Attempt CAIIB IT and Digital Banking Module C Quiz & Download PDF

1. In the context of NPCI’s Unified Payments Interface (UPI), which of the following correctly describes the role of a Payment Service Provider (PSP) bank as distinguished from a remitter bank?

The PSP bank is the bank where the beneficiary maintains their account
The PSP bank solely processes IMPS-based fund transfers for UPI transactions
The PSP bank provides the UPI application interface and handles authentication, while the remitter bank holds the payer’s account
The PSP bank acts as the settlement bank for all interbank UPI transactions

2. A bank is evaluating its Core Banking Solution (CBS) for upgrade. Which of the following architectural features of a CBS distinguishes it from a traditional branch-level banking system?

CBS processes transactions only during banking hours and stores data locally at each branch
CBS uses a centralised database with real-time processing, enabling any-branch, any-time banking
CBS requires separate database servers at each branch for redundancy and disaster recovery
CBS operates exclusively on a mainframe architecture and does not support web-based interfaces

3. Under the IT Act 2000, Section 43 deals with penalties for damage to computer systems. Which of the following activities is covered specifically under Section 43(b)?

Introducing any computer contaminant or computer virus into a computer system
Downloading, copying, or extracting data from a computer without authorisation
Tampering with computer source documents
Publishing obscene material in electronic form

4. In the MICR (Magnetic Ink Character Recognition) cheque clearing system, which band of the MICR line on a cheque contains the cheque serial number?

Bank Code Field
Account Number Field
Transaction Code Field
Cheque Number Field

5. In the context of Digital Rights Management (DRM) under the IT Act framework, which of the following correctly describes the concept of ‘technological protection measures’ (TPM)?

Physical locks and security devices used to protect bank ATM machines
Encryption or access controls used by copyright holders to prevent unauthorised use of digital content
RBI-mandated firewalls for protecting banking networks from cyberattacks
Biometric authentication systems deployed at bank branch entry points

6. Which of the following accurately describes the role of a ‘Payment Gateway’ in an e-commerce transaction as opposed to a ‘Payment Aggregator’?

A payment gateway settles funds directly into the merchant’s bank account while a payment aggregator only routes transaction data
A payment gateway provides the technology infrastructure for routing transaction data securely between parties, while a payment aggregator collects payments from multiple merchants and settles them
A payment gateway is regulated exclusively by SEBI, whereas a payment aggregator is regulated by RBI
A payment gateway holds merchant funds in escrow for up to 90 days before settlement

7. SFMS (Structured Financial Messaging System) is used in Indian banking for secure interbank messaging. Which of the following is the PRIMARY distinguishing feature of SFMS compared to ordinary email communication?

SFMS supports multimedia file attachments while email does not
SFMS operates only within the same bank’s branch network and cannot be used for interbank messages
SFMS provides PKI-based message authentication, non-repudiation, and integration with CBS for financial transactions
SFMS is exclusively used for SWIFT international wire transfers and not for domestic transactions

8. Under RBI’s framework on Card Tokenisation, which entity is authorised to perform tokenisation of card data for a given merchant or device?

Only the card network (Visa, Mastercard, RuPay) acting as Token Service Provider (TSP)
The acquiring bank of the merchant
Any NBFC registered with SEBI for payment processing
The issuing bank of the cardholder independently without card network involvement

9. In the context of Open Banking and APIs in India, what is the PRIMARY purpose of the Account Aggregator (AA) framework launched by RBI?

To allow banks to share customer data with advertisers for targeted marketing
To consolidate all bank accounts of a customer into a single account at a designated bank
To provide insurance companies direct access to customer transaction data without consent
To enable consent-based sharing of financial data between financial information providers and users through a regulated intermediary

10. Which of the following correctly describes a ‘Smart Card’ as distinct from a regular magnetic stripe debit card?

Smart cards can only be used at ATMs and not at POS terminals
Smart cards contain an embedded microprocessor chip that can process data and store information securely, enabling dynamic authentication
Smart cards use radio frequency for long-range transmission of card data up to 100 metres
Smart cards store cardholder data only in plaintext format for easy merchant access

11. The NEFT system in India was migrated to a 24×7 basis in December 2019. Prior to that, what was the settlement mechanism used in NEFT transactions?

Deferred net settlement in hourly batches during business hours on working days
Real-time individual gross settlement similar to RTGS
T+2 rolling settlement similar to equity market transactions
End-of-day gross settlement processed by SWIFT messaging

12. In the context of cyber security for banking, which attack vector does a ‘SQL Injection’ exploit in web-based banking applications?

Physical interception of network cables to extract transmitted data
Overloading a bank’s server with excessive traffic to cause service disruption
Malicious SQL code inserted through input fields to manipulate or gain unauthorised access to the backend database
Installing keyloggers on customer devices through phishing emails

13. Under the IT Act 2008 amendment, Section 66F defines cyber terrorism. Which of the following scenarios would be classified under Section 66F?

A hacker defacing a bank’s website to display offensive content
An individual penetrating critical infrastructure systems with intent to threaten India’s unity, integrity, or security, or to strike terror
An employee stealing customer data and selling it to competitors
A person sending offensive messages through a communication service

14. In e-learning, SCORM (Sharable Content Object Reference Model) is widely used as a technical standard. What is the PRIMARY purpose of SCORM in a Learning Management System (LMS)?

To provide a standardised programming language for developing banking software applications
To encrypt e-learning content to prevent unauthorised access by non-enrolled users
To provide a standardised interface for video conferencing in virtual classrooms
To ensure interoperability — allowing e-learning content to be developed once and deployed across different LMS platforms

15. A bank is implementing a Disaster Recovery (DR) strategy for its CBS. The RTO (Recovery Time Objective) is set at 4 hours. Which DR configuration best satisfies this requirement?

Cold standby site where servers are available but not powered on — requires manual installation and configuration
Warm standby site with pre-configured servers and regular data replication with near-real-time synchronisation
Data backup on magnetic tapes stored in a vault 500 km away with weekly backup schedule
Paper-based manual backup procedures without any IT infrastructure at the DR site

16. The RuPay card network is India’s domestic card scheme. What is the PRIMARY advantage of RuPay over Visa/Mastercard for Indian banks in terms of transaction economics?

RuPay cards can be used internationally across all SWIFT member countries without any processing fees
Transaction processing fees for RuPay cards are significantly lower as interchange and switching fees remain within India through NPCI infrastructure
RuPay mandates zero interest rates on credit card outstanding balances by regulatory directive
RuPay cards are the only cards accepted at government-owned ATMs in India

17. In the context of Blockchain technology applied to banking, which of the following correctly distinguishes a ‘permissioned blockchain’ from a ‘permissionless blockchain’?

Permissioned blockchains are always more secure than permissionless blockchains due to cryptographic encryption
In a permissioned blockchain, participation is restricted to pre-approved nodes, offering controlled access and governance, unlike permissionless blockchains where anyone can join
Permissioned blockchains use Proof-of-Work consensus exclusively while permissionless blockchains use Proof-of-Stake
Permissioned blockchains store data in plaintext while permissionless blockchains always encrypt all data

18. In SET (Secure Electronic Transaction) protocol used for e-commerce card payments, what is the role of ‘dual signature’?

Linking the customer’s payment information (sent to bank) and order information (sent to merchant) such that each party sees only what they need, while the linkage is verifiable
Requiring two bank officers to digitally sign every e-commerce transaction for authorisation
Requiring both Visa and Mastercard to authenticate a transaction simultaneously for added security
A second digital signature applied after the first signature expires within 60 seconds

19. Under RBI’s guidelines on internet banking, banks are required to implement ‘transaction monitoring’ as a security control. Which of the following best describes the purpose of this control?

Recording all customer keystrokes during internet banking sessions for legal audit purposes
Limiting the number of internet banking sessions a customer can initiate per day
Monitoring employee internet usage to prevent data exfiltration during office hours
Detecting anomalous or suspicious transaction patterns in real-time to identify potential fraud or unauthorised access

20. In the context of cloud computing for banking, which deployment model is specifically recommended by RBI for storing sensitive customer data and core banking functions?

Public cloud hosted on foreign cloud service providers’ infrastructure for maximum cost efficiency
Private cloud or community cloud with data localisation compliance, as RBI mandates payment data to be stored only in India
Multi-cloud approach where data is distributed equally across US, Europe, and Asia data centres
Hybrid cloud where 100% of data must be stored internationally for global redundancy