Daily JAIIB Quiz 26 Oct 2026

CBS connects branches to a centralized or networked banking system so that customer accounts and transactions can be accessed across branches in near real time. This enables anywhere banking, subject to the bank’s controls and service availability. CBS is not merely an ATM network or a stand-alone branch ledger.

An ATM transaction at another bank’s ATM is an interbank or off-us transaction. The issuer (Bank X) authenticates/authorizes the cardholder and account transaction through the relevant switching and payment infrastructure, while the acquirer/operator (Bank Y) provides the ATM terminal. Applicable transaction limits, charges and customer protections depend on RBI directions and the relevant scheme rules.

A UPI PIN is used to authorize a UPI debit/payment transaction and should never be disclosed to another person. A UPI PIN is not the same as the app login password or the OTP used in some authentication/registration flows. Users should enter the PIN only in the trusted UPI application flow and should not enter it to receive money.

NEFT is an RBI-operated electronic funds transfer system that processes transactions in half-hourly batches and is available 24×7, including holidays. It is not a real-time gross settlement system; RTGS settles eligible transactions individually in real time. Banks may set operational cut-offs for customer-facing processes, but the NEFT system itself operates round the clock.

RBI’s RTGS framework prescribes a minimum transaction amount of ₹2 lakh for ordinary domestic RTGS transfers. There is no RBI-prescribed upper ceiling for RTGS, although a bank may apply channel-specific limits for its customers. NEFT, unlike RTGS, has no RBI-prescribed minimum transfer amount.

IMPS enables near-instant interbank fund transfers and is available 24×7, including holidays, through participating banks and supported channels. The exact transaction limits and supported initiation methods can vary by bank and channel, so users should check their bank’s current terms. IMPS is distinct from NEFT’s batch settlement and RTGS’s real-time gross settlement.

CTS replaces the physical movement of cheques with electronic presentation of cheque images and data for clearing. It speeds up clearing and reduces the risks, cost and time associated with transporting physical cheques. The physical cheque is generally retained by the presenting bank under prescribed procedures rather than sent through the clearing chain.

SWIFT provides a secure standardized financial messaging network used by banks and other financial institutions to exchange payment instructions and other financial messages. SWIFT messaging itself does not constitute the movement or final settlement of funds; settlement occurs through correspondent accounts and relevant payment/settlement systems.

Tokenisation replaces the actual card number (such as the PAN) with a surrogate value, or token, for use in a defined payment context. This reduces exposure of the actual card details if token data is compromised. A token is not a customer’s PIN and does not itself guarantee that a transaction is legitimate; authentication, authorization and other security controls remain important.

Two-factor authentication combines two different categories: something the user knows (for example, a password or PIN), something the user has (for example, a registered device or token), or something the user is (a biometric). Two passwords are generally two instances of the same factor category, not two-factor authentication. Strong authentication reduces risk but does not eliminate all fraud.

This is a typical phishing attempt: a fraudulent message impersonates a trusted institution and pressures the recipient to disclose credentials. The customer should not click the link or disclose passwords, PINs or OTPs. They should contact the bank through an independently verified official channel and report the message. Banks do not need a customer’s OTP or password to prevent account closure.

A firewall enforces network traffic rules between networks or network zones by allowing or blocking traffic according to defined policies. It is one layer of defence and should be complemented by controls such as endpoint protection, secure configuration, access controls, monitoring, patching and incident response. A firewall alone cannot prevent every attack, particularly those involving authorized users or compromised endpoints.

Encryption in transit helps protect confidentiality by making intercepted data unreadable without the appropriate cryptographic keys. Secure protocols can also provide integrity and server authentication when properly configured. Encryption does not by itself prove that a user is authorized to access the data, nor does it remove the need for secure key management and endpoint protection.

An IS audit evaluates controls over information systems, including access management, change management, system operations, security, data integrity, continuity and compliance with relevant policies and requirements. It is not limited to checking financial entries or testing whether a computer turns on. The audit should assess both control design and operating effectiveness, with findings documented and followed up.

A disaster recovery (DR) site supports restoration or continuation of critical IT services after a major disruption at the primary site. Effective DR arrangements require tested recovery procedures, appropriate replication or backups, defined recovery time objectives (RTOs) and recovery point objectives (RPOs), and clear responsibilities. Merely owning an alternate site does not establish that recovery will succeed.

RTO is the target time within which a system, application or service should be restored after disruption. Recovery Point Objective (RPO), by contrast, concerns the maximum tolerable data loss measured in time—for example, how far back data may need to be recovered. Both objectives should be based on business impact analysis and approved recovery requirements.

A valid digital signature can support verification of the message’s integrity and evidence that it was signed using the corresponding private key associated with the signer’s certificate. It can also support non-repudiation in a legal and procedural context, subject to the applicable framework and proper key control. A digital signature does not encrypt the message or automatically keep its contents confidential.

NPCI operates and develops several retail payment systems and infrastructure in India, including UPI, IMPS, RuPay and the National Financial Switch, under the applicable regulatory framework. RBI is India’s central bank and operates systems such as RTGS and NEFT. The distinction matters because a payment system’s operator and its regulator or settlement arrangements are not necessarily the same entity.

Contactless card payments commonly use Near Field Communication (NFC), a short-range wireless communication technology. The payment is still subject to scheme rules, terminal capabilities, transaction limits and applicable authentication requirements. Contactless does not mean risk-free, and customers should protect their cards and promptly report unauthorized transactions.

The principle of least privilege means granting users only the minimum access needed to perform their authorized duties, for only as long as necessary. Role-based access, segregation of duties, periodic access reviews and prompt removal of unnecessary permissions help implement this principle. Broad access for convenience increases the risk of misuse and accidental disclosure.