1. Why is a distributed ledger difficult to tamper with?

A) A central administrator reviews and approves every transaction before it is added to the ledger
B) Each transaction is stored only on the originator's computer, which locks it against any later change
C) Blocks are hash-linked and copied across many nodes, so changing one block means rewriting all later blocks and most copies
D) Transactions are encrypted so that no participant can read the contents of the ledger entries

Correct: C difficult Blockchain

Chaining of hashes plus replication across nodes makes retrospective change detectable and impractical. A central reviewer would describe a conventional database. Encryption alone does not prevent alteration, and public ledgers are generally readable. A ledger stored only by the originator would not be distributed.

2. A company rents virtual servers and storage from a provider, but installs and manages its own operating systems and accounting software. Which cloud service model is it using?

A) Infrastructure as a service (IaaS)
B) Platform as a service (PaaS)
C) Software as a service (SaaS)
D) Community cloud

Correct: A difficult Cloud computing models

With IaaS the provider supplies computing infrastructure and the customer manages operating systems and applications. In SaaS the provider also supplies the application, and PaaS adds a managed development platform. 'Community cloud' is a deployment model, not a service model, so it does not answer the question.

3. Which task is most suitable for robotic process automation?

A) Matching supplier invoices to purchase orders using fixed tolerance rules
B) Negotiating revised payment terms with a major supplier in a dispute
C) Deciding whether a client remains a going concern after a major loss
D) Designing the group's five-year strategy for new markets

Correct: A difficult Robotic process automation

RPA suits repetitive, rule-based, high-volume tasks with structured inputs. Going-concern assessment, negotiation and strategy require judgement, context and interpersonal skill. If you chose any of these you picked a judgement task.

4. The finance team receives an email that appears to come from the chief executive, asking for an urgent payment to a new bank account. Which control best addresses this risk?

A) Call-back verification on a known number plus dual authorisation of bank detail changes
B) Blocking all external emails to the finance team at weekends and public holidays
C) Installing updated antivirus software on every laptop used by the finance team
D) Replying to the email and asking the sender to confirm the instruction in writing

Correct: A complex Cyber risk

This is business email compromise, a form of phishing. Verification through an independent channel and dual authorisation address the fraud directly. Blocking emails at weekends does not address the method. Replying uses the same compromised channel. Antivirus does not stop a persuasive request that contains no malware.

5. Which TWO describe smart contracts? (Select TWO.)

Multiple response
A) They require a trusted intermediary to execute
B) Their code runs automatically when programmed conditions are met
C) Either party can change them unilaterally after signing
D) They are recorded on a distributed ledger
E) They cannot be used for payments

Correct: B, D complex Smart contracts

Smart contracts are self-executing code stored on a distributed ledger, which removes the need for an intermediary and prevents unilateral change. If you chose A, C or E you stated the opposite of a smart-contract feature.

6. Which TWO are preventive controls? (Select TWO.)

Multiple response
A) Intrusion detection alerts
B) Firewalls
C) Restoration from backups after an attack
D) Multi-factor authentication
E) Post-incident review

Correct: B, D difficult Cybersecurity controls

Preventive controls stop an attack succeeding. Alerts are detective, and restoring from backups and post-incident reviews are corrective. If you chose A, C or E you chose a control that operates after an event begins.

7. Which THREE are recognised risks when using artificial intelligence in finance? (Select THREE.)

Multiple response
A) Bias inherited from training data
B) Lack of explainability of model outputs
C) Complete elimination of errors
D) Over-reliance on automated outputs
E) Guaranteed legal compliance
F) Reduced need for any data

Correct: A, B, D difficult Artificial intelligence

Bias, opacity and over-reliance are widely cited risks. AI does not eliminate errors, guarantee compliance or remove the need for data. If you chose C, E or F you accepted a claim that is not a risk but a false benefit.

8. Consider technology in reporting. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. XBRL tags allow software to read financial data.   Yes

2. In a public cloud, resources are dedicated exclusively to one organisation.   No

3. Cloud services can convert capital expenditure into a subscription cost.   Yes

Correct: Y, N, Y difficult XBRL and cloud

(1) Yes. (2) No: public cloud resources are shared; a private cloud is dedicated. (3) Yes.

9. Consider blockchain. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Confirmed transactions can be deleted by the network administrator.   No

2. Consensus mechanisms validate transactions.   Yes

3. Public blockchains are generally permissionless.   Yes

Correct: N, Y, Y difficult Blockchain features

(1) No: confirmed entries are effectively immutable. (2) Yes. (3) Yes: anyone can join and read.

10. Consider payment systems in Bangladesh. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. bKash, Nagad and Rocket are mobile financial services platforms.   Yes

2. Payment gateways pass card authorisation requests for e-commerce purchases.   Yes

3. Cheques are no longer used in Bangladesh.   No

4. SWIFT is a messaging network used for cross-border payment instructions.   Yes

Correct: Y, Y, N, Y difficult Digital payments

(1) Yes. (2) Yes. (3) No: cheques are still used and cleared through the banking system. (4) Yes.

11. A small Dhaka firm uses an online accounting package through its web browser. The supplier hosts the servers, applies updates and manages the software. Which cloud service model is this?

A) Platform as a service (PaaS)
B) A private cloud owned and operated by the firm
C) Infrastructure as a service (IaaS)
D) Software as a service (SaaS)

Correct: D complex Cloud service models

In SaaS the supplier delivers the finished application over the internet and manages the underlying infrastructure and software. PaaS provides a development and deployment environment for developers. IaaS provides virtual servers, storage and networks that the customer manages. A private cloud would be operated for the firm's own use.

12. A garment factory fits sensors to its sewing machines. They send usage data over the internet to a central dashboard that flags maintenance needs. Which development is this and what is the main control concern?

A) The Internet of Things, with the main concern being the security of many connected devices
B) Blockchain, with the main concern being the immutability of the records stored on the machines
C) Quantum computing, with the main concern being the cost of keeping the processors cool
D) Robotic process automation, with the main concern being software bots replacing manual keying

Correct: A complex Internet of Things

Networked sensors exchanging data over the internet are the Internet of Things. Each connected device is a potential entry point for attackers, so device security and data protection are key concerns. The alternatives describe different technologies.

13. A bank trains a model on past loan applications, each labelled 'repaid' or 'defaulted', and uses it to predict outcomes for new applicants. What type of machine learning is this?

A) Unsupervised learning
B) Rule-based robotic process automation
C) Distributed ledger validation
D) Supervised learning

Correct: D difficult Machine learning

In supervised learning the model learns from input data with a known correct answer (the label). Unsupervised learning looks for patterns in unlabelled data. RPA follows fixed rules and does not learn, and distributed ledger validation is unrelated.

14. Attackers flood a bank's website with traffic so that customers cannot log in for several hours. No data is stolen or altered. Which attack is this?

A) Phishing
B) A denial of service attack
C) Ransomware
D) An advanced persistent threat

Correct: B difficult Cyber attacks

A denial of service attack overwhelms a system so that legitimate users cannot access it. Phishing deceives people into disclosing information or taking actions. Ransomware encrypts data and demands payment. An advanced persistent threat is a prolonged, stealthy intrusion.

15. Which THREE are advantages of cloud computing? (Select THREE.)

Multiple response
A) Full control over the physical security of the servers
B) Reduced up-front capital expenditure
C) Ability to work without any internet connection
D) Capacity that can be scaled up or down on demand
E) Elimination of the customer's data protection responsibilities
F) Access to the service from any location with a connection

Correct: B, D, F difficult Cloud computing advantages

Cloud services avoid large up-front spending, scale as needed and can be accessed anywhere. The customer does not control the provider's physical security, depends on connectivity, and still has data protection responsibilities.

16. Which TWO are examples of fintech? (Select TWO.)

Multiple response
A) A mobile wallet such as bKash used to send money and pay merchants
B) A paper cashbook kept by a shop cashier
C) An online payment gateway that lets merchants accept card and wallet payments
D) A cheque book printed by the bank
E) A cash deposit slip completed at a branch counter

Correct: A, C difficult Fintech

Fintech uses technology to deliver or improve financial services: mobile financial services and payment gateways are typical examples. Paper cashbooks, printed cheque books and counter deposit slips are traditional manual methods.

17. Which TWO controls most reduce the impact of a ransomware attack on a company's data? (Select TWO.)

Multiple response
A) Regularly tested back-ups stored offline
B) Paying any ransom immediately
C) Staff training to recognise suspicious links and attachments
D) Disabling software updates to avoid disruption
E) Sharing administrator passwords among the finance team

Correct: A, C difficult Reducing ransomware risk

Offline, tested back-ups allow recovery without paying, and trained staff are less likely to open the malicious attachment. Paying encourages attacks and gives no guarantee, while missing updates and shared passwords widen the attack surface.

18. Consider distributed ledger technology and digital assets. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A distributed ledger is shared and synchronised across multiple participants.   Yes

2. Blockchain is a form of distributed ledger that records transactions in linked blocks.   Yes

3. Cryptocurrency is legal tender issued by the central bank.   No

4. A distributed ledger needs one central administrator to validate every transaction.   No

Correct: Y, Y, N, N difficult Distributed ledger technology

(1) Yes. (2) Yes. (3) No: cryptocurrencies are digital assets, generally not issued by a central bank as legal tender. (4) No: decentralisation is the defining feature.

19. Consider artificial intelligence and the Internet of Things. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Unsupervised learning needs every training example to be labelled.   No

2. Machine learning systems can improve their performance as they are exposed to more data.   Yes

3. An IoT sensor network reduces cyber risk because the devices are simple.   No

4. IoT devices can exchange data over a network without human intervention.   Yes

Correct: N, Y, N, Y difficult AI and the Internet of Things

(1) No: that describes supervised learning. (2) Yes. (3) No: many connected devices widen the attack surface. (4) Yes.

20. Consider cyber threats. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A denial of service attack aims to make a system unavailable to its users.   Yes

2. Phishing is carried out only by telephone.   No

3. Ransomware encrypts data and demands payment for access.   Yes

4. An advanced persistent threat is a prolonged and stealthy intrusion.   Yes

5. A firewall is solely a detective control and cannot prevent anything.   No

Correct: Y, N, Y, Y, N difficult Cyber threats

(1) Yes. (2) No: phishing is most often by email or message, though not limited to it. (3) Yes. (4) Yes. (5) No: a firewall is mainly a preventive control that filters network traffic.

21. A Dhaka software house builds and deploys its own applications on a provider's environment, without managing servers or operating systems. Which cloud service model is this?

A) Platform as a service (PaaS)
B) Private cloud only
C) Infrastructure as a service (IaaS)
D) Software as a service (SaaS)

Correct: A complex Platform as a service

PaaS provides a development and deployment platform. In SaaS the supplier delivers the finished application; in IaaS the customer manages operating systems.

22. A bank keeps its core customer database on its own servers but uses a public cloud service for its customer website during peak periods. Which deployment model is this?

A) Community cloud
B) Hybrid cloud
C) Private cloud only
D) Public cloud only

Correct: B complex Hybrid cloud

Combining private infrastructure with public cloud is a hybrid model.

23. A caller who claims to be from the IT helpdesk persuades a finance clerk to reveal her password. Which type of attack is this?

A) Social engineering
B) Advanced persistent threat
C) Denial of service
D) Ransomware

Correct: A difficult Social engineering

Manipulating people into disclosing information is social engineering, often related to phishing.

24. A finance director's laptop containing client data is stolen. Which control would best protect the confidentiality of the data on it?

A) Full-disk encryption
B) An uninterruptible power supply
C) A faster processor
D) Regular back-ups to the cloud

Correct: A difficult Encryption

Encryption renders data unreadable without the key. Backups protect availability.

25. A company considers holding part of its cash in a cryptocurrency. Which is the main risk?

A) Immediate legal tender status in every jurisdiction
B) Price volatility and regulatory uncertainty
C) Complete absence of security risks
D) Guaranteed return from the central bank

Correct: B difficult Cryptocurrency risk

Cryptocurrencies can fluctuate sharply in value and face uncertain regulation.