FRM Exam Part II · Cyber-resilience: Range of Practices

Protection, Detection and Controls in Cyber-Resilience

Updated 11 October 2026 · Fact-checked

Protection controls stop or limit a cyber attack before damage occurs: access management, network security, encryption and patching. Detection controls spot attacks that get through: monitoring, logging and alerts. Testing, such as penetration tests and red teaming, checks both. Match the control's timing and purpose to the scenario to answer.

Understand Protection, Detection and Controls

Cyber-resilience practices are usually grouped by function: identify, protect, detect, respond and recover. This topic covers protect and detect, plus the testing that proves they work. Identification, response and recovery are studied elsewhere.

Preventive (protective) controls reduce the chance that an attack succeeds. Examples: access management (least privilege, multi-factor authentication, privileged access management, joiner-mover-leaver reviews), network security (segmentation, firewalls, filtering), secure configuration, patching, encryption of data at rest and in transit, and staff awareness training. The aim is to make an attack harder and to limit how far it can spread.

Detective controls find attacks or weaknesses that preventive controls missed. Examples: continuous monitoring, log collection, a security operations centre, intrusion detection, anomaly and fraud alerts, and file-integrity checks. Detection matters because no prevention is perfect. The key measure is how quickly an attack is spotted, since dwell time drives the damage.

Testing gives assurance. A vulnerability scan is automated and finds known weaknesses. A penetration test is a scoped, usually announced exercise in which testers try to exploit specific systems to show how far they can get. Red teaming is broader and goal-based. It simulates a real adversary across people, process and technology, often with little notice to the defenders, so it also tests detection and response. A threat-led test uses current threat intelligence to choose realistic attack methods.

Third-party risk controls matter because attackers often enter through suppliers. Banks do due diligence before onboarding, set security and incident-notification terms in contracts, and monitor providers over time. They also assess concentration in cloud or other critical providers, map fourth parties, and plan exit and substitution. Responsibility stays with the bank even when a service is outsourced.

No single layer is enough. Good practice uses defence in depth: several independent controls, so one failure does not mean a breach.

Key formulas to remember

Preventive vs detective: Preventive = before or during an attack (reduce likelihood); Detective = during or after (reduce dwell time and impact); Classify by what the control does at the moment it acts, not by the tool name.
Penetration test vs red team: Penetration test = scoped, specific systems, usually announced; Red team = goal-based, realistic adversary, tests people, process and technology and defender response; Red teaming tests detection and response as well as technical weaknesses.
Vulnerability scan vs penetration test: Scan = automated, finds known weaknesses; Penetration test = manual exploitation to prove impact; A scan does not show whether a weakness can actually be chained into a breach.
Least privilege: Access granted = minimum needed for the role, for the time needed; Pair with periodic access recertification and privileged access management.
Defence in depth: Several independent layers, so one control failure does not cause a breach; Use it to justify combining preventive and detective controls.
Third-party risk lifecycle: Due diligence → contract terms → ongoing monitoring → exit planning; Accountability remains with the bank, not the provider.

How to solve Protection, Detection and Controls questions

Use this method for any scenario on cyber protection, detection, testing or third-party controls.

1Read the scenario and note what happened and when: before, during or after the attack.
2Identify the control in question and ask what it does: stop, spot, or verify.
3Classify it as preventive, detective or testing. A test is assurance, not a control that blocks attacks.
4If testing, check scope, realism and who knows about it. Narrow and announced points to a penetration test; goal-based and covert points to red teaming.
5If a supplier is involved, locate the stage: due diligence, contract, monitoring or exit. Remember accountability stays with the bank.
6Look at the gap: is there a missing layer (defence in depth) or slow detection?
7Eliminate options that overstate, such as 'eliminates risk' or 'only needed once', and pick the one that fits the stage and purpose.

Quickest way: Timing and purpose check

When to use it: For short MCQs asking you to classify a control or choose the best next action.

Ask: does it stop the attack, or tell us it happened?
Stop = preventive. Tell = detective. Prove it works = testing.
For testing, ask: narrow and announced, or realistic and covert?
For suppliers, ask: before contract, in contract, or after onboarding?
Reject absolute wording such as 'guarantees' or 'eliminates'.

Common mistakes in Protection, Detection and Controls

Calling monitoring or logging a preventive control.
Alerts can trigger a block, so students assume monitoring prevents attacks.
Fix: Monitoring finds activity; it is detective unless it is an automated blocking tool. Check what the question says the control does.
Treating penetration testing and red teaming as the same thing.
Both involve ethical hackers attacking the bank.
Fix: A penetration test is scoped and usually announced. Red teaming is goal-based, adversary-like and tests detection and response too.
Assuming a vulnerability scan proves systems are secure.
A clean report feels like assurance.
Fix: Scans only find known weaknesses. Penetration tests show whether weaknesses can be exploited.
Believing outsourcing moves cyber accountability to the provider.
The provider runs the system, so students think it owns the risk.
Fix: The bank stays accountable. It must do diligence, set contract terms and monitor the provider.
Thinking strong preventive controls remove the need for detection.
Students think a good perimeter is enough.
Fix: Assume prevention will sometimes fail. Detection limits dwell time and damage, which is the idea behind defence in depth.
Treating testing as a one-off event.
Tests are often scheduled projects.
Fix: Testing should be repeated, risk-based and updated for new threats and system changes, with findings tracked to fix.

Worked examples

Example 1

A bank's analysts notice unusual outbound data transfers from a server at 2 a.m. An alert from the security operations centre led to the finding. The firewall rules had not blocked the traffic. Which statement is most accurate? A) The alert is a preventive control that failed. B) The alert is a detective control that worked, and the firewall gap is a preventive weakness. C) The alert is a test of the firewall. D) Both controls are detective.

Show the solution

The alert from the security operations centre found activity after it began. That is detective.
It worked, since it identified the unusual transfer.
The firewall rules were meant to block such traffic and did not. That is a preventive weakness.
Option A mislabels the alert. Option C confuses a live alert with testing. Option D mislabels the firewall.

Answer: B. The alert is a detective control that worked; the firewall gap is a preventive weakness.

Example 2

A bank wants to know whether its security team would notice and stop a realistic attacker trying to reach its payment systems, with little warning to defenders and using current threat intelligence. Which is the most suitable exercise? A) Vulnerability scan B) Scoped penetration test of one application C) Threat-led red team exercise D) Annual access recertification

Show the solution

The goal is to test whether defenders notice and respond. That points to a test of detection and response, not only technical flaws.
Realistic attacker, little warning and threat intelligence describe a threat-led red team.
A scan only lists known weaknesses. A scoped penetration test covers one application and is usually announced.
Access recertification is a preventive housekeeping control, not a test of detection.

Answer: C. A threat-led red team exercise.

Exam tips

Classify first by timing: stop, spot or verify. Most MCQs reduce to that.
Know the penetration test versus red team contrast in one sentence each; it is a favourite distractor pair.
For third-party questions, pick the answer that keeps accountability with the bank and covers the whole lifecycle.
Be wary of absolute words such as 'eliminates', 'guarantees' or 'only'.
Link to the wider framework: protect and detect sit between identify and respond and recover.

Practice questions from Cyber-resilience: Range of Practices

Protection, Detection and Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Protection, Detection and Controls: frequently asked questions

What is the difference between preventive and detective cyber controls?

Preventive controls reduce the chance an attack succeeds, for example multi-factor authentication, network segmentation and patching. Detective controls find attacks that get through, for example monitoring, logging and alerts. Banks need both because prevention is never perfect.

What is the difference between penetration testing and red teaming?

A penetration test is scoped to specific systems and is usually known to the defenders. Red teaming is goal-based, imitates a real adversary and tests people and processes, including detection and response. Red teaming is broader and more realistic.

How do banks manage third-party cyber risk?

They do due diligence before onboarding, set security and incident-notification terms in the contract, and monitor the provider on an ongoing basis. They also look at concentration, fourth parties and exit plans. The bank remains accountable for the outsourced service.

Is a vulnerability scan the same as a penetration test?

No. A scan is automated and lists known weaknesses. A penetration test involves testers actively exploiting weaknesses to show real impact.