
  4. Cloning a repository to inspect its source code locally

Explanation

Obligations attach when code is used and especially when it is distributed. Shipping an Apache 2.0 library inside a distributed application triggers notice and license-inclusion duties. Reading docs, attending calls, or local inspection creates no distribution obligation.

Question 6Open source fundamentals and governance in financial services

A team is drafting its open source policy. Which item belongs in a policy governing participation in foundation projects rather than in a general IT security standard?

  1. Rules for employees contributing code upstream under their employer's intellectual property approval Correct answer.
  2. Password complexity requirements for corporate accounts
  3. Physical access controls for the data centre
  4. Encryption standards for data at rest

Explanation

An open source participation policy addresses upstream contribution approvals, CLA or DCO handling, and IP clearance. Password, encryption, and physical access rules belong to general security standards. Mixing them dilutes accountability for open source specific risks.

Question 7Open source fundamentals and governance in financial services

What does an Open Source Program Office typically own in a financial institution?

  1. Setting central bank interest rate policy
  2. Negotiating trading venue memberships
  3. Coordinating open source policy, license compliance, contribution approval, and community engagement Correct answer.
  4. Approving the firm's annual financial statements

Explanation

An OSPO centralises open source strategy and controls: policy, license review, contribution and consumption approval, and engagement with foundations. It is an internal coordination function. It does not perform monetary policy, financial reporting, or market access negotiation.

Question 8Open source fundamentals and governance in financial services

A developer finds a FINOS project whose charter states it operates under neutral foundation governance. What does that imply for a participating bank?

  1. No single vendor or firm controls the project's direction, and decision rights are defined in the charter Correct answer.
  2. The project cannot accept contributions from competitors of the bank
  3. The bank automatically gains a permanent board seat
  4. The bank's legal team must approve every commit by any contributor

Explanation

Neutral governance means no single organisation owns or steers the project unilaterally. Decision-making authority, such as a technical steering committee, is defined in the charter. Participation does not confer automatic board seats or restrict contributions by competitors.

Question 9Open source fundamentals and governance in financial services

A trading platform team wants to donate an internal project to FINOS. Which step is most consistent with foundation contribution practice?

  1. Publish the code on a personal repository and rename it later
  2. Keep the source closed and donate only the documentation
  3. Transfer the code to a single vendor partner who will act as sole owner
  4. Complete IP review and a software grant, then onboard the project with a charter and maintainers under foundation process Correct answer.

Explanation

Donation requires clearing intellectual property, executing a contribution or software grant agreement, and onboarding with a charter, maintainers, and license. This preserves provenance and neutral stewardship. Publishing informally or transferring to a single vendor defeats the purpose.

Question 10Open source fundamentals and governance in financial services

A compliance analyst compares an Apache 2.0 component with a GPLv3 component that will be linked into a distributed application. What is the key difference in obligation?

  1. Apache 2.0 requires notice retention, while GPLv3 can require source disclosure for the combined work when distributed Correct answer.
  2. Both licenses impose identical obligations, so no distinction is needed
  3. Apache 2.0 requires source disclosure of derivative works, while GPLv3 does not
  4. GPLv3 forbids commercial use, while Apache 2.0 permits it

Explanation

Apache 2.0 is permissive and mainly requires notices and license text. GPLv3 is copyleft, so distributing a combined work can require providing corresponding source under GPL terms. Both permit commercial use; the difference lies in reciprocity and source disclosure.

Question 11Open source fundamentals and governance in financial services

A bank releases an internal tool as open source under a permissive license but wants to retain patent protection against contributors who sue over patents. Which license feature addresses this?

  1. A warranty disclaimer limiting liability
  2. A patent retaliation or termination clause that withdraws patent grants from parties filing patent suits Correct answer.
  3. A notice file listing all previous contributors
  4. A trademark clause restricting use of the project name

Explanation

Patent retaliation clauses, present in licenses such as Apache 2.0, terminate patent grants if a licensee sues alleging patent infringement over the software. This deters aggressive patent litigation. Trademark, warranty, and notice provisions address different concerns.

Question 12Open source fundamentals and governance in financial services

A firm embeds a copyleft-licensed library into a proprietary risk engine and distributes the engine to clients. Why is this a governance concern?

  1. Because distribution may trigger obligations to make the corresponding source of the combined work available under the same license Correct answer.
  2. Because copyleft licenses prohibit use in financial services
  3. Because the firm must obtain a commercial license from FINOS
  4. Because the library's maintainers must be paid a royalty

Explanation

Copyleft obligations attach on distribution, potentially requiring source availability for the combined work under the same terms. That can conflict with proprietary distribution models. Copyleft licenses do not ban financial use, require royalties, or route through FINOS licensing.

Question 13Open source fundamentals and governance in financial services

During due diligence, a bank discovers a component labelled open source but with no license file and an ambiguous README. What is the appropriate governance response?

  1. Treat it as unlicensed and block or escalate until rights are clarified with the author Correct answer.
  2. Use it internally only, which removes all legal risk
  3. Assume it is MIT-licensed because that is the most common license
  4. Copy the code into an internal repository and add an Apache 2.0 header

Explanation

Absent a license, default copyright applies and no rights are granted, even for internal use. The safe response is to treat the code as unlicensed and escalate for clarification. Assuming a license or self-assigning one is unauthorised.

Question 14Open source fundamentals and governance in financial services

A contributor submits a pull request that copies code from a blog post with no stated license. How should maintainers of a FINOS project respond?

  1. Request removal or replacement of the copied code until provenance and licensing are established Correct answer.
  2. Merge it and rely on the DCO sign-off as proof of rights
  3. Merge it but remove the author's name from the commit history
  4. Ask the contributor to relicense the blog content as Apache 2.0 on the project's behalf

Explanation

Code without a license cannot be safely incorporated, and a DCO sign-off does not cure third-party rights issues. Maintainers should require removal or replacement until provenance is clear. They cannot relicense someone else's content.

Question 15Open source fundamentals and governance in financial services

A project hosted at FINOS wants to change its license from Apache 2.0 to a copyleft license. What is the governance-sound approach?

  1. Let any single maintainer change the LICENSE file in a commit
  2. Follow the project charter and obtain consent from copyright holders and the governing body before relicensing Correct answer.
  3. Relicense silently and update the documentation in the next release
  4. Ask the foundation's marketing team to announce the change after it is merged

Explanation

Relicensing requires authority from copyright holders and adherence to the project's charter and foundation process. Unilateral or silent changes undermine contributor trust and may be legally invalid. Announcement is a communication step, not an approval mechanism.

Question 16Open source fundamentals and governance in financial services

Which pair correctly matches a FINOS-style governance artefact with its function?

  1. Charter - holds meeting minutes; CODEOWNERS - defines the project's funding model
  2. Charter - lists software dependencies; CODEOWNERS - records license obligations
  3. Charter - defines the license text; CODEOWNERS - stores contributor tax details
  4. Charter - records the project's scope, roles, and decision process; CODEOWNERS - identifies reviewers for paths in the repository Correct answer.

Explanation

A charter sets scope, roles, and decision-making, while CODEOWNERS maps repository paths to required reviewers. These are distinct governance and review mechanisms. Dependency lists, license text, tax data, and funding models live elsewhere.

Question 17Open source fundamentals and governance in financial services

A bank's security team wants to know which open source components are in a trading application. Which practice best supports ongoing open source governance?

  1. Generating a software bill of materials from the build and monitoring it for license and vulnerability changes Correct answer.
  2. Reviewing dependencies once at go-live and never again
  3. Blocking all third-party libraries from the build
  4. Relying on developers to remember which libraries they added

Explanation

An SBOM generated from the build gives an inventory of components and versions that can be continuously monitored. Governance requires ongoing visibility as dependencies change. Manual recall, one-off review, or blanket bans are weak or impractical controls.

Question 18Open source fundamentals and governance in financial services

A contributor wants to use a project's name and logo in a conference talk about the FINOS-hosted project. What is the usual expectation?

  1. Trademarks are never usable in community contexts
  2. The contributor must purchase a trademark license from the foundation
  3. Trademark rights are automatically granted by the code license, so no care is needed
  4. Open source licenses typically do not grant trademark rights, so use should follow the project's or foundation's trademark policy Correct answer.

Explanation

Code licenses generally exclude trademark grants, so names and logos are governed by separate trademark policies. Descriptive, non-endorsing use is often permitted, but the policy controls. No automatic grant or purchase is involved.

Question 19Open source fundamentals and governance in financial services

A bank wants to influence the roadmap of a FINOS project it depends on. Which approach aligns with open source community norms?

  1. Contact the foundation's board and demand a roadmap change
  2. Fork the project privately and never share improvements
  3. Submit an issue with a clear use case, contribute code or tests, and participate in the project's technical discussions Correct answer.
  4. Threaten to remove the project from the bank's stack unless changes are made

Explanation

Influence in open source comes from constructive participation: well-argued issues, contributions, and engagement in technical forums. Escalation, private forking without contribution, or ultimatums do not build consensus. Foundations coordinate rather than dictate technical roadmaps.

Question 20Open source fundamentals and governance in financial services

A firm's open source policy requires approval before employees contribute upstream. Which rationale best justifies that control?

  1. It ensures contributions do not disclose confidential information or create unintended IP or contractual exposure Correct answer.
  2. It removes the need for any license review of consumed software
  3. It prevents employees from learning new technologies
  4. It guarantees the firm will own the contributor's future work

Explanation

Upstream contribution approval protects against leaking proprietary information and against IP or contractual entanglements such as employer ownership or client obligations. It is a risk control, not a barrier to learning. It does not replace consumption-side license review.

Question 21Open source fundamentals and governance in financial services

A FINOS project's maintainers receive a security report describing a remotely exploitable flaw in a payment messaging library. Which response best reflects responsible open source practice?

  1. Remove the repository without notifying downstream users
  2. Acknowledge privately, prepare and coordinate a fix and advisory with reporters under a disclosure policy, then publish Correct answer.
  3. Ignore the report until a customer complains
  4. Publish the exploit details immediately so users can patch themselves

Explanation

Coordinated vulnerability disclosure gives maintainers time to prepare a fix and advisory before public details. This reduces exploitation risk for downstream financial institutions. Immediate full disclosure, inaction, or silent removal harms users.

Question 22Open source fundamentals and governance in financial services

A bank consumes a FINOS project that is popular but has one active maintainer and no recent releases. How should governance treat this?

  1. Record it as a sustainability risk and plan for contingency such as internal capability, fork readiness, or replacement Correct answer.
  2. Assume the foundation will automatically staff maintainers
  3. Immediately delete the dependency from production without analysis
  4. Popularity guarantees long-term support, so no action is needed

Explanation

Sustainability risk arises when a critical dependency depends on very few maintainers or shows low activity. Governance should record the risk and plan contingencies such as internal expertise, fork readiness, or alternatives. Popularity, abrupt removal, or assumed staffing are not adequate responses.

Question 23Open source fundamentals and governance in financial services

A firm publishes an internal standard as an open specification under a FINOS project. Which governance consideration is most specific to specifications rather than to code?

  1. Ensuring the specification's patent and copyright licensing terms allow implementers to build interoperable products Correct answer.
  2. Selecting the code review tool
  3. Setting the branch protection rules for the repository
  4. Choosing the continuous integration runner

Explanation

Open specifications need clear copyright and patent licensing so implementers can build compatible products without legal uncertainty. CI runners, branch protection, and review tooling are code-hosting mechanics. The licensing of the specification itself is the distinctive governance issue.

Question 24Open source fundamentals and governance in financial services

An OSPO wants to measure whether its open source programme is effective. Which set of indicators is most meaningful?

  1. Number of meetings held and count of slide decks produced
  2. Count of approved contributions, time to license review, inventory coverage of SBOMs, and resolved policy exceptions Correct answer.
  3. Total lines of code in public repositories and number of social media followers
  4. Number of employees who have heard of open source and total office floor space

Explanation

Effective indicators tie to governance outcomes: contribution throughput, review cycle time, SBOM coverage, and exception handling. These show whether controls operate and whether participation delivers value. Vanity or activity metrics do not demonstrate control effectiveness.

Question 25Open source fundamentals and governance in financial services

A bank uses a component under a license with a field-of-use restriction limiting use to non-commercial purposes. How does this differ from an OSI-approved open source license?

  1. OSI-approved licenses must permit commercial use and must not discriminate against fields of endeavour, so this component is not open source Correct answer.
  2. The restriction only applies outside financial services
  3. There is no difference, because all public source code is open source
  4. The restriction is automatically void because the code is on a public repository

Explanation

The Open Source Definition requires no discrimination against persons, groups, or fields of endeavour, which includes commercial use. A non-commercial field-of-use restriction therefore falls outside OSI-approved open source. Public availability alone does not make software open source.

Question 26Open source fundamentals and governance in financial services

A fintech startup joins FINOS and wants its engineers to contribute upstream to foundation-hosted projects. Which arrangement reflects standard open source governance practice?

  1. Contributions are made anonymously so the firm avoids any public association with the project
  2. The startup's legal team sends a bilateral contract to each maintainer before any pull request is opened
  3. The firm's board must ratify every line of code merged into a foundation repository
  4. Engineers sign the project's Contributor License Agreement or DCO and contribute as individuals under the project's charter Correct answer.

Explanation

Foundation projects normally require contributors to accept the project's contribution terms, typically a CLA or a Developer Certificate of Origin, and to follow the project charter and contribution guidelines. Contributions are public and reviewed by maintainers through the project's normal workflow, not through private bilateral contracts.

Question 27Open source fundamentals and governance in financial services

A risk analyst is asked to explain why FINOS projects are described as vendor-neutral. Which statement best captures the governance meaning of neutrality?

  1. The foundation guarantees that no commercial product will ever be built on top of the project's code
  2. No single member firm controls the project roadmap, and technical decisions follow the project's documented meritocratic process Correct answer.
  3. Neutrality is a marketing label with no effect on how maintainers are appointed or how releases are approved
  4. Vendor neutrality means the code may only be used by financial institutions and not by technology vendors

Explanation

Neutral governance means control of the project sits with the foundation and its documented decision process rather than with one sponsoring firm. Commercial use is fully permitted, including by vendors, so neutrality constrains control, not adoption.

Question 28Open source fundamentals and governance in financial services

An engineer asks which document in a foundation-hosted project defines the project's scope, decision-making rules and the role of the technical steering committee. Which artefact should they consult?

  1. The organisation's internal source code review checklist
  2. The repository's SECURITY.md file
  3. The project charter Correct answer.
  4. The foundation's annual financial report

Explanation

A project charter records scope, governance bodies, decision rules and how leadership is chosen, so it is the authoritative governance document. Security policies, financial reports and internal checklists serve other purposes.

Question 29Open source fundamentals and governance in financial services

A bank's open source program office wants a single, auditable record of every third-party component and version shipping in a payments service. Which practice most directly produces that record?

  1. Requiring engineers to record dependencies manually in a spreadsheet each quarter
  2. Reviewing the repository's README before each production release
  3. Relying on the vendor's marketing page to list the frameworks it uses
  4. Generating a software bill of materials from the build with automated dependency scanning Correct answer.

Explanation

A machine-generated SBOM tied to the build pipeline gives version-level, reproducible inventory that can be audited and re-generated per release. Manual or informal sources drift and cannot reliably support vulnerability response.

Question 30Open source fundamentals and governance in financial services

A maintainer of a FINOS-hosted project receives a pull request that adds a new public API. The charter states that significant architectural changes require lazy consensus on the project's public mailing list. What should the maintainer do first?

  1. Ask the contributor to send the design privately to the sponsor bank's architects
  2. Raise the proposal on the public list and allow the documented review period before merging Correct answer.
  3. Merge immediately because the contributor has signed the CLA
  4. Reject the change because API additions are outside maintainer authority

Explanation

Where the charter requires lazy consensus for significant changes, the maintainer must follow that process, which means public proposal and an opportunity for objections within the stated period. A signed CLA addresses IP provenance only and does not substitute for the governance process.

Question 31Open source fundamentals and governance in financial services

A firm wants to reuse code from a foundation project in a proprietary analytics product. The project is licensed under Apache 2.0. Which obligation must the firm satisfy when distributing the product?

  1. Remove all copyright headers so the combined work appears wholly proprietary
  2. Publish the firm's own analytics source code under Apache 2.0 as well
  3. Obtain written permission from every past contributor to the project
  4. Retain the license and attribution notices and include a copy of the license with the distribution Correct answer.

Explanation

Apache 2.0 is permissive: it allows proprietary combination but requires preservation of notices and delivery of the license text, and it includes a patent grant and termination clause. It does not require the licensee's own code to be opened.

Question 32Open source fundamentals and governance in financial services

A contributor wants to add a dependency licensed under a copyleft license to a FINOS project distributed under Apache 2.0. What is the governance-sound first step?

  1. Fork the project immediately and continue work in a private repository
  2. Add the dependency quietly because dependency licences are not part of project governance
  3. Assess compatibility with the project's outbound license and raise the question with maintainers before merging Correct answer.
  4. Replace the project's license with the copyleft license to accommodate the dependency

Explanation

Introducing a dependency can change the effective licensing of distributions, so compatibility with the project's outbound license must be assessed and the decision taken through the project's public process. Unilateral licence changes or silent additions undermine both legal clarity and neutral governance.

Question 33Open source fundamentals and governance in financial services

A bank employee wants to contribute a small bug fix to a FINOS project during working hours. Under a typical corporate open source policy, which condition most commonly applies before the pull request is opened?

  1. A guarantee that the bank will be granted committer status in exchange for the fix
  2. Manager or OSPO approval confirming the work relates to company use and carries no confidential content Correct answer.
  3. A public statement that the bank does not use the project commercially
  4. Transfer of the contributor's employment IP agreement to the foundation

Explanation

Corporate policies typically require internal approval so the firm can confirm the contribution is within its interests, contains no confidential material and complies with the project's CLA or DCO. Approval does not buy governance rights, and employment agreements remain with the employer.

Question 34Open source fundamentals and governance in financial services

A project hosted at FINOS has a public roadmap. A bank depends on the project and wants a feature prioritised. Which action is most consistent with open source governance?

  1. Ship a local patch and stop reporting issues upstream
  2. Contact the foundation's board to instruct maintainers to build the feature
  3. Submit a well-scoped proposal and offer engineering time to implement and test the feature upstream Correct answer.
  4. Privately pay a maintainer to add the feature without telling the community

Explanation

Influence in neutral projects comes from contributing proposals, code and review effort in public, which lets maintainers and other users evaluate the change on its merits. Directing maintainers through the board or covertly paying individuals conflicts with transparent governance.

Question 35Open source fundamentals and governance in financial services

A bank is evaluating a foundation project for a trade reporting pipeline. The project has one active maintainer, no release in eighteen months and no published security policy. Which governance response is most appropriate?

  1. Treat maintainer concentration and release cadence as supply chain risk, and plan mitigation such as internal patching capacity or a fork strategy Correct answer.
  2. Adopt the project without further review because foundation hosting implies the foundation maintains the code
  3. Require the maintainer to transfer commit rights to the bank before adoption
  4. Assume the project is abandoned and prohibit any use in production systems

Explanation

Foundation hosting provides neutral governance and IP hygiene but does not guarantee maintainer capacity or release activity. Consumers should assess bus factor, release cadence and security responsiveness, then plan mitigation such as internal expertise, patching or a fork.

Question 36Open source fundamentals and governance in financial services

An OSPO is choosing metrics to report to senior management on the effectiveness of the firm's open source programme. Which set of indicators is most meaningful?

  1. Count of employees who have starred foundation repositories
  2. Number of open source licences the firm has read about in the past year
  3. Total lines of code in public repositories and number of conference talks given
  4. Upstream contributions merged, critical projects with named internal owners, time to remediate known vulnerabilities, and policy exceptions tracked to closure Correct answer.

Explanation

Effective OSPO reporting links activity to risk and value: upstream influence, ownership of critical dependencies, remediation speed and controlled exceptions. Volume metrics such as lines of code or stars measure visibility rather than programme outcomes.

Question 37Open source fundamentals and governance in financial services

A foundation project's maintainers receive a private report of a remotely exploitable flaw in a component used by several banks. Which sequence best follows coordinated vulnerability disclosure?

  1. Forward the report to the largest sponsor bank and let it decide on disclosure
  2. Acknowledge privately, develop and test a fix with the reporter, agree a disclosure date, then publish an advisory with a CVE and notify downstream consumers Correct answer.
  3. Keep the report private indefinitely until every downstream bank has patched
  4. Publish the details immediately on the public issue tracker so users can protect themselves

Explanation

Coordinated disclosure gives maintainers time to prepare a fix while limiting attacker advantage, then publishes an advisory with an identifier so downstream consumers can act. Immediate publication or indefinite silence both harm users.

Question 38Open source fundamentals and governance in financial services

A firm publishes an internal data model as an open specification hosted under a FINOS project. Which governance consideration most distinguishes an open specification from an open source code release?

  1. Only foundation members may read the specification until it is ratified
  2. The specification needs a licence granting implementation rights plus a clear patent and versioning policy so vendors can implement it without fear of encumbrance Correct answer.
  3. The specification automatically becomes public domain once it is hosted by a foundation
  4. The specification must be accompanied by a reference implementation or it cannot be considered open

Explanation

Open specifications succeed when implementers know they can build compatible products, which requires an appropriate licence, a patent posture such as a royalty-free grant, and a versioning and change process. A reference implementation is helpful but not a precondition for openness.

Question 39Open source fundamentals and governance in financial services

A bank's legal team finds a component described as open source but licensed with a field-of-use restriction limiting it to non-commercial research. How should the firm treat it under its open source policy?

  1. Treat it as not open source under the Open Source Definition and require an exception or alternative component before use in commercial systems Correct answer.
  2. Accept it because the source code is publicly available on a repository host
  3. Use it freely in production provided the firm does not sell the software directly
  4. Include it only if the restriction is documented in the SBOM

Explanation

The Open Source Definition forbids discrimination against fields of endeavour, so a non-commercial restriction disqualifies the licence from being open source. Public availability of source code alone does not make a licence open source, and documenting a restriction does not remove it.

Question 40Open source fundamentals and governance in financial services

A FINOS project's maintainers want to move from a single maintainer to a documented meritocratic model as adoption grows. Which change best strengthens neutral governance without altering the licence?

  1. Keep maintainer selection informal so the foundation cannot influence technical decisions
  2. Grant commit rights only to engineers from the founding sponsor bank to preserve continuity
  3. Require new maintainers to sign an exclusive commercial agreement with the project's largest user
  4. Adopt written contributor and committer guidelines with public nomination and consensus-based approval of new maintainers Correct answer.

Explanation

Documented, public pathways for earning commit rights and consensus-based approval spread control and make succession predictable, which is the substance of meritocratic neutral governance. Restricting rights to one sponsor or to commercial allies reintroduces the vendor control that neutrality is meant to prevent.

Question 41FINOS and the financial services open source ecosystem

Which body publishes the specification that defines how FDC3 context data is structured and shared between financial desktop applications?

  1. The W3C Web Applications Working Group
  2. The ISO TC68 securities committee
  3. The Basel Committee on Banking Supervision
  4. The FINOS FDC3 Program under the FDC3 standard maintainers Correct answer.

Explanation

FDC3 is a FINOS-hosted open standard, and its specification is developed and versioned by the FDC3 program within FINOS. ISO TC68 and W3C work on other standards, and the Basel Committee issues prudential banking rules rather than desktop interoperability specs.

Question 42FINOS and the financial services open source ecosystem

In FDC3, what is the primary role of an app directory?

  1. It encrypts inter-application messages on the desktop bus
  2. It publishes metadata describing applications and the intents they handle Correct answer.
  3. It stores the app's compiled binaries for distribution
  4. It reconciles trades against clearing house records

Explanation

An FDC3 app directory is a service that exposes application metadata, including supported intents and context types, so a desktop agent can resolve intent requests. It does not host binaries, provide encryption, or perform trade reconciliation.

Question 43FINOS and the financial services open source ecosystem

A developer wants to raise an FDC3 intent so that any capable application on the desktop can respond. Which API call best matches that goal?

  1. fdc3.raiseIntent with the intent name and context Correct answer.
  2. fdc3.broadcast with the intent payload
  3. fdc3.getInfo to read the agent version
  4. fdc3.addContextListener with a context type

Explanation

raiseIntent asks the desktop agent to find and launch a target application that can handle the named intent with the supplied context. broadcast distributes context without targeting an intent handler, addContextListener only receives context, and getInfo returns agent metadata.

Question 44FINOS and the financial services open source ecosystem

What does the FINOS Open Source Readiness initiative primarily help financial institutions do?

  1. Replace all proprietary software with GPL-licensed alternatives
  2. Assess and improve their ability to consume and contribute to open source Correct answer.
  3. Certify trading algorithms for regulatory approval
  4. Host customer data in FINOS-managed cloud regions

Explanation

Open Source Readiness provides guidance, scorecards, and community practices that help firms adopt open source safely and contribute effectively. It is not a trading algorithm certification, a mandate to use copyleft software, or a data hosting service.

Question 45FINOS and the financial services open source ecosystem

Which license is a common permissive choice for code contributed to FINOS-hosted projects because it allows reuse in proprietary products with attribution?

  1. Creative Commons BY-NC-ND 4.0
  2. Server Side Public License
  3. Apache License 2.0 Correct answer.
  4. GNU Affero General Public License v3.0

Explanation

Apache License 2.0 is permissive, includes an express patent grant, and permits use in proprietary distributions provided notices are kept. AGPL and SSPL impose strong copyleft or service obligations, and CC BY-NC-ND forbids commercial use and derivatives.

Question 46FINOS and the financial services open source ecosystem

In the FDC3 context data model, what best describes a context object?

  1. A SOAP envelope containing a WSDL reference
  2. A binary blob encrypted with the desktop agent's key
  3. A JSON object with a type property and associated data fields Correct answer.
  4. A CSV row keyed by instrument identifier

Explanation

FDC3 context objects are JSON structures that carry a type field identifying the context type plus the data fields defined for that type. They are not encrypted blobs, SOAP envelopes, or CSV records.

Question 47FINOS and the financial services open source ecosystem

What is the main purpose of the FINOS Common Cloud Controls project?

  1. To provide a managed Kubernetes distribution for banks
  2. To publish reference implementations of FDC3 desktop agents
  3. To define a shared set of cloud security control requirements mapped to multiple regulatory frameworks Correct answer.
  4. To standardize equity trade settlement cycles

Explanation

Common Cloud Controls aims to express cloud service security controls once and map them to several regulatory and industry frameworks, reducing duplicated assurance work. It is not a Kubernetes distribution, a settlement rulebook, or an FDC3 implementation project.

Question 48FINOS and the financial services open source ecosystem

A firm wants to contribute an internal project to FINOS. Which step is normally required before the project can be hosted as a FINOS project?

  1. Transferring all trademarks to a commercial cloud vendor
  2. Removing all documentation to avoid liability
  3. Rewriting the codebase in a FINOS-mandated programming language
  4. Completing contribution and license review, including a software grant or contributor license agreement Correct answer.

Explanation

FINOS hosting requires legal and license review plus appropriate contribution agreements so the project's IP status is clear to consumers. There is no mandated language, trademarks are not handed to a cloud vendor, and documentation is expected rather than removed.

Question 49FINOS and the financial services open source ecosystem

In FDC3, which component is responsible for resolving intent requests and managing communication between applications on a user's desktop?

  1. The identity provider
  2. The context type registry
  3. The desktop agent Correct answer.
  4. The app directory service

Explanation

The desktop agent is the runtime component that brokers intents, channels, and context between applications. App directories supply metadata, the context type registry defines schemas, and identity providers handle authentication.

Question 50FINOS and the financial services open source ecosystem

A development team needs a context type for a fixed income instrument that is not covered by the FDC3 standard types. What is the recommended approach?

  1. Encode the data as a plain string in the fdc3.contact type
  2. Define a custom context type with a namespaced type name and publish its schema Correct answer.
  3. Avoid context sharing and hard-code the data in each application
  4. Reuse the fdc3.instrument type and overload its fields with custom meanings

Explanation

FDC3 supports custom context types identified by namespaced type names, with schemas published so other applications can interoperate. Overloading standard types or abusing unrelated types breaks interoperability, and hard-coding defeats the purpose of context sharing.