Home › Library › Cyber Security & Fraud Risk Management
JAIIB Paper 2 • Banking Technology
Security Considerations, IS Audit & Operational Aspects of Cyber Crimes / Fraud Risk Management
Every banking technology topic we've covered so far โ CBS, ADCs, payment rails, FinTech โ ultimately depends on this one: keeping the systems, and the customers using them, safe from an ever-evolving threat landscape. Covers risk areas, threat types, IS Audit/Security, the G. Gopalakrishna Committee, RBI's Cyber Security Framework, fraud vs crime, and Incident Response Plan phases, with 50 exam-style MCQs with hidden answers.
๐ Updated: September 2026 • 34 min read
๐ At a Glance
Concept
Key Point
G. Gopalakrishna Committee
2010-11 RBI committee report on IT governance, IS security, and cyber fraud, foundational to India's bank cyber-security regulation
RBI Cyber Security Framework
2016 circular mandating a Board-approved cyber security policy for every bank
Social-engineering attacks via fraudulent email (phishing), voice calls (vishing), or SMS (smishing) tricking customers into revealing credentials/OTP.
๐ฆ
Malware / Ransomware
Malicious software that infiltrates systems to steal data or (in ransomware's case) encrypt data and demand payment for its release.
๐
DDoS (Distributed Denial of Service)
Overwhelming a bank's servers with traffic to disrupt service availability, often used as a diversion during a larger attack.
๐ค
Insider Threats
Malicious or negligent actions by employees/contractors with legitimate system access, often harder to detect than external attacks.
๐
Supply-Chain/Third-Party Risk
Vulnerabilities introduced via vendors, FinTech partners, or outsourced service providers connected to the bank's systems.
2 Control Mechanisms
Layered ("defence in depth") controls include firewalls, intrusion detection/prevention systems (IDS/IPS), encryption (data at rest and in transit), multi-factor authentication, endpoint security, and Security Operations Centre (SOC) monitoring for 24x7 threat detection โ no single control is treated as sufficient; controls are combined so a failure in one layer doesn't compromise the whole system.
3 Computer Audit, IS Audit & IS Security
๐ฅ๏ธ
Computer Audit
Broad review of computerised systems/processes for accuracy, completeness, and control effectiveness in financial/operational reporting.
๐
Information System (IS) Audit
A specialised audit specifically examining IT governance, access controls, change management, and cyber security controls โ increasingly mandated by RBI for banks and their critical vendors.
๐ก๏ธ
Information System (IS) Security
The broader discipline/function of protecting information systems โ encompassing policy, technology controls, and staff awareness โ that IS Audit evaluates and tests.
4 Online Fraud Modus Operandi & Cyber Security Awareness
Common modus operandi: Fraudsters impersonate bank officials/KYC update agents to extract OTP/PIN, deploy fake loan-approval/lottery-winning messages demanding an upfront "processing fee," or set up fraudulent job/investment schemes routing victim funds through mule accounts. Customer awareness campaigns (RBI's own, and individual banks') are a key non-technical control layer โ no technology can fully compensate for a customer who voluntarily shares their OTP with a fraudster.
For the customer side, including the 1930 helpline, the golden hour, RBI liability rules and 10 common UPI scams, see our UPI fraud SOP (English + เคนเคฟเคเคฆเฅ).
5 Disaster Recovery, IT Act & G. Gopalakrishna Committee
๐
Disaster Recovery Management
Objectives centre on restoring critical systems within a defined RTO/RPO after a disruptive event (cyber attack, natural disaster, system failure), tested via periodic DR drills.
โ๏ธ
IT Act, 2000 (Amended 2008)
India's legal framework for electronic transactions, digital signatures, and cyber offences โ providing legal recognition to electronic records/signatures and defining penalties for hacking, data theft, and identity fraud.
๐
G. Gopalakrishna Committee Report (2010-11)
An RBI-constituted committee that issued comprehensive recommendations on IT governance, information security, business continuity, IS audit, and cyber fraud โ its recommendations form the foundation of much of India's current bank cyber-security regulatory architecture.
6 RBI's Cyber Security Framework in Banks
๐ก๏ธ
2016 Circular โ Board-Level Cyber Governance
RBI's Cyber Security Framework circular (June 2016) mandates every bank to have a Board-approved cyber security policy distinct from its general IT policy, a dedicated Chief Information Security Officer (CISO), mandatory reporting of cyber incidents to RBI within a specified timeframe, participation in an Indian Banks โ Center for Analysis of Risks and Threats (IB-CART) for threat-intelligence sharing, and periodic cyber-security preparedness assessments/testing.
7 Fraud vs Crime
Fraud is a specific category of intentional deception for wrongful gain (a subset within the broader legal category of crime, which covers all law violations, including non-deception-based offences like theft or assault). In banking, most cyber incidents are frauds (specifically financial deception), but the term "crime" is the broader umbrella under which "cyber crime" (including but not limited to fraud) and specific criminal statutes (IT Act, IPC/BNS) apply.
8 Phases of an Effective Incident Response Plan
1๏ธโฃ
Preparation
Establishing policies, tools, and a trained response team before any incident occurs.
2๏ธโฃ
Detection & Analysis
Identifying that an incident has occurred and assessing its scope/severity.
3๏ธโฃ
Containment
Isolating affected systems to prevent the incident from spreading further.
4๏ธโฃ
Eradication
Removing the root cause (malware, unauthorised access) from the environment.
5๏ธโฃ
Recovery
Restoring affected systems to normal operation, verified as clean and secure.
6๏ธโฃ
Lessons Learned
A post-incident review to update policies/controls and prevent recurrence.
The six phases in strict sequence: Preparation โ Detection โ Containment โ Eradication โ Recovery โ Lessons Learned.
โ Key Takeaways
Banking threats span phishing/vishing/smishing, malware/ransomware, DDoS, insider threats, and third-party/supply-chain risk, addressed via layered "defence in depth" controls.
IS Audit specifically examines IT governance/security controls, distinct from general computer audit.
The G. Gopalakrishna Committee (2010-11) laid the foundation for India's bank cyber-security regulation.
RBI's 2016 Cyber Security Framework mandates a Board-approved cyber security policy, a CISO, and mandatory incident reporting.
Fraud is a subset of crime โ specifically, intentional deception for wrongful gain.
An effective Incident Response Plan follows: Preparation โ Detection โ Containment โ Eradication โ Recovery โ Lessons Learned.
๐ Top 50 JAIIB-Style MCQs on Cyber Security & Fraud Risk Management
Test your understanding with these 50 practice MCQs, closely modelled on the JAIIB (PPB) exam pattern. Each question has 5 options โ the correct answer is hidden by default; tap "Show Answer" to reveal it along with a short explanation.
๐ฃ Risk Areas & Threats
1 Vishing refers to fraud committed via:
A. Voice calls
B. Email only
C. Physical letters
D. Fax machines
E. Telegraph
Answer: A. Vishing uses voice calls to defraud victims.
2 Smishing refers to fraud committed via:
A. SMS
B. Voice calls
C. Physical mail
D. In-person visits only
E. Fax
Answer: A. Smishing uses SMS to defraud victims.
3 Ransomware:
A. Encrypts data and demands payment for its release
B. Has no effect on any data
C. Only improves system performance
D. Is a type of antivirus software
E. Is used only for legitimate encryption purposes
Answer: A. Ransomware encrypts data, demanding payment for release.
4 A DDoS attack primarily aims to:
A. Disrupt service availability by overwhelming servers with traffic
B. Improve website loading speed
C. Encrypt customer data for legitimate backup
D. Have no impact on service availability
E. Enhance customer experience
Answer: A. DDoS disrupts availability via traffic overload.
5 Insider threats are often harder to detect than external attacks because:
A. Insiders have legitimate system access
B. Insiders never have any system access
C. Insider threats don't exist in banking
D. External attacks are always harder to detect
E. Insiders are always immediately identified
Answer: A. Legitimate access makes insider threats harder to detect.
๐ IS Audit & Security
6 IS Audit specifically examines:
A. IT governance, access controls, and cyber security controls
B. Only the bank's marketing budget
C. Only physical branch cleanliness
D. Only ATM cash levels
E. Nothing related to IT
Answer: A. IS Audit examines IT governance and security controls specifically.
7 IS Security is best described as:
A. The broader discipline of protecting information systems, evaluated by IS Audit
B. Identical to a computer's antivirus alone
C. Unrelated to IS Audit
D. Only a physical security guard function
E. A marketing term with no defined scope
Answer: A. IS Security is the broader discipline that IS Audit evaluates.
โ๏ธ IT Act & G. Gopalakrishna Committee
8 The IT Act, 2000 provides legal recognition to:
A. Electronic records and digital signatures
B. Only physical paper documents
C. No legal recognition of any kind
D. Only foreign transactions
E. Only cash transactions
Answer: A. IT Act gives legal recognition to electronic records/signatures.
9 The G. Gopalakrishna Committee Report was issued around:
A. 2010-11
B. 1935
C. 1949
D. 1999
E. 2021
Answer: A. The report was issued in 2010-11.
10 The G. Gopalakrishna Committee's recommendations covered:
A. IT governance, information security, business continuity, and IS audit
B. Only ATM hardware specifications
C. Only foreign exchange trading
D. Only credit rating methodology
E. No relevance to banking technology
Answer: A. The committee covered IT governance, security, BCP, and IS audit.
๐ก๏ธ RBI Cyber Security Framework
11 RBI's Cyber Security Framework circular was issued in:
A. June 2016
B. 1935
C. 1999
D. 2000
E. 1949
Answer: A. The framework was issued in June 2016.
12 RBI's Cyber Security Framework requires every bank to have:
A. A Board-approved cyber security policy distinct from the general IT policy
B. No cyber security policy at all
C. Only a verbal understanding among IT staff
D. A policy identical to the general IT policy with no distinction
E. A policy approved only by a junior IT clerk
Answer: A. A distinct, Board-approved cyber security policy is mandated.
13 The framework mandates a dedicated:
A. Chief Information Security Officer (CISO)
B. No specific officer of any kind
C. Only a branch manager to handle cyber security
D. A customer-elected representative
E. A foreign government official
Answer: A. A dedicated CISO is mandated.
14 IB-CART facilitates:
A. Threat-intelligence sharing among Indian banks
B. No information sharing of any kind
C. Only foreign exchange rate sharing
D. Only marketing collaboration
E. Only ATM cash logistics coordination
Answer: A. IB-CART facilitates threat-intelligence sharing among banks.
โ๏ธ Fraud vs Crime
15 Fraud is best described as:
A. A subset of crime, specifically intentional deception for wrongful gain
B. A completely separate legal category unrelated to crime
C. Identical to every type of crime with no distinction
D. A term with no legal meaning
E. Broader than the term "crime" itself
Answer: A. Fraud is a subset of crime โ intentional deception for gain.
๐ Incident Response Plan
16 The first phase of an effective Incident Response Plan is:
A. Preparation
B. Recovery
C. Eradication
D. Lessons Learned
E. Containment
Answer: A. Preparation is the first phase.
17 "Containment" in incident response refers to:
A. Isolating affected systems to prevent the incident from spreading
B. Ignoring the incident entirely
C. Immediately deleting all system logs
D. Publicly announcing the incident before any investigation
E. Restoring systems without any prior isolation
Answer: A. Containment isolates affected systems to prevent spread.
18 "Eradication" in incident response refers to:
A. Removing the root cause (malware/unauthorised access) from the environment
B. Ignoring the root cause entirely
C. Deleting the incident response plan itself
D. The first phase of incident response
E. Publicly blaming the affected customer
Answer: A. Eradication removes the root cause of the incident.
19 The final phase of an Incident Response Plan is:
A. Lessons Learned
B. Preparation
C. Detection
D. Containment
E. Eradication
Answer: A. Lessons Learned is the final phase.
๐งฉ Mixed / Comprehensive
20 Which of the following best explains why banks implement "defence in depth" (layered controls) rather than relying on a single security measure?
A. If one control fails or is bypassed, additional layers still provide protection, reducing the chance of a complete compromise
B. A single control is always sufficient for complete protection
C. Layered controls have no additional protective benefit
D. Multiple layers increase the risk of complete system compromise
E. Defence in depth applies only to physical security, never cyber security
Answer: A. Layered controls ensure a single failure doesn't lead to complete compromise.
21 Which of the following would be an appropriate example of a phishing attack targeting a bank customer?
A. A fraudulent email impersonating the bank, asking the customer to "verify" their account by entering login credentials on a fake website
B. A genuine bank statement mailed to the customer's registered address
C. A legitimate SMS alert for a completed transaction
D. A scheduled branch visit for KYC updation
E. A routine ATM cash withdrawal
Answer: A. A fake-website credential-harvesting email is a classic phishing attack.
22 Which of the following best explains why "no technology can fully compensate for a customer voluntarily sharing OTP with a fraudster"?
A. Technical controls protect systems from unauthorised access, but cannot prevent an authorised user from willingly disclosing their own credentials
B. Technology can always fully prevent any customer-side credential disclosure
C. Customer awareness has no role in preventing this type of fraud
D. OTP sharing carries no fraud risk whatsoever
E. Technical and human-factor controls are functionally identical
Answer: A. Technical controls can't stop a user from voluntarily disclosing credentials โ awareness is essential.
23 Which of the following would be an appropriate reason RBI mandates cyber incident reporting to it within a specified timeframe?
A. Timely reporting allows the regulator to assess systemic risk, coordinate response, and issue warnings to other banks if needed
B. Incident reporting serves no regulatory or systemic purpose
C. RBI has no interest in individual bank cyber incidents
D. Systemic risk assessment is unrelated to incident reporting timelines
E. Banks are exempt from any incident reporting obligation
Answer: A. Timely reporting enables systemic risk assessment and coordinated response.
24 Which of the following would be an appropriate reason a bank conducts periodic DR drills rather than assuming its documented DR plan will work when needed?
A. Drills verify the plan actually works in practice, revealing gaps that a purely theoretical document wouldn't surface
B. DR drills serve no verification purpose
C. A documented plan alone guarantees successful execution with no testing needed
D. DR drills are conducted only once at initial DR site setup, never again
E. Practical testing has no advantage over theoretical documentation
Answer: A. Drills reveal practical gaps a theoretical plan alone wouldn't surface.
25 Which of the following would be an appropriate distinction between an IS Audit and a routine financial audit?
A. IS Audit focuses specifically on IT governance/security controls, while financial audit focuses on the accuracy of financial statements
B. IS Audit and financial audit are identical in scope and purpose
C. Financial audit reviews only IT systems, never financial data
D. IS Audit has no connection to any bank control framework
E. Only financial audit is legally required; IS Audit is entirely voluntary
Answer: A. IS Audit targets IT/security controls; financial audit targets financial statement accuracy.
26 Which of the following would be an appropriate scenario classified as "third-party/supply-chain risk"?
A. A vulnerability in a FinTech partner's API being exploited to access the bank's connected systems
B. A bank's own internal employee accessing systems within their authorised role
C. A customer's own device being compromised with no connection to any bank system
D. Third-party risk has no relevance to modern banking technology
E. Supply-chain risk applies only to physical goods, never digital services
Answer: A. A compromised FinTech partner API is a classic third-party/supply-chain risk.
27 Which of the following would be an appropriate reason the G. Gopalakrishna Committee's recommendations are still relevant today despite being over a decade old?
A. They established foundational principles (governance structures, IS audit mandates, BCP frameworks) that subsequent RBI circulars have built upon and refined
B. The recommendations have been completely discarded with no lasting influence
C. Foundational governance principles never remain relevant over time
D. Subsequent RBI circulars have no connection to this committee's work
E. This committee's report has no historical significance to Indian banking regulation
Answer: A. The committee's foundational principles underpin subsequent, refined RBI regulation.
28 Which of the following would be an appropriate reason a bank might treat a specific incident as both a "fraud" and a "crime" simultaneously?
A. An incident involving intentional deception for financial gain (fraud) is also, by definition, a violation of law (crime), since fraud is a legal offence under criminal statutes
B. Fraud and crime are always entirely separate, non-overlapping categories
C. An incident can never be classified as both simultaneously
D. Crime always excludes any deception-based offence
E. Fraud has no legal status as a criminal offence
Answer: A. Fraud, as intentional deception, is itself a criminal offence โ hence both classifications apply.
29 Which of the following would be an appropriate reason a bank's Security Operations Centre (SOC) operates 24x7?
A. Cyber threats can occur at any time, and continuous monitoring is necessary for timely detection and response
B. Cyber threats occur only during standard business hours
C. 24x7 monitoring has no security benefit over business-hours-only monitoring
D. SOCs are used only for marketing analytics, not security
E. Continuous monitoring is banned under RBI rules
Answer: A. Threats can occur anytime, necessitating continuous SOC monitoring.
30 Which of the following would be an appropriate reason a bank's incident response plan includes a "lessons learned" phase rather than closing the case at "recovery"?
A. Understanding what went wrong and updating controls/processes helps prevent similar incidents from recurring
B. Lessons learned serves no preventive purpose
C. Recovery alone is always sufficient with no need for further review
D. Post-incident review has no connection to future incident prevention
E. Lessons learned is identical to the containment phase
Answer: A. Lessons learned helps prevent recurrence by updating controls/processes.
31 Which of the following would be an appropriate example of a "mule account" used in online fraud schemes?
A. An account opened by an unwitting or complicit individual to receive and quickly transfer out fraudulently obtained funds, obscuring the money trail
B. A standard savings account with no connection to any fraud scheme
C. A corporate current account used for legitimate business operations
D. A fixed deposit held for long-term savings
E. A locker rental agreement
Answer: A. A mule account receives/transfers fraudulent funds to obscure the money trail.
32 Which of the following would be an appropriate reason encryption is applied to both "data at rest" and "data in transit"?
A. Data is vulnerable to unauthorised access both while stored and while being transmitted, requiring protection at both stages
B. Only data in transit requires any protection; stored data carries no risk
C. Only data at rest requires protection; data in transit is inherently safe
D. Encryption serves no protective purpose at either stage
E. Data is never vulnerable regardless of its state
Answer: A. Data is vulnerable both stored and in transit, requiring protection at each stage.
33 Which of the following would be an appropriate reason RBI's cyber security framework is described as being distinct from the bank's general IT risk framework?
A. Cyber risk has unique, rapidly evolving characteristics (threat actor sophistication, attack vectors) warranting dedicated governance and policy attention beyond generic IT risk management
B. Cyber security and general IT risk are identical concepts requiring no distinct treatment
C. Cyber threats evolve at the same slow pace as general IT infrastructure risk
D. A single, generic IT policy is always sufficient to address cyber-specific threats
E. Dedicated cyber governance offers no advantage over generic IT governance
Answer: A. Cyber risk's unique, evolving nature warrants dedicated governance beyond generic IT risk.
34 Which of the following would be an appropriate reason a bank trains frontline staff to recognise social engineering attempts (e.g., a caller impersonating a senior executive requesting an urgent fund transfer)?
A. Social engineering exploits human trust/urgency rather than technical vulnerabilities, so staff awareness is a critical control layer
B. Social engineering has no relevance to staff training
C. Technical controls alone fully prevent all social engineering attempts
D. Frontline staff training serves no fraud-prevention purpose
E. Impersonation attacks target only technical systems, never human decision-making
Answer: A. Social engineering exploits human trust, making staff awareness a critical control.
35 Which of the following would be an appropriate example of the "Detection & Analysis" phase in incident response?
A. A SOC analyst noticing anomalous login patterns and investigating whether they indicate a genuine security incident
B. Restoring a system to normal operation after cleanup
C. Drafting the initial incident response policy before any incident occurs
D. Conducting a post-incident review meeting
E. Removing malware from an infected system
Answer: A. Investigating anomalous patterns to confirm an incident is Detection & Analysis.
36 Which of the following would be an appropriate reason a bank's cyber security policy addresses both prevention and response, rather than prevention alone?
A. No prevention measure is foolproof, so a well-prepared response capability is essential to limit damage when an incident does occur
B. Prevention alone guarantees zero incidents will ever occur
C. Response capability serves no purpose if prevention measures exist
D. Incidents never occur despite the best prevention measures failing
E. A cyber security policy need only address prevention, never response
Answer: A. Since no prevention is foolproof, response capability limits damage when incidents occur.
37 Which of the following best explains why RBI requires banks to test their cyber-security preparedness periodically (e.g., through penetration testing)?
A. Simulated attacks reveal actual exploitable vulnerabilities that a purely documentary/policy review might miss
B. Penetration testing serves no vulnerability-discovery purpose
C. A documented policy alone is always sufficient without any practical testing
D. Periodic testing has no relevance to cyber-security preparedness
E. Simulated attacks always find zero vulnerabilities regardless of the system's actual state
Answer: A. Simulated attacks reveal real vulnerabilities that documentary review alone would miss.
38 Which of the following would be an appropriate reason a customer receiving a call from someone claiming to be from "RBI" demanding OTP for a "KYC update" should be suspicious?
A. RBI does not directly contact individual customers to demand OTP/PIN โ this is a classic vishing impersonation pattern
B. RBI routinely calls individual customers directly to collect OTPs
C. This call pattern has no connection to any known fraud modus operandi
D. Sharing OTP with any caller claiming regulatory authority is always safe
E. KYC updates always require OTP disclosure over an unsolicited phone call
Answer: A. RBI doesn't directly call customers for OTP โ this is a classic vishing pattern.
39 Which of the following would be an appropriate reason RBI/banks conduct regular staff awareness training on the evolving fraud landscape?
A. Fraud tactics evolve continuously, so training must be refreshed to keep staff alert to newer schemes rather than only historical patterns
B. Fraud tactics never change, making one-time training sufficient forever
C. Staff awareness training has no bearing on fraud prevention effectiveness
D. Regular refresher training serves no purpose once initial training is completed
E. The fraud landscape has remained completely static since the 1990s
40 Which of the following would be an appropriate reason IB-CART's threat-intelligence sharing benefits the broader banking sector, not just one bank?
A. A threat/attack pattern detected at one bank can be shared to help other banks proactively defend against the same tactic
B. Threat intelligence shared by one bank has no relevance to any other bank
C. Each bank faces entirely unique, non-overlapping threats with no shared patterns
D. Sector-wide sharing increases each bank's individual vulnerability
E. IB-CART restricts information sharing to a single bank only
Answer: A. Sharing detected threats helps the entire sector defend against common tactics.
41 Which of the following would be an appropriate reason a bank's fraud risk management team distinguishes between "fraud" originating externally versus "fraud" involving insider collusion?
A. Insider-collusion fraud often requires different detection approaches (behavioural monitoring, access reviews) compared to purely external attack detection
B. No distinction is needed since all fraud types require identical detection approaches
C. Insider collusion never occurs in banking fraud scenarios
D. External fraud detection methods are always identical to insider fraud detection methods
E. Fraud risk management teams never distinguish between fraud origin types
Answer: A. Insider-collusion fraud needs distinct detection approaches like behavioural monitoring.
42 Which of the following would be an appropriate reason a bank's IT Act-related compliance extends to digital signature verification for certain transactions?
A. The IT Act's legal recognition of digital signatures allows certain transactions to be authenticated electronically with legal validity equivalent to a physical signature
B. Digital signatures have no legal recognition under the IT Act
C. Physical signatures are always legally superior to digital signatures under the IT Act
D. The IT Act has no provisions related to digital signatures
E. Digital signature verification serves no compliance purpose
Answer: A. The IT Act gives digital signatures legal validity equivalent to physical signatures.
43 Which of the following would be an appropriate description of why "preparation" is listed as the first phase of incident response, before any actual incident occurs?
A. Having policies, tools, and a trained team ready in advance ensures a faster, more effective response when an actual incident does occur
B. Preparation has no bearing on response speed or effectiveness
C. Incident response teams should be assembled only after an incident has already caused damage
D. Advance preparation offers no advantage over ad hoc response
E. Preparation is identical to the recovery phase with no distinction
Answer: A. Advance preparation ensures faster, more effective response when incidents occur.
44 Which of the following would be an appropriate reason a bank's cyber security governance structure includes Board-level reporting on cyber risk?
A. Cyber risk can have material financial, operational, and reputational consequences, warranting senior governance attention, not just IT-department-level handling
B. Cyber risk has no material consequences requiring Board attention
C. Board-level reporting serves no governance purpose for cyber risk
D. IT-department-level handling alone is always sufficient without any senior oversight
E. Cyber risk is entirely disconnected from a bank's overall risk management framework
Answer: A. Material cyber risk consequences warrant senior Board-level governance attention.
45 Which of the following would be an appropriate reason a bank's fraud awareness campaign specifically warns customers about fake "loan approval" or "lottery win" messages demanding an upfront fee?
A. This is a recurring, well-documented fraud pattern where victims are tricked into paying an upfront "processing fee" for a fictitious benefit
B. Fake loan/lottery schemes have no documented pattern of occurrence
C. Legitimate loan approvals always require an upfront cash fee before any documentation
D. Awareness campaigns serve no purpose against this specific fraud pattern
E. Upfront fee demands are always legitimate banking practice
Answer: A. Fake loan/lottery schemes with upfront fee demands are a recurring, documented fraud pattern.
46 Which of the following would be an appropriate summary of how the topics in this JAIIB page (risk areas, IS Audit, IT Act, RBI framework, incident response) fit together?
A. They form a complete cycle โ identifying threats, establishing regulatory/audit oversight, and having a structured response capability โ for managing a bank's cyber/fraud risk holistically
B. These topics are entirely disconnected with no logical relationship
C. Only IS Audit is relevant; the other topics have no connection to cyber risk management
D. Incident response has no relationship to regulatory frameworks like RBI's Cyber Security Framework
E. This grouping serves no coherent risk-management purpose
Answer: A. These topics together form a complete cyber/fraud risk management cycle.
47 Which of the following would be an appropriate reason a bank's outsourcing/vendor management policy includes cyber security due diligence for FinTech partners?
A. A vendor's security weakness can become the bank's own exposure once systems are integrated, making vendor-side due diligence essential
B. Vendor security has no bearing on the bank's own risk exposure
C. FinTech partners are always inherently more secure than the bank's own systems
D. Due diligence on vendors serves no risk-mitigation purpose
E. Integrated systems carry no shared risk between the bank and its vendors
Answer: A. A vendor's weakness becomes the bank's exposure once integrated โ due diligence mitigates this.
48 Which of the following would be an appropriate reason a bank's crisis communication plan (part of incident response preparation) matters during a major cyber incident?
A. Clear, timely communication to customers/regulators/media helps manage reputational impact and prevents misinformation from spreading during a crisis
B. Crisis communication has no bearing on managing an incident's broader impact
C. Banks should never communicate about any incident under any circumstance
D. Reputational impact is unrelated to how an incident is communicated
E. Communication planning is irrelevant to the incident response process
Answer: A. Clear communication manages reputational impact and prevents misinformation during a crisis.
49 Which of the following would be an appropriate reason this topic is positioned as a capstone within JAIIB's Banking Technology module, following CBS, ADCs, payment systems, and FinTech trends?
A. Security and fraud risk considerations cut across and protect every technology system/product covered in the preceding topics
B. Security has no relevance to any of the previously covered banking technology topics
C. This topic is entirely independent of CBS, ADCs, or payment systems
D. Fraud risk management applies only to physical branch operations, not digital systems
E. This topic's positioning is arbitrary with no pedagogical logic
Answer: A. Security/fraud risk considerations cut across and protect all preceding technology topics.
50 Overall, which statement best summarises this topic?
A. Bank cyber security spans identifying risk areas/threats (phishing, malware, DDoS, insider/third-party risk), layered control mechanisms, IS Audit/Security oversight, the foundational G. Gopalakrishna Committee and IT Act legal framework, RBI's 2016 Cyber Security Framework (Board policy, CISO, incident reporting), the fraud-crime relationship, and a structured six-phase Incident Response Plan (Preparation โ Detection โ Containment โ Eradication โ Recovery โ Lessons Learned)
B. Cyber security has no formal regulatory framework in Indian banking
C. IS Audit and computer audit are identical concepts with no distinction
D. Fraud is broader than and encompasses the concept of crime
E. Incident response has no defined phases or structure
Answer: A. This correctly captures the full cyber security/fraud risk management framework.
Disclaimer: This article is prepared for educational and exam-preparation purposes only, summarising cyber security and fraud risk management practices as of September 2026. Candidates should cross-check the latest official IIBF syllabus and RBI guidelines before the exam.