You’re on a roll
Create a free account to save your CTP progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CTP › Treasury Technology and Payment Systems
Free CTP Treasury Technology and Payment Systems Practice Questions & Answers
150 exam-style Treasury Technology and Payment Systems questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 151
A cloud TMS subscription costs $4,000 per month. It replaces an on-premise system with $70,000 in annual maintenance plus $2,000 per month in internal IT support. What is the annual cost difference (positive means the cloud option is cheaper)?
Select an option first.
Correct answer: A — $46,000 cheaper
Explanation: On-premise annual cost is $70,000 maintenance plus 12 x $2,000 = $24,000 support, totaling $94,000. Cloud annual cost is 12 x $4,000 = $48,000. The difference is $94,000 minus $48,000 = $46,000 in favor of the cloud option. Option B omits the internal IT support in the comparison.
Question 152
An RPA bot processes reconciliations at $0.05 each after a $10,000 build cost. The manual process costs $2.05 per reconciliation. At 20,000 reconciliations per year, what is the first-year net savings from the bot (including the build cost)?
Select an option first.
Correct answer: B — $30,000
Explanation: Per-item savings equal $2.05 minus $0.05 = $2.00. Annual gross savings: 20,000 x $2.00 = $40,000. Subtracting the one-time $10,000 build cost gives first-year net savings of $40,000 minus $10,000 = $30,000. Option A omits the build cost.
Question 153
A firm evaluates an AI cash-forecasting tool costing $25,000 per year that is expected to reduce idle cash by $1,500,000, which can then be invested at 3% annually. What is the net annual benefit of adopting the tool?
Select an option first.
Correct answer: C — $20,000
Explanation: Investing the $1,500,000 of freed idle cash at 3% earns $1,500,000 x 0.03 = $45,000 per year. Subtracting the tool's $25,000 annual cost gives a net annual benefit of $45,000 minus $25,000 = $20,000. Option B is the gross investment income before deducting the tool cost.
Question 154
A treasury team wants to limit the damage from a ransomware attack that encrypts production systems. The most effective preparedness control is:
Select an option first.
Correct answer: D — Maintaining tested, isolated (offline or immutable) backups with a recovery plan
Explanation: Regularly tested, isolated backups that ransomware cannot reach or alter allow an organization to restore systems without paying a ransom, and a documented recovery plan speeds resumption. Keeping the only copy on the production server, disabling defenses, or paying attackers all increase exposure rather than reduce it.
Question 155
Which statement best distinguishes tokenization from encryption?
Select an option first.
Correct answer: A — Tokenization substitutes data with an unrelated surrogate value stored in a secure vault, while encryption mathematically transforms data using a key
Explanation: Tokenization replaces sensitive data with a surrogate token that has no mathematical relationship to the original, with the mapping held in a secure token vault, whereas encryption uses a reversible algorithm and key to transform the data itself. They are complementary techniques. Encryption does protect data in transit, and tokenization does not publish original data.
Get the full CTP question bank — free
Drop your email and we'll send you fresh CTP practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 156
A treasury team is evaluating a new cloud-based TMS vendor. Which due-diligence item best addresses the vendor's own security posture?
Select an option first.
Correct answer: A — Independent security attestations such as SOC 2 reports and data-handling controls
Explanation: Independent security attestations, such as SOC 2 Type II reports, along with documented encryption, access, and data-handling controls, provide evidence of a cloud vendor's security posture and control effectiveness. Interface aesthetics, marketing awards, and conference sponsorships do not demonstrate security assurance.
Question 157
After an employee with payment-release authority resigns, the most important immediate security action is to:
Select an option first.
Correct answer: B — Promptly deactivate the employee's system credentials and access tokens
Explanation: Deprovisioning access promptly upon termination prevents misuse of the former employee's credentials, which is a significant fraud and insider-threat risk, especially for someone with payment authority. Waiting for the next review or reusing credentials leaves a dangerous window open, and public posting adds no protection.
Question 158
Which configuration weakness would most undermine segregation of duties in a payment workflow?
Select an option first.
Correct answer: C — Allowing the same user ID to both create and release payments
Explanation: Permitting a single user to both create and release a payment collapses the maker-checker separation, enabling one person to originate and authorize fraudulent payments without oversight. Requiring two approvers, logging activity, and separating beneficiary changes all strengthen controls rather than weaken them.
Question 159
A company integrates a bank API into its TMS. Which practice best protects the API credentials and connection?
Select an option first.
Correct answer: D — Storing secrets in a secure vault, rotating keys, and restricting by IP and scope
Explanation: API credentials should be stored in a secure secrets vault, rotated regularly, and constrained by least-privilege scopes and network restrictions such as IP allow-listing, with encrypted transport. Hard-coding keys in shared files, emailing them broadly, or disabling TLS all expose the credentials and connection to compromise.
Question 160
When implementing RPA for a treasury reconciliation process, a key governance control is to:
Select an option first.
Correct answer: C — Apply access controls, logging, and exception-handling oversight to the automation
Explanation: RPA bots act with system credentials and must be governed like any privileged user: least-privilege access, activity logging, exception handling, and periodic human oversight of outputs. Unrestricted access, eliminating review, or concealing activity from auditors would create significant control and audit risks.
Question 161
An advantage of using bank APIs over traditional batch file transfers for treasury is that APIs:
Select an option first.
Correct answer: D — Enable real-time, event-driven data exchange and on-demand payment status
Explanation: APIs support real-time, on-demand, and event-driven interactions, allowing a treasury system to query balances or payment status instantly and initiate transactions in real time, unlike scheduled batch files. They are secured with authentication tokens and encryption and do not depend on nightly windows or physical media.
Question 162
A company piloting AI-based cash forecasting should recognize which limitation?
Select an option first.
Correct answer: A — Forecast accuracy depends heavily on data quality, and outputs should be validated and monitored for bias and drift
Explanation: AI-driven forecasting depends heavily on the quality, completeness, and representativeness of input data, and models can degrade over time (drift) or embed bias, so outputs must be validated, explained, and monitored by knowledgeable staff. AI supports but does not replace human understanding of business cash-flow drivers, and it is never guaranteed to be perfectly accurate.
Question 163
A vendor emails treasury requesting that future payments be redirected to a new bank account. The strongest control before updating the payment master data is to:
Select an option first.
Correct answer: B — Independently verify the change with a known contact at the vendor using previously validated contact details
Explanation: Vendor bank-account change requests are a common vector for payment redirection fraud, so the change must be independently verified through a previously validated contact and channel, not the details supplied in the request itself. Updating immediately or confirming within the same suspect thread provides no genuine verification against impersonation.
Question 164
In the context of ISO 20022 adoption on modern payment rails, a benefit especially relevant to emerging real-time payments is:
Select an option first.
Correct answer: C — Structured remittance and extended data that improve reconciliation and enable services like request for payment
Explanation: ISO 20022 provides structured, extended data that travels with each payment, which on real-time rails enables richer remittance information, better automated reconciliation, and value-added services such as request for payment. It increases rather than reduces accompanying data and complements API-based, real-time processing rather than forcing a return to batch.
More free CTP topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.