CFP Open Banking & API Integration 2

Question 1

Why is 'screen scraping' controversial in the context of financial data access?

Accepted Answer

It accesses bank portals by simulating user logins, bypassing security controls and posing data privacy risks

Answer

It requires customers to pay additional fees to access their own data

Answer

It violates copyright law by copying bank website content

Answer

It generates excessive API traffic that overloads bank servers

Question 2

What is the Financial Data Exchange (FDX) in the context of US open banking?

Accepted Answer

An industry-led nonprofit consortium that develops standardized APIs for secure financial data sharing

Answer

A federal agency established by the CFPB to regulate financial data sharing

Answer

A cryptocurrency exchange platform regulated by FinCEN

Answer

A mandatory clearinghouse for financial data established under Dodd-Frank

Question 3

Which security protocol is required to protect data in transit between open banking APIs and third-party providers?

Accepted Answer

TLS 1.2 or higher (preferably TLS 1.3)

Answer

SSL 2.0 for legacy bank system compatibility

Answer

SSH tunneling for all API connections

Answer

IPSec for network-layer encryption

Question 4

In open banking, what is the purpose of a 'sandbox environment' provided by banks or open banking platforms?

Accepted Answer

A testing environment where developers can integrate and validate APIs using mock data without accessing real customer accounts

Answer

A restricted bank branch for piloting new financial products with select customers

Answer

A secure credential vault for storing API keys and OAuth tokens

Answer

A compliance review portal for submitting fintech application approvals

Question 5

What is 'Banking as a Service' (BaaS) and how does it leverage open banking principles?

Accepted Answer

A model where banks expose their regulated infrastructure and financial services via APIs to enable non-bank businesses to embed banking capabilities

Answer

A premium service where banks manage investments on behalf of high-net-worth clients

Answer

A government-mandated service providing free banking access to underserved populations

Answer

A cloud-based service for banks to migrate their core systems to modern infrastructure

Question 6

Which of the following best describes 'tokenization' as applied in open banking security?

Accepted Answer

Replacing sensitive financial data with non-sensitive surrogate tokens that map back to the original data in a secure vault

Answer

Converting cryptocurrency holdings to equivalent fiat currency values

Answer

Generating time-limited one-time passwords for API endpoint authentication

Answer

Encrypting API request payloads using asymmetric public-key cryptography

Question 7

What does 'Strong Customer Authentication' (SCA) require under PSD2?

Accepted Answer

Authentication using at least two independent factors from knowledge, possession, and inherence categories

Answer

Passwords of at least 16 characters with special characters for all online banking logins

Answer

Biometric-only authentication for all payment transactions above €30

Answer

Annual re-verification of customer identity by the account-holding bank