Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank scores cyber scenarios by annual frequency and loss per event. Scenario A: frequency 0.20, loss USD 10 million. Scenario B: frequency 0.05, loss USD 50 million. Scenario C: frequency 1.5, loss USD 1 million. The bank's risk appetite limits expected annual loss per scenario to USD 2 million and, separately, single-event loss to USD 20 million. Which scenario(s) breach at least one limit?

Only Scenario B breaches limits. Its expected annual loss is USD 2.5 million, above the USD 2 million limit, and its USD 50 million single-event loss exceeds USD 20 million. Scenario A equals the limit at USD 2 million and Scenario C is USD 1.5 million.

  1. AScenario B onlyCorrect
  2. BScenarios A and B only
  3. CScenarios B and C only
  4. DScenario A only

Explanation

Expected annual losses: A = 0.20×10 = 2.0 (equals the limit, no breach); B = 0.05×50 = 2.5 (breaches expected loss and single-event limit); C = 1.5×1 = 1.5 (within limit, event loss 1). Only B breaches. Choosing A treats a loss exactly at the limit as a breach.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions