Free APRP Practice Questions
10 free, exam-style Accredited Payments Risk Professional (APRP) practice questions with answers and
explanations. No signup required. Work through them below, then take the
full free APRP practice test to study every exam domain.
Question 1
An ODFI reviews its origination data and finds that over the prior two calendar months, its unauthorized entry return rate has reached 0.6%. Under current Nacha Operating Rules, this rate:
- Is within acceptable limits but should be monitored
- Triggers an inquiry under the Administrative Return Rate Threshold
- Exceeds the Unauthorized Entry Return Rate Threshold and constitutes a rules violation
- Triggers an inquiry under the Overall Return Rate Threshold
Show answer & explanation
Correct answer: C - Exceeds the Unauthorized Entry Return Rate Threshold and constitutes a rules violation
Question 2
A corporate controller receives an email appearing to be from the company's CEO requesting an urgent $185,000 wire transfer to a new vendor for a confidential acquisition. The email instructs the controller not to discuss the matter with anyone. After the wire is sent, the CEO denies sending the email. This fraud is BEST classified as:
- Account takeover fraud
- Business email compromise
- Synthetic identity fraud
- First-party fraud
Show answer & explanation
Correct answer: B - Business email compromise
Question 3
A small business customer of an RDFI calls to report that an ACH debit posted to its corporate account was not authorized by the company. The entry was originated under the CCD Standard Entry Class. Within how many days of settlement must the RDFI return the entry, and which return reason code applies?
- 60 days, using R10
- 60 days, using R29
- 2 banking days, using R29
- 2 banking days, using R10
Show answer & explanation
Correct answer: C - 2 banking days, using R29
Question 4
A Third-Party Sender (TPS) processes ACH entries on behalf of multiple Originators through its sponsoring ODFI. The TPS argues it is not required to conduct its own ACH risk assessment because its ODFI conducts a comprehensive risk assessment that covers the TPS's activity. Under Nacha Operating Rules, this position is:
- Correct, provided the ODFI's risk assessment specifically addresses TPS-originated entries
- Correct, because the TPS is bound by the ODFI's risk management framework
- Incorrect, because each TPS must conduct its own ACH risk assessment
- Incorrect, only if the TPS originates more than 6 million entries per year
Show answer & explanation
Correct answer: C - Incorrect, because each TPS must conduct its own ACH risk assessment
Question 5
An Originator initiates ACH debits to consumer accounts for online retail purchases using the WEB Standard Entry Class. Under Nacha's account validation requirement effective March 19, 2021, the Originator must:
- Use a commercially reasonable fraudulent transaction detection system that includes account validation for the first use of an account number
- Validate every WEB debit before transmission, regardless of whether the account has been used before
- Use account validation only for transactions exceeding $1,000
- Obtain written authorization from the consumer for every WEB debit
Show answer & explanation
Correct answer: A - Use a commercially reasonable fraudulent transaction detection system that includes account validation for the first use of an account number
Question 6
An ODFI submits a Same Day ACH credit file to its ACH Operator at 2:30 p.m. ET. The credit is destined for an RDFI in the Pacific Time zone. Which Same Day ACH processing window will this file enter, and at what time (ET) will the entry be settled?
- Window 1; settled at 1:00 p.m. ET
- Window 2; settled at 5:00 p.m. ET
- Window 3; settled at 6:00 p.m. ET
- The file will not qualify for Same Day processing
Show answer & explanation
Correct answer: B - Window 2; settled at 5:00 p.m. ET
Question 7
Which of the following is TRUE of the FedNow Service but NOT of The Clearing House's RTP network?
- Operates 24 hours per day, 365 days per year
- Provides instant, irrevocable settlement to the receiving institution
- Settles transactions through each participating institution's master account at a Federal Reserve Bank
- Has a per-transaction limit of $10 million
Show answer & explanation
Correct answer: C - Settles transactions through each participating institution's master account at a Federal Reserve Bank
Question 8
Which of the following is the newly added function in NIST Cybersecurity Framework 2.0 (released February 26, 2024) that was not present in CSF 1.1?
- Identify
- Protect
- Govern
- Recover
Show answer & explanation
Correct answer: C - Govern
Question 9
A consumer notifies their financial institution on Day 8 after the periodic statement was sent of an unauthorized ACH debit posted to their account. The FI determines that further investigation beyond 10 business days is needed. To use the extended investigation period of up to 45 calendar days, the FI must:
- Complete the investigation within 10 business days regardless of complexity
- Provide provisional credit to the consumer's account within 10 business days of the notice
- Obtain a written statement of unauthorized debit from the consumer
- Notify the consumer in writing that the investigation will exceed 10 business days
Show answer & explanation
Correct answer: B - Provide provisional credit to the consumer's account within 10 business days of the notice
Question 10
A commercial customer authorizes wire transfers through its bank's online portal using a security procedure that the customer agreed to in writing. The procedure includes a unique customer ID, password, and a hardware token. An unauthorized party obtains the customer's credentials through a phishing attack and initiates a fraudulent $250,000 wire that is verified by the security procedure and executed by the bank in good faith. Under UCC Article 4A, which party MOST LIKELY bears the loss?
- The bank, because the wire was unauthorized
- The customer, because the security procedure was commercially reasonable and the bank acted in good faith
- The bank, because phishing constitutes a failure of the bank's authentication system
- The customer, only if the customer had previously been notified of phishing risks
Show answer & explanation
Correct answer: B - The customer, because the security procedure was commercially reasonable and the bank acted in good faith