FRM Part II · FRM Exam Part II · Risk Mitigation
A bank has a critical service with an impact tolerance of 6 hours. Scenario testing of a severe but plausible ransomware event yields these sequential recovery times: detection and decision to invoke the plan 1.5 hours, isolation and clean environment rebuild 3 hours, data restoration 2 hours, and validation 1 hour, with no parallelisation possible for the first three steps and validation overlapping the final 0.5 hour of data restoration. What is the correct assessment?
The total recovery time is 7.0 hours, breaching the 6-hour impact tolerance by 1 hour. Sequential steps sum to 6.5 hours, and validation adds only 0.5 hour beyond the overlap with data restoration. The firm must shorten recovery or invest in remediation.
- ATotal time 7.0 hours; tolerance breached by 1.0 hourCorrect
- BTotal time 7.5 hours; tolerance breached by 1.5 hours
- CTotal time 8.5 hours; tolerance breached by 2.5 hours
- DTotal time 6.0 hours; tolerance exactly met
Explanation
Sequential steps: 1.5 + 3 + 2 = 6.5 hours. Validation takes 1 hour but 0.5 hour overlaps restoration, adding only 0.5 hour: total 7.0 hours. This exceeds the 6-hour tolerance by 1.0 hour. Adding validation fully gives 7.5, ignoring the overlap. Summing all without overlap and mislabeling gives other wrong figures.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank estimates a ransomware event has an annual probability of 10% and an expected loss of USD 20 million per event. A proposed control su…
- A bank discovers that its critical vendor relies on a subcontractor (a fourth party) to host client data. What is the most appropriate respo…
- Which testing approach best demonstrates that a firm can actually remain within its impact tolerances for an important business service duri…
- A bank's payments unit identifies that a manual reconciliation step causes frequent errors. Management decides to automate the step and add …
- After a breach investigation, a bank finds that an attacker used stolen credentials of a vendor to move laterally from a low-sensitivity rep…
- During due diligence on a prospective cloud service provider, which finding should most concern a bank's risk committee when the service sup…