Free FINOS Financial Services Certified Open Source Developer (FSOSD) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the FINOS Financial Services Certified Open Source Developer (FSOSD) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A participant observes a code-of-conduct violation at a FINOS Foundation event. Which event-specific reporting contact is named in the FINOS code?

   1. A.Any FINOS representative on-siteCorrect answer: A
   2. B.Only the project's lead maintainer
   3. C.Only the participant's line manager
   4. D.Only the event's peer contributors

   Explanation: "If you observe or are subject to a violation of these rules at a Foundation event, please report the matter to any FINOS representative on-site." The code specifies the on-site Foundation representative for an event violation.

   Reference: FINOS Community Code of Conduct — Reporting Violations

2. 2A company distributes substantial portions of MIT-licensed software. What notices does the MIT license require it to include?

   1. A.Only the permission notice
   2. B.Both notices only in source copies
   3. C.The copyright notice and permission noticeCorrect answer: C
   4. D.Only the copyright notice

   Explanation: "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software." The other notice combinations omit a required notice, while a downstream-user list is not the stated requirement.

   Reference: The MIT License — License text

3. 3What does a software bill of materials (SBOM) primarily record?

   1. A.Components and their supply chain relationshipsCorrect answer: A
   2. B.Only components developed directly by the product supplier
   3. C.Only components with known vulnerabilities
   4. D.Only direct components, excluding their relationships

   Explanation: "An SBOM is a formal record containing the details and supply chain relationships of various components used in building software." The record provides component transparency; it is neither just a contract list nor a vulnerability-only record.

   Reference: Securing the Software Supply Chain: Recommended Practices for Managing Open-Source Software and Software Bill of Materials — Section 5.1, Software Bill of Materials Background

4. 4A developer accidentally includes confidential client records in a public open source contribution. Which risk does this most directly illustrate?

   1. A.Data leakage riskCorrect answer: A
   2. B.Dependency sustainability risk
   3. C.License compatibility risk
   4. D.Contribution-approval delay

   Explanation: "Data leakage risk refers to the potential for sensitive or confidential information to be unintentionally or maliciously disclosed outside of an organization". Publishing confidential client records is an unintended external disclosure.

   Reference: Data Leakage Risk — Data Leakage Risk

5. 5For a broker-dealer under FINRA's guidance, what determines whether an electronic communication is related to firm business for recordkeeping?

   1. A.Whether the communication is sent outside working hours
   2. B.Whether the message uses a public platform
   3. C.The content and the facts and circumstancesCorrect answer: C
   4. D.Whether the device is personally owned

   Explanation: "This analysis does not depend upon the type of device or technology used to transmit the communication, nor does it depend upon whether it is a firm-issued or personal device of the individual; rather, the content of the communication is determinative." A personal device or third-party platform does not by itself remove recordkeeping obligations.

   Reference: Regulatory Notice 11-39: Social Media Websites and the Use of Personal Devices — Recordkeeping, Question 1

6. 6Outside an event, how does FINOS's conduct policy direct a witness to escalate a violation?

   1. A.Email legal@linuxfoundation.orgCorrect answer: A
   2. B.Privately email the project's security response team
   3. C.File a confidential vulnerability report with project maintainers
   4. D.Ask the person's line manager to handle the matter internally

   Explanation: "Please report any other code of conduct violations by emailing legal@linuxfoundation.org." This is the code's stated route for other violations.

   Reference: FINOS Community Code of Conduct — Reporting Violations

7. 7A developer distributes an Apache License 2.0 work to a recipient. Under section 4(a), who must receive a copy of the license?

   1. A.Recipients only when the work is modified
   2. B.Each recipient of the work or derivativeCorrect answer: B
   3. C.Recipients only when they request it
   4. D.Recipients only when they receive source code

   Explanation: "You must give any other recipients of the Work or Derivative Works a copy of this License; and" Section 4 applies to source or object form, with or without modifications.

   Reference: Apache License, Version 2.0 — Section 4(a), Redistribution

8. 8What is the function of a package manager in the open source supply chain?

   1. A.Manage the installation and upgrading of packagesCorrect answer: A
   2. B.Archive packages for distribution from a repository
   3. C.Review the source changes proposed by contributors
   4. D.Determine which vulnerabilities affect each product

   Explanation: "Package Managers: Tools or software that automate the process of installing, upgrading, configuring, and removing software packages in a consistent manner." The other choices confuse package management with legal authority or security assurance.

   Reference: Open Source Supply Chain Security — Components of the Open Source Supply Chain

9. 9Why does FINOS's reference policy call for accounting review when company software is contributed under a typical royalty-free open source license?

   1. A.The software asset may require a financial write-down.Correct answer: A
   2. B.Royalty-free reuse guarantees future license revenue.
   3. C.A write-down is impossible while the firm retains any copyright.
   4. D.Royalty-free terms end automatically after the first distribution.

   Explanation: "account must be made of any financial write down of the software asset." The reference policy links royalty-free licensing to a possible write-down, rather than an automatic copyright expiry.

   Reference: Reference FOSS Policy — FOSS Contribution Risk, Financial Loss

10. 10Under FINRA Notice 11-39, why may a broker-dealer not use a business communication device whose technology automatically erases its communications?

    1. A.It would preclude retention needed for recordkeeping compliance.Correct answer: A
    2. B.It changes the content into a non-business communication.
    3. C.It turns all communications into static advertising.
    4. D.It transfers the recordkeeping obligation to the device vendor.

    Explanation: "Technology that automatically erases or deletes the content of an electronic communication would preclude the ability of the firm to retain the communications in compliance with their obligations under SEA Rule 17a-4." FINRA's notice therefore rules out such devices for the covered communications.

    Reference: Regulatory Notice 11-39: Social Media Websites and the Use of Personal Devices — Recordkeeping, Question 3