Test Your NISM-IFSCA-02B: Security and Cyber Resilience in the GIFT IFSC (Advanced) Mock Test Knowledge in 5 Minutes

1. A brokerage encrypts client records, hashes transaction logs, and maintains failover servers. The three CIA properties these controls respectively serve are:

A. Confidentiality, integrity, availability B. Integrity, availability, confidentiality C. Availability, confidentiality, integrity D. Confidentiality, availability, integrity

2. A customer disputes having authorised a high-value transfer, but the bank produces a cryptographically signed transaction record proving the customer’s action. The security principle at work is:

A. Authorisation B. Least privilege C. Non-repudiation D. Availability

3. A security control doubles transaction processing time, causing settlement delays that breach service commitments. The information attribute compromised by the control is:

A. Confidentiality B. Efficiency C. Non-repudiation D. Exposure

4. A bank’s data centre sits on the seashore. Flood risk before any controls is X, and after relocating backups inland and installing barriers, some flood risk remains, and management accepts it. X and the remainder are, respectively:

A. Residual and inherent risk B. Exposure and appetite C. Aggregated and tolerated risk D. Inherent and residual risk

5. Management states the firm can tolerate at most four hours of core banking unavailability, well below the overall level of risk it is willing to run in pursuit of growth. The four-hour limit and the overall level are, respectively:

A. Risk tolerance and risk appetite B. Risk appetite and risk tolerance C. Risk profile and risk aggregation D. Impact and exposure

6. During design review of a payment API, the team tests each component against spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. The framework in use is:

A. MITRE ATT&CK B. STRIDE C. PCI DSS D. ISO 31000

7. An organisation insures against cyber losses while also deploying an intrusion detection system, and accepts what remains. The risk responses combined are:

A. Avoid and accept B. Avoid and mitigate C. Transfer, mitigate, and accept D. Accept only

8. A financial-sector entity asks which framework function in NIST CSF 2.0 houses cyber security strategy, oversight, and accountability, and what is new about it. The answer is:

A. Identify, unchanged since CSF 1.1 B. Protect, renamed in 2.0 C. Detect, expanded in 2.0 D. Govern, introduced as a sixth function in CSF 2.0 cutting across the others

9. An FMI’s board asks what recovery objective the CPMI-IOSCO cyber resilience guidance sets for critical operations after a disruption. The answer is:

A. Twenty-four hours B. Two hours C. Five days D. No stated objective

10. A firm’s IT head configures firewalls, approves his own firewall rule changes, and certifies annually to the board that network controls are effective. The three lines of defence principle violated is:

A. Separation of first-line ownership from second-line oversight and third-line assurance B. The requirement that all controls be technical C. The requirement that the board operate controls directly D. The requirement to outsource internal audit