APRP Authentication & Access Controls in Payments

Question 1

In payments risk management, 'corporate account takeover' (CATO) is BEST described as:

Accepted Answer

Criminals stealing business online banking credentials to initiate unauthorized ACH debits or wire transfers

Answer

CATO refers to cybercriminals compromising a business's online banking login credentials — often through malware or phishing — and then using those credentials to initiate unauthorized payments such as ACH batch files or wire transfers. It is a major fraud vector specifically targeting commercial payment accounts.

Question 2

Multi-factor authentication (MFA) in payment systems requires users to present credentials from:

Accepted Answer

Two or more independent factors drawn from different categories: something you know, something you have, and/or something you are

Answer

True MFA requires factors from at least two distinct categories: knowledge (password/PIN), possession (hardware token, mobile device), or inherence (biometrics). Using two passwords is not MFA — both belong to the same category. The independence of the factors is what makes MFA effective.

Question 3

The principle of 'least privilege' applied to payment system access controls means users should be granted:

Accepted Answer

Access rights limited to only what is necessary to perform their specific job duties

Answer

Least privilege is a foundational access control principle that limits each user's system permissions to exactly what their role requires — no more. This minimizes the damage that can result from compromised credentials, insider threat, or accidental misuse.

Question 4

Which control BEST prevents a single employee from both initiating a payment AND approving that same payment for processing?

Accepted Answer

Segregation of duties between payment initiation and payment approval roles

Answer

Segregation of duties (SoD) assigns the initiation and authorization steps of a payment workflow to different individuals, ensuring no single employee can complete a fraudulent transaction without a second party's involvement. MFA and password controls address authentication, not authorization workflow separation.

Question 5

'Out-of-band' authentication for high-value payment transactions refers to verifying the transaction through:

Accepted Answer

A separate communication channel from the one used to initiate or request the payment

Answer

Out-of-band authentication uses a different channel — such as a phone call or SMS to a registered number — to confirm a transaction that was initiated via online banking or another channel. This defeats man-in-the-browser attacks because the attacker controlling the primary channel cannot intercept the secondary channel.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Authentication & Access Controls in Payments