Skip to content
// EXAM HALL25 QUESTIONS · 30 MINUTES

Bank Technology Practice Test

The bank's side of the job, and no coding: a ledger's rules, one payment incident, and the calls on security and data.

BY MICHAEL SHANG · SIXTEEN YEARS IN COMMERCIAL BANKING · UPDATED

// THE SHORT ANSWER

A bank technology practice test here covers the bank's side of the job, and there is no coding in it. It has three parts: what a bank asks of its systems, from ledgers to retries and change control; one duplicate payment incident set on an exhibit; and calls on security, data and models. It serves software engineers, cyber security analysts and data scientists, whose own technical rounds it does not replace. Every question is original, and none comes from any bank's test. Sit it against a thirty-minute clock, or take it as practice.

BASIS  Practitioner judgment from sixteen years in commercial banking, set out in How Bankers Think (Highbank Press, 2026). Every borrower on this site is a composite constructed for teaching, not a client. The market is mid-market commercial lending as practised in New Zealand and Australia; where a convention differs elsewhere, the page says so.

// HOW TO SIT IT

Answer below as practice, and each read opens as you go. Or sit it as a test: 30 minutes, with every read held back until you finish.

PART A

What a bank asks of its systems

What makes bank software different from most software. There is no code in this paper; your own technical round will test that.

PART A · QUESTION 1

A payment service promises 99.9% availability over a 30-day month.

How much downtime does that allow in the month?

PART A · QUESTION 2

In a double-entry ledger every transaction posts equal debits and credits. A report shows that total debits and credits across the ledger differ by US$40.

What does that tell you?

PART A · QUESTION 3

A client sends 'pay US$500 to this account', and the connection drops before any reply. The client does not know if it worked, and sends it again.

What makes this safe?

PART A · QUESTION 4

The core banking system and the card system disagree about a customer's balance by US$200. A developer says: 'Core is the master. Just overwrite the card system.'

What is wrong with that?

PART A · QUESTION 5

A fix to a payment limit check is ready at 4pm on Friday. It has passed its tests. The product owner wants it live tonight, because a client is asking.

What do you do?

PART A · QUESTION 6

1% of transactions are fraud. A model catches 90% of fraud, and wrongly flags 5% of genuine transactions. Take 10,000 transactions.

What share of flagged transactions are really fraud?

PART B

The incident

One afternoon, nine questions. Read the timeline as if you had just been handed it.

EXHIBIT L · THE INCIDENT

A bank's payment service, one Tuesday afternoon, from the incident timeline.

TimeWhat happened
14:02A salary batch of 412 payments, US$3.2m, is sent to the payment rail.
14:03The gateway times out after 60 seconds, waiting for the rail's acknowledgement.
14:05The service retries automatically, and gives the retry a new message ID.
14:06The rail accepts the retry. It had received the first batch after all.
14:40A reconciliation job flags debits of US$6.4m against US$3.2m expected.
14:55The contact centre reports customers being paid twice.
15:10An engineer offers to fix the ledger database directly with a script.
PART B · QUESTION 7

From Exhibit L.

What made the batch go out twice?

BACK TO EXHIBIT L ↑
PART B · QUESTION 8

It is 14:40 in Exhibit L, and reconciliation has just flagged debits of US$6.4m against US$3.2m expected.

What is the first thing to do?

BACK TO EXHIBIT L ↑
PART B · QUESTION 9

At 15:10 in Exhibit L, an engineer offers to run a script directly on the ledger database to reverse the second batch. 'It is quick, and I have access.'

What do you say?

BACK TO EXHIBIT L ↑
PART B · QUESTION 10

In Exhibit L, the second batch has been accepted by the rail. A manager asks: 'Can we just pull the money back tonight?'

What is the accurate answer?

BACK TO EXHIBIT L ↑
PART B · QUESTION 11

It is 14:45 in Exhibit L. The engineers are working on it. You are the incident lead.

Who needs to know now?

BACK TO EXHIBIT L ↑
PART B · QUESTION 12

In Exhibit L, nothing in the payment service noticed the duplicate. A scheduled reconciliation job found it 38 minutes after the batch went in, because of when it happened to run.

What does that tell you?

BACK TO EXHIBIT L ↑
PART B · QUESTION 13

After Exhibit L, an engineer proposes raising the gateway timeout from 60 seconds to five minutes. 'That stops it happening again.'

What do you say?

BACK TO EXHIBIT L ↑
PART B · QUESTION 14

The retry fix from Exhibit L is ready. A colleague has tested that a normal batch still goes through.

What test proves the fix?

BACK TO EXHIBIT L ↑
PART B · QUESTION 15

At the Exhibit L review, a senior manager asks: 'Who wrote the retry code? I want that person off the payments team.'

What do you say as the incident lead?

BACK TO EXHIBIT L ↑

PART C

Cyber and data

Alerts, vendors, data and models, in a place where someone will ask you to prove it.

PART C · QUESTION 16

An alert shows an administrator account logged in at 3am from a country where the bank has no staff. It then read several customer files.

What do you do first?

PART C · QUESTION 17

Three patches are due: a critical flaw on an internal test server, a medium flaw on the internet-facing payment portal that is being exploited elsewhere, and a high flaw on a laptop image.

What goes first?

PART C · QUESTION 18

You have two minutes with the chief executive, an hour into an incident. You know one server is compromised. You do not yet know if customer data was taken.

What do you tell them?

PART C · QUESTION 19

A vendor that holds customer data sends a clean annual security certificate. Its service is now critical to onboarding. The business says: 'We have the certificate. Move on.'

What do you do?

PART C · QUESTION 20

An audit confirms all staff completed phishing training and that passwords rotate every 90 days. That week a staff member approves a fake login prompt, and an attacker gets in.

What does that show?

PART C · QUESTION 21

A tester asks for a copy of production customer data, because the test data does not reproduce a bug. It is urgent, and they promise to delete it afterwards.

What do you do?

PART C · QUESTION 22

You are asked how many active customers the bank has. Marketing's dashboard says 1.2 million, finance says 0.9 million, and the regulator's return says 1.0 million. All are correct on their own terms.

What do you do?

PART C · QUESTION 23

Your early-warning model for business loans scores remarkably well on test data. One strong feature turns out to be 'number of calls from the collections team'.

What do you conclude?

PART C · QUESTION 24

A credit scoring model does not use ethnicity. An analysis finds people from one community are declined far more often at the same repayment record. Postcode is a strong feature.

What do you do?

PART C · QUESTION 25

A fraud model went live a year ago and has not been looked at since. Its alert volumes look normal. A colleague says: 'It is not broken, so leave it alone.'

What do you say?

0 OF 25 ANSWERED · 0 WITH THE SENIOR READ · 0 STANDS UP · 0 OFF THE LINE

// THE REST OF THE ROUND

Every question here is original; none is any bank's real test. Written for: Software engineer, Cyber security analyst, Data scientist.