JAIIB Paper 2 Module C Quiz 9

Correct answer: Option 4. The IT Act, 2000, as amended, provides a legal framework for electronic records/signatures and specified cyber offences and liabilities. Other laws and regulations also apply to banking. Topic area: IT Law and Governance — Information Technology Act, 2000.

Correct answer: Option 4. CERT-In is India‘s national agency for responding to computer security incidents and performs functions under the IT Act framework and applicable directions. Topic area: IT Law and Governance — CERT-In.

Correct answer: Option 4. RBI‘s cyber-security framework emphasises governance, risk assessment, detection, response and resilience. Banks must follow the applicable current directions and circulars. Topic area: IT Law and Governance — RBI Cyber Security Framework for Banks.

Correct answer: Option 2. The G. Gopalakrishna Committee examined information security, electronic banking, technology risk and assurance-related issues in the financial sector. Topic area: IT Law and Governance — Gopalakrishna Committee.

Correct answer: Option 3. Banks hold sensitive financial and identity data. Appropriate collection, purpose limitation, access controls, security, retention and lawful disclosure are important. Topic area: IT Law and Governance — Data privacy in banking.

Correct answer: Option 3. Outsourcing does not remove a bank‘s responsibility to manage risk and comply with applicable requirements. Contracts, audit rights, resilience and exit plans matter. Topic area: IT Law and Governance — Outsourcing risk management.

Correct answer: Option 2. An SLA clarifies expected availability, support, performance and escalation. It should be aligned with risk, criticality and contractual obligations. Topic area: IT Law and Governance — Third-party service-level agreement (SLA).

Correct answer: Option 2. A risk register supports governance by tracking risk severity, ownership, controls, action status and residual exposure. Topic area: IT Law and Governance — Technology risk register.

Correct answer: Option 1. Independence can improve objectivity and identify blind spots. Findings should be reported to appropriate governance forums and tracked to closure. Topic area: IT Law and Governance — Independent security review.

Correct answer: Option 1. India‘s IT Act framework provides for protection of critical information infrastructure. Classification and protection depend on the applicable legal and institutional process. Topic area: IT Law and Governance — Critical information infrastructure.

Correct answer: Option 4. CERT-In has issued directions covering specified cyber incidents and reporting requirements. Organisations should consult the current official directions for exact scope and timelines. Topic area: IT Law and Governance — CERT-In incident reporting.

Correct answer: Option 4. BIA helps prioritise recovery by evaluating operational, financial, legal and customer impacts of downtime and identifying dependencies. Topic area: IT Law and Governance — Business impact analysis (BIA).

Correct answer: Option 1. Drills validate recovery capabilities and expose gaps. Results should lead to corrective actions, updated procedures and retesting. Topic area: IT Law and Governance — Disaster recovery drill.

Correct answer: Option 4. Recovery strategies balance business needs, data-loss tolerance, restoration targets, cost and dependencies. Critical services often require more stringent arrangements. Topic area: IT Law and Governance — Recovery strategy.

Correct answer: Option 2. A rollback plan reduces the impact of failed deployments. It should be feasible, documented and tested where appropriate. Topic area: IT Law and Governance — Change rollback plan.

Correct answer: Option 4. Risk-based authentication can add checks when activity is unusual or high risk. It should be designed to avoid unjustified exclusion and comply with applicable requirements. Topic area: IT Law and Governance — Risk-based authentication.

Correct answer: Option 3. Consent-based data sharing should be transparent and limited to the agreed purpose, with safeguards for revocation and records where applicable. Topic area: IT Law and Governance — Customer consent in data sharing.

Correct answer: Option 4. BCP is broader and includes people, processes and facilities as well as technology. Disaster recovery is commonly focused on restoring IT services and data. Topic area: IT Law and Governance — Business continuity versus disaster recovery.

Correct answer: Option 4. Operational resilience focuses on maintaining important services through disruption, supported by mapping dependencies, testing, response and learning. Topic area: IT Law and Governance — Operational resilience.

Correct answer: Option 4. Security by design addresses threats early, often reducing remediation cost and preventing weaknesses from being embedded into systems and processes. Topic area: IT Law and Governance — Security by design.