You’re on a roll
Create a free account to save your CTP progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CTP › Financial, Regulatory and Operational Risk
Free CTP Financial, Regulatory and Operational Risk Practice Questions & Answers
150 exam-style Financial, Regulatory and Operational Risk questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 151
Payee positive pay adds which capability beyond standard positive pay?
Select an option first.
Correct answer: C — It verifies the payee name on the check against the issue file, not just the check number and amount
Explanation: Standard positive pay matches serial number and amount; payee positive pay additionally compares the payee name to the issued file, catching fraud where a check is altered to change the payee while keeping the amount unchanged. It does not affect funds availability or eliminate reconciliation.
Question 152
Under UCC Article 4A, if a bank and its customer agreed to a commercially reasonable security procedure for wire transfers and the bank followed it in good faith, a fraudulent payment order that the customer did not actually authorize is generally:
Select an option first.
Correct answer: C — Effective against the customer (the customer bears the loss) if the order was verified per the agreed procedure
Explanation: UCC Article 4A allocates loss based on security procedures: if the bank and customer agreed to a commercially reasonable procedure and the bank accepted the order in good faith and in compliance with it, the order is treated as authorized and the customer bears the loss. This underscores why customers must adopt and follow strong verification controls.
Question 153
Which combination of controls most effectively mitigates the risk that a single treasury employee both creates a fictitious vendor and pays it?
Select an option first.
Correct answer: C — Segregation of duties between vendor master maintenance and payment approval, plus periodic independent vendor audits
Explanation: Fictitious-vendor fraud is defeated by separating the ability to add or change vendors from the ability to approve payments, reinforced by independent review of the vendor master file. Risk-measurement tools and limit changes do not address this internal control gap.
Question 154
A treasury team maintains a single banking relationship and one authorized signer who works from one office. From a continuity perspective, the biggest weakness is:
Select an option first.
Correct answer: B — Multiple single points of failure in banking, authorization, and location
Explanation: Relying on one bank, one signer, and one location creates several single points of failure: any one being unavailable could halt payments and cash access. Resilient treasury design uses backup banks, multiple cross-trained authorized signers, and geographically dispersed access.
Question 155
Why is periodic testing (for example, tabletop exercises and failover tests) an essential part of a treasury business continuity plan?
Select an option first.
Correct answer: D — Because an untested plan may contain gaps, outdated contacts, or unworkable steps that only surface under simulated stress
Explanation: Plans degrade as personnel, systems, and vendors change, so untested plans often fail when actually needed. Regular exercises reveal outdated contact lists, broken dependencies, and unrealistic recovery steps, allowing correction before a real event.
Get the full CTP question bank — free
Drop your email and we'll send you fresh CTP practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 156
During a ransomware attack that locks the treasury workstation and treasury management system, which pre-established capability is most critical to continue making time-sensitive payments?
Select an option first.
Correct answer: D — Documented offline/backup access procedures and alternate payment channels at backup banks
Explanation: When primary systems are compromised, the ability to authorize and execute payments through documented alternate channels and backup banking relationships keeps critical obligations current. Credit limits, hedges, and dividends do not restore payment capability during a systems outage.
Question 157
A firm stores its only backup of payment records in the same data center as the production system. What operational risk principle does this violate?
Select an option first.
Correct answer: C — Geographic diversification / off-site redundancy of backups
Explanation: Co-locating the only backup with production means a single localized event (fire, flood, power loss) can destroy both copies simultaneously. Sound continuity design requires off-site or geographically separated backups so one incident cannot eliminate all recovery options.
Question 158
After a data breach, an organization that stored full card magnetic-stripe data after authorization is most exposed to penalties because:
Select an option first.
Correct answer: D — Storing prohibited sensitive authentication data after authorization breaches PCI DSS requirements
Explanation: PCI DSS explicitly prohibits storing sensitive authentication data, such as full magnetic-stripe contents, after a transaction is authorized. Retaining it dramatically increases breach severity and exposes the entity to fines, forensic costs, and card-brand assessments.
Question 159
The shift to EMV chip cards and the associated liability shift primarily affected fraud liability by:
Select an option first.
Correct answer: B — Shifting counterfeit-fraud liability to whichever party (merchant or issuer) is the least EMV-compliant in a card-present transaction
Explanation: Under the EMV liability shift, the party that has not enabled chip technology in a card-present counterfeit-fraud scenario generally bears the loss. This incentivized merchants to adopt chip terminals but did not eliminate fraud, shift liability to networks, or remove PCI obligations.
Question 160
Tokenization reduces a merchant's PCI DSS scope primarily because:
Select an option first.
Correct answer: A — Actual card numbers are replaced with non-sensitive tokens, so the merchant stores less cardholder data
Explanation: Tokenization substitutes a card's primary account number with a surrogate token that has no exploitable value if stolen, reducing the amount of sensitive data the merchant retains. Fewer systems touching real card data narrows PCI DSS scope and lowers breach risk.
Question 161
The Dodd-Frank Act affected corporate treasury derivatives use primarily by:
Select an option first.
Correct answer: C — Requiring central clearing and reporting for many standardized swaps, while providing an end-user exception for commercial hedgers
Explanation: Dodd-Frank mandated central clearing, exchange trading, and reporting for many standardized over-the-counter swaps to reduce systemic risk, but it included an end-user (commercial hedger) exception from mandatory clearing for firms using swaps to hedge commercial risk. It did not ban corporate derivatives or eliminate liquidity rules.
Question 162
Under UCC Articles 3 and 4, which of the following best describes a holder in due course?
Select an option first.
Correct answer: B — A party who takes a negotiable instrument for value, in good faith, and without notice of defects, and thus takes it free of many defenses
Explanation: UCC Articles 3 and 4 govern negotiable instruments; a holder in due course takes an instrument for value, in good faith, and without notice of defenses or claims, and consequently holds it free from most personal defenses. This concept is central to the negotiability and transferability of checks.
Question 163
UCC Article 4A governs which type of payment, and what is a key feature of its loss-allocation framework?
Select an option first.
Correct answer: A — Commercial wholesale wire (funds) transfers; loss allocation based on commercially reasonable security procedures
Explanation: UCC Article 4A governs wholesale/commercial funds transfers, principally wires, and allocates the risk of unauthorized orders based on whether a commercially reasonable security procedure was agreed and followed. Consumer electronic transfers instead fall under Regulation E, and checks fall under Articles 3 and 4.
Question 164
A treasury team notices multiple structured cash deposits of $9,500 designed to stay below the $10,000 currency transaction reporting threshold. Under AML rules, this pattern should be:
Select an option first.
Correct answer: D — Treated as potential structuring and reported via a suspicious activity report (SAR)
Explanation: Deliberately breaking transactions into amounts below the $10,000 reporting threshold is structuring, itself illegal, and is a red flag for money laundering. Institutions are expected to detect such patterns and file a suspicious activity report rather than treating each deposit as innocuous.
More free CTP topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.