10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The CCBA exam has 130 questions and runs 3 hours.
These 10 free CCBA questions are organized by exam domain, so you can see how each part of the Certification of Capability in Business Analysis blueprint is tested. Reveal the answer and explanation under each question.
During a loan-origination system project, the chief operating officer asks internal audit to review proposed access roles and sign the final production-access approval. The audit charter permits advisory work, and qualified management personnel can approve the configuration. Where should the chief audit executive draw the line?
Correct answer: A - Advise on control design; leave approval and ownership to management.
Quarterly updates reach the audit committee after several activities received low residual-risk ratings. Which update invalidates the control basis for its rating, rather than merely reporting a business change?
Correct answer: D - A conversion removed automated overdraft limits; the promised replacement review has not begun.
For a control-reliance test, the approved sampling plan requires the one-sided 95% upper deviation limit to be no greater than 4%. A valid random sample produces an observed deviation rate of 1.25% and a calculated upper limit of 5.8%. The supervisor marks the control reliable because 1.25% is below 4%. The workpaper conclusion should instead state:
Correct answer: C - The evidence does not meet the specified criterion for planned reliance.
An analyst tests collateral-documentation completeness by joining the secured-loan register to the collateral register on LoanID. The inner join retains only loans with a matching collateral record. Every output row contains collateral details, so the analyst reports no missing documentation. Which additional output is essential before accepting that conclusion?
Correct answer: A - Secured LoanIDs with no matching collateral record.
A manufacturer loses its principal customer, and its loan no longer shares the risk characteristics of the commercial loan pool. The bank develops a supported individual estimate of expected credit losses. During the allowance reconciliation, the auditor finds that the same loan also remains in the balance used to calculate the collective allowance. The controller calls the extra coverage prudent. Which correction is warranted?
Correct answer: B - Remove the loan from the pool and retain its supported individual estimate.
A borrower's annual debt-service covenant requires recurring cash available for debt service divided by scheduled principal and interest to be at least 1.20. The review worksheet shows $460,000 of cash available, but that amount includes $70,000 from a one-time equipment sale. Scheduled principal is $280,000 and interest is $70,000 for the same year. No waiver has been granted. Which ratio and covenant conclusion belong in the review?
Correct answer: B - 1.11; the covenant is breached.
A loan servicer provides a SOC 1 Type 2 report with an unmodified opinion. Its data-center host is treated by the carve-out method: the host's access and backup controls were excluded from the service auditor's testing. Those controls are necessary to the bank's reliance on the service, and no other evidence covers them. What would close this assurance gap?
Correct answer: C - Obtain relevant independent assurance over the excluded host controls.
Ransomware disrupts a national bank's deposit-processing system. Management determines that the event has materially disrupted services to a substantial portion of customers and meets the OCC definition of a notification incident. Containment is underway, but investigators have not determined whether data left the network. Under 12 CFR Part 53, the bank's notification obligation is to:
Correct answer: D - Notify the OCC as soon as possible, and within 36 hours after the notification-incident determination.
An outgoing $240,000 wire is awaiting release. The customer's usual email address supplied new beneficiary instructions this morning. Two employees approved the change, but the callback used a telephone number in that email rather than the different, previously verified number on file. No other suspicious activity is known. Before the wire cutoff, the auditor should recommend that operations:
Correct answer: D - Hold this wire and confirm the change using the previously verified telephone number.
After an audit report has been distributed, the chief audit executive discovers that a spreadsheet error overstated the exception rate and changed the engagement rating. The corrected figures have been validated; the underlying transaction testing remains reliable. How should the issued communication be handled?
Correct answer: B - Promptly communicate the corrected information to all original recipients.
The full bank has 1,020 more CCBA questions with explanations.
Continue in the free practice test →
View plans