Skip to content
// EXAM HALL24 QUESTIONS · 30 MINUTES

Bank Cyber Security Practice Test

Alerts and risk in numbers, one phishing attack from first click to held payment, and the calls a security team gets.

BY MICHAEL SHANG · SIXTEEN YEARS IN COMMERCIAL BANKING · UPDATED

// THE SHORT ANSWER

A bank cyber security practice test asks whether you can read an alert queue, contain an attack and put a risk in terms a board can weigh. This paper has three parts: base rates, annualised loss and access; one phishing attack from first click to held payment, set on an exhibit; and calls on ransomware, exceptions and risk acceptance. It does not replace your own technical round. Every question is original, and none comes from any bank's test. Sit it against a thirty-minute clock, or take it as practice.

BASIS  Practitioner judgment from sixteen years in commercial banking, set out in How Bankers Think (Highbank Press, 2026). Every borrower on this site is a composite constructed for teaching, not a client. The market is mid-market commercial lending as practised in New Zealand and Australia; where a convention differs elsewhere, the page says so.

// HOW TO SIT IT

Answer below as practice, and each read opens as you go. Or sit it as a test: 30 minutes, with every read held back until you finish.

PART A

Alerts, risk and access

The numbers behind a security team's day, and the questions it gets asked.

PART A · QUESTION 1

A detection rule catches 99% of real intrusions and wrongly flags 1% of normal events. Of 1,000,000 events a day, 10 are real.

About what share of its alerts are real?

PART A · QUESTION 2

A type of incident happens about twice a year and costs US$300,000 each time. A control costing US$200,000 a year would halve how often it happens.

What is the case for the control?

PART A · QUESTION 3

An analyst moved from payments to marketing six months ago. A review finds they can still approve payments: access was added for the new role, and nothing was removed.

What is the real finding?

PART A · QUESTION 4

An alert shows an administrator account logged in at 3am from a country where the bank has no staff. It then read several customer files.

What do you do first?

PART A · QUESTION 5

Three patches are due: a critical flaw on an internal test server, a medium flaw on the internet-facing payment portal that is being exploited elsewhere, and a high flaw on a laptop image.

What goes first?

PART A · QUESTION 6

You have two minutes with the chief executive, an hour into an incident. You know one server is compromised. You do not yet know if customer data was taken.

What do you tell them?

PART A · QUESTION 7

A vendor that holds customer data sends a clean annual security certificate. Its service is now critical to onboarding. The business says: 'We have the certificate. Move on.'

What do you do?

PART A · QUESTION 8

An audit confirms all staff completed phishing training and that passwords rotate every 90 days. That week a staff member approves a fake login prompt, and an attacker gets in.

What does that show?

PART B

The intrusion

One Monday, nine questions. Read the whole morning before you start.

EXHIBIT O · THE INTRUSION

One Monday at a bank, put together afterwards from its logs.

TimeWhat happened
09:12A message with a link to an overdue invoice reaches a treasury analyst.
09:14The analyst enters their password on a fake login page, and approves a prompt on their phone.
09:20A login to the analyst's account from a new country passes multi-factor authentication.
09:22A new mail rule moves every message containing 'payment' out of the inbox, to an archive folder.
09:40The account opens a site holding supplier bank details.
10:05The analyst's account emails accounts payable: a supplier has changed banks, US$840,000, next run at 15:00.
10:30An alert for the login from a new country is closed as 'probably VPN' after five minutes.
13:50An accounts payable clerk rings the supplier on the number on file. The supplier knows nothing about it, and the clerk reports the call.
PART B · QUESTION 9

From Exhibit O.

Which event should have raised the strongest alarm?

BACK TO EXHIBIT O ↑
PART B · QUESTION 10

It is 13:50 in Exhibit O, and the clerk has just reported the call. The payment runs at 15:00.

What comes first?

BACK TO EXHIBIT O ↑
PART B · QUESTION 11

In Exhibit O, a colleague resets the analyst's password at 14:00 and says: 'Done. They are locked out.'

What is still open?

BACK TO EXHIBIT O ↑
PART B · QUESTION 12

In Exhibit O, the login at 09:20 passed multi-factor authentication.

What does that tell you?

BACK TO EXHIBIT O ↑
PART B · QUESTION 13

Reviewing Exhibit O afterwards, you see the 10:30 alert for the login from a new country was closed as 'probably VPN' after five minutes. You are the shift lead.

What do you do about it?

BACK TO EXHIBIT O ↑
PART B · QUESTION 14

At 15:30 in Exhibit O, the payment is held and the account is contained. Someone proposes wiping the analyst's laptop to be sure.

What do you say?

BACK TO EXHIBIT O ↑
PART B · QUESTION 15

Exhibit O's attacker opened a site of supplier bank details, and the mailbox held some customer emails. Legal asks whether this has to be reported to the regulator.

What do you give them?

BACK TO EXHIBIT O ↑
PART B · QUESTION 16

After Exhibit O, someone says: 'The analyst clicked. Send them back to training, and note it on their file.'

What do you say?

BACK TO EXHIBIT O ↑
PART B · QUESTION 17

From Exhibit O.

How long did the attacker have, from first login to the first person who acted on it?

BACK TO EXHIBIT O ↑

PART C

The calls

Ransomware, exceptions, and the people asking for them.

PART C · QUESTION 18

Ransomware has encrypted a branch system. The attackers demand US$2m, and the backups have not been tested. A senior executive says: 'Just pay. It is cheaper than the outage.'

What do you do?

PART C · QUESTION 19

A developer asks you to open a firewall port from the internet to a test server for a two-week vendor demo. 'It is only test. There is nothing real on it.'

What do you do?

PART C · QUESTION 20

This year's phishing tests show the click rate down from 12% to 4%. The head of security wants to tell the board that this risk has fallen by two-thirds.

Signal or noise?

PART C · QUESTION 21

A penetration test found a serious flaw in the loan portal, and the fix needs a three-month rebuild. The head of lending says: 'Accept the risk. We need this release.'

What do you do?

PART C · QUESTION 22

Logs show that a colleague you like, in the fraud team, looked up a celebrity's accounts last night with no case attached.

What do you do?

PART C · QUESTION 23

A software library used across the bank is reported at 8pm with a critical flaw that is easy to exploit. Nobody can say where it runs.

What comes first?

PART C · QUESTION 24

The chief financial officer wants to be exempted from multi-factor authentication. 'It slows me down when I travel.'

What do you say?

0 OF 24 ANSWERED · 0 WITH THE SENIOR READ · 0 STANDS UP · 0 OFF THE LINE

// THE REST OF THE ROUND

Every question here is original; none is any bank's real test. Written for: Cyber security analyst.