You’re on a roll
Create a free account to save your CTP progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CTP › Treasury Technology and Payment Systems
Free CTP Treasury Technology and Payment Systems Practice Questions & Answers
150 exam-style Treasury Technology and Payment Systems questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 121
In a TMS, what does a cash pooling module primarily enable a treasurer to do?
Select an option first.
Correct answer: A — Concentrate balances across multiple accounts to optimize interest and reduce borrowing
Explanation: A cash pooling module supports physical concentration (zero-balance or target-balance sweeps) or notional pooling to aggregate balances across accounts, minimizing idle cash, reducing external borrowing, and optimizing interest. It is a liquidity optimization tool, not a tax, logistics, or marketing function.
Question 122
The EDI 823 transaction set (lockbox) is primarily used to:
Select an option first.
Correct answer: D — Report lockbox deposit and remittance detail from a bank to a company
Explanation: The EDI 823 (lockbox) transaction set is used by a bank to report lockbox activity, including deposit and remittance detail, back to the company for reconciliation and posting. It is not for purchase orders, message encryption, or initiating wire transfers.
Question 123
A key advantage of migrating cross-border payment messaging from MT to ISO 20022 MX format is:
Select an option first.
Correct answer: A — Richer, more structured data that improves straight-through processing and reconciliation
Explanation: ISO 20022 MX messages support significantly richer and more structured data than legacy MT messages, which improves automation, compliance screening, and reconciliation through better straight-through processing. It does not reduce remittance capacity, eliminate the need for institution identifiers, or by itself guarantee instant settlement, which depends on the underlying rail.
Question 124
A treasurer reviewing SWIFT connectivity options learns that SWIFT for corporates can be accessed indirectly through a service bureau. The main reason a corporation would use a service bureau is to:
Select an option first.
Correct answer: B — Avoid the operational burden and cost of maintaining direct SWIFT infrastructure in-house
Explanation: A SWIFT service bureau provides the technical infrastructure and connectivity on behalf of the corporation, reducing the in-house cost, staffing, and operational burden of maintaining a direct SWIFT connection. It does not bypass compliance obligations, enable currency printing, or remove the need for bank accounts.
Question 125
A company operating in many countries wants a single standardized channel to connect to multiple banks for both payments and reporting, rather than maintaining separate proprietary links to each bank. The best solution is:
Select an option first.
Correct answer: D — SWIFT connectivity (for example via SWIFT for corporates or a service bureau)
Explanation: SWIFT connectivity gives a corporation a single, standardized, secure channel to reach many banks worldwide for both payment initiation and reporting, avoiding a patchwork of proprietary bank-specific links. Fax lines, separate portal logins, and mailed instructions do not provide a single standardized multi-bank channel.
Get the full CTP question bank — free
Drop your email and we'll send you fresh CTP practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 126
A treasurer finds that some banks deliver BAI2 files while others send MT940 and ISO 20022 camt statements. To achieve consistent cash positioning, the TMS must:
Select an option first.
Correct answer: A — Normalize and map the different reporting formats into a common internal data model
Explanation: When banks deliver data in different formats (BAI2, MT940, ISO 20022 camt), the TMS must parse, normalize, and map them into a consistent internal data model so positioning and reconciliation work uniformly across banks. Rejecting formats, forcing paper, or halting imports would leave the cash position incomplete.
Question 127
Within the ISO 20022 family of cash-management messages, the camt.053 message corresponds most closely to which legacy function?
Select an option first.
Correct answer: B — An end-of-day bank-to-customer statement (like an MT940)
Explanation: The ISO 20022 camt.053 is a bank-to-customer statement message that delivers end-of-day account and transaction reporting, serving the same reporting purpose as the legacy MT940. It is a reporting message, not a payment instruction (MT103), FX confirmation, or trade-finance document.
Question 128
A primary control advantage of implementing eBAM with digitized signatory mandates is:
Select an option first.
Correct answer: C — It creates a consistent audit trail and reduces the risk of outdated or unauthorized signatories
Explanation: Digitized signatory management under eBAM maintains an accurate, centralized, and auditable record of who is authorized on each account, reducing the risk of stale or unauthorized signatories and improving control during audits. It strengthens rather than removes approvals and has no effect on interest rates or unrestricted account opening.
Question 129
A treasury group wants its month-end close to require fewer manual journal entries from treasury activity. The most effective enabler is:
Select an option first.
Correct answer: D — Automated accounting-entry generation and posting from the TMS to the ERP
Explanation: Automating the generation and posting of treasury accounting entries from the TMS to the ERP reduces manual journal entries, accelerates the close, and lowers error rates. Manual re-keying, eliminating bank accounts, or delaying reconciliations would worsen the close process rather than streamline it.
Question 130
A company issues a large volume of recurring consumer collections and wants the lowest per-item cost with predictable settlement, accepting next-day timing. The most cost-effective rail is typically:
Select an option first.
Correct answer: A — ACH debit entries
Explanation: ACH debits are a low-cost, batch-processed rail well suited to high-volume recurring consumer collections where next-day or same-day settlement is acceptable. Wires are far more expensive per item and reserved for high-value, time-critical payments, and mailing checks is slow and costly for recurring collections.
Question 131
Business email compromise (BEC) is a fraud scheme in which attackers:
Select an option first.
Correct answer: A — Impersonate an executive or trusted vendor via email to trick staff into sending funds or data
Explanation: BEC involves attackers impersonating a senior executive, vendor, or other trusted party through spoofed or compromised email accounts to deceive employees into transferring funds or divulging sensitive information. It is a social-engineering attack, distinct from physical theft, password guessing, or denial-of-service flooding.
Question 132
Phishing is best defined as:
Select an option first.
Correct answer: B — Fraudulent messages designed to trick recipients into revealing credentials or clicking malicious links
Explanation: Phishing uses deceptive emails, texts, or other messages that appear legitimate to trick recipients into disclosing credentials, sensitive data, or clicking links that install malware. It is an attack technique, not a bank service, encryption method, or settlement enhancement.
Question 133
Ransomware is a type of malware that:
Select an option first.
Correct answer: C — Encrypts or locks a victim's data and demands payment for its release
Explanation: Ransomware encrypts or otherwise locks a victim's systems or data and demands a ransom, often in cryptocurrency, in exchange for a decryption key. It is malicious software, not a performance tool, backup service, or identity-verification mechanism.
Question 134
Multifactor authentication (MFA) strengthens security by requiring:
Select an option first.
Correct answer: D — Two or more independent factors such as something you know, have, or are
Explanation: MFA requires two or more independent authentication factors, typically drawn from something you know (password), something you have (token or phone), and something you are (biometric). Combining factors makes stolen credentials alone insufficient for access. A single password is only one factor.
Question 135
Encryption protects data by:
Select an option first.
Correct answer: A — Converting it into an unreadable form that requires a key to decode
Explanation: Encryption transforms readable data (plaintext) into an unreadable form (ciphertext) using an algorithm and a key, so that only parties with the correct key can decode it. It protects confidentiality in storage and transit. It does not delete, publicize, or inherently slow data beyond minor processing overhead.
Question 136
Tokenization in payment security refers to:
Select an option first.
Correct answer: B — Replacing sensitive data such as an account number with a non-sensitive substitute value
Explanation: Tokenization replaces sensitive data, such as a primary account number, with a non-sensitive surrogate (a token) that has no exploitable value if intercepted, while the real data is stored securely elsewhere. It reduces the scope of sensitive data exposure. It is unrelated to arcade tokens, rounding, or converting data to plaintext.
Question 137
A dual-approval (segregation of duties) control over payments means that:
Select an option first.
Correct answer: C — Initiating and approving a payment are performed by different individuals
Explanation: Segregation of duties through dual approval ensures that the person who initiates a payment is not the same person who approves or releases it, reducing the risk of error and fraud. Allowing one person to do both, or removing approval entirely, defeats the control's purpose.
Question 138
Role-based access control (RBAC) in a treasury system means that:
Select an option first.
Correct answer: D — System permissions are granted according to a user's job role and responsibilities
Explanation: Role-based access control assigns system permissions based on a user's defined job role, ensuring individuals can access only the functions their responsibilities require. This supports least-privilege and segregation-of-duties principles. Granting everyone admin rights or random access would undermine security controls.
Question 139
The principle of least privilege states that users should:
Select an option first.
Correct answer: A — Have the minimum access rights necessary to perform their job
Explanation: Least privilege dictates that each user is granted only the minimum access rights necessary to perform their duties, limiting the potential damage from error, misuse, or compromised credentials. Full access for all, shared logins, and zero access all violate the principle or make work impossible.
Question 140
When treasury applications move to a cloud (SaaS) model, security responsibility is typically:
Select an option first.
Correct answer: B — Shared between the cloud provider and the customer under a shared responsibility model
Explanation: Cloud services operate under a shared responsibility model in which the provider secures the underlying infrastructure and platform while the customer remains responsible for configuration, access management, and data governance. Security is neither entirely offloaded nor eliminated. Responsibility is not left solely to personal devices.
Question 141
A user access review (recertification) is performed to:
Select an option first.
Correct answer: C — Periodically confirm that users' access rights remain appropriate and remove unneeded access
Explanation: Periodic user access reviews verify that each person's system permissions still match their current role and responsibilities, and that access for departed or reassigned employees is removed. This limits privilege creep and orphaned accounts. It does not expand permissions, delete logs, or replace MFA.
Question 142
Payment limits and beneficiary controls configured within a TMS are examples of:
Select an option first.
Correct answer: D — System-embedded fraud and error controls
Explanation: Configurable payment limits, approved beneficiary lists, and threshold-based approval rules are controls embedded in the payment system that help prevent unauthorized, erroneous, or fraudulent payments. They are risk controls, not marketing, tax, or inventory functions.
Question 143
An application programming interface (API) in banking allows:
Select an option first.
Correct answer: B — Two software systems to communicate and exchange data directly in a defined way
Explanation: An API defines a standardized way for two software systems, such as a corporate TMS and a bank platform, to communicate and exchange data programmatically, often in real time. It enables automation and integration. It does not handle paper or physical cash and does not exempt banks from regulation.
Question 144
Distributed ledger technology (DLT), including blockchain, is characterized by:
Select an option first.
Correct answer: C — A shared, synchronized ledger replicated across multiple participants
Explanation: Distributed ledger technology maintains a shared, synchronized record of transactions replicated across multiple participants or nodes, often secured cryptographically, rather than relying on a single central copy. This can improve transparency and resilience. It is neither a single central database nor a paper-based system.
Question 145
Robotic process automation (RPA) in treasury is best used to:
Select an option first.
Correct answer: D — Automate repetitive, rule-based tasks such as data entry and reconciliation steps
Explanation: RPA uses software robots to automate repetitive, rule-based, high-volume tasks such as data extraction, re-keying, and routine reconciliation steps, freeing staff for higher-value work. It handles structured, deterministic processes rather than making unsupervised strategic decisions or moving physical cash.
Question 146
A smart contract on a distributed ledger is:
Select an option first.
Correct answer: A — Self-executing code that automatically enforces the terms of an agreement when conditions are met
Explanation: A smart contract is self-executing program code stored on a distributed ledger that automatically performs actions or enforces terms when predefined conditions are satisfied. It removes the need for manual intervention to execute the agreed logic. It is not a verbal agreement, paper document, or brochure.
Question 147
How is artificial intelligence (AI) increasingly applied in treasury operations?
Select an option first.
Correct answer: B — To enhance cash-flow forecasting and detect anomalous or fraudulent transactions
Explanation: AI and machine learning are applied in treasury to improve cash-flow forecasting accuracy, detect anomalies and potential fraud in payment patterns, and support decision-making by analyzing large data sets. These are analytical and predictive uses; AI does not eliminate bank accounts or print currency.
Question 148
An audit trail (transaction log) in a treasury system supports security by:
Select an option first.
Correct answer: B — Recording who did what and when, enabling detection and investigation of unauthorized activity
Explanation: An audit trail captures a chronological record of user and system actions, including who initiated, approved, or changed transactions and when, which supports monitoring, accountability, and investigation of suspicious or unauthorized activity. It does not approve transactions, conceal actions, or encrypt marketing content.
Question 149
A company faces a payment-fraud risk with an estimated annual loss of $250,000. A control costing $60,000 per year is expected to reduce that expected loss by 80%. What is the net annual benefit of implementing the control?
Select an option first.
Correct answer: B — $140,000
Explanation: The control reduces expected loss by 80% of $250,000 = $200,000 of avoided loss. Subtracting the $60,000 control cost gives a net annual benefit of $200,000 minus $60,000 = $140,000. Option A is the gross avoided loss before deducting the control cost.
Question 150
A firm estimates the annualized rate of occurrence (ARO) of a successful phishing-driven fraud at 0.5 events per year, with a single-loss expectancy (SLE) of $300,000. What is the annualized loss expectancy (ALE)?
Select an option first.
Correct answer: C — $150,000
Explanation: Annualized loss expectancy equals single-loss expectancy multiplied by the annualized rate of occurrence: $300,000 x 0.5 = $150,000. Option B ignores the frequency factor and option D doubles it.
More free CTP topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.