Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's board is reviewing its cyber strategy. Management proposes to focus only on preventing every intrusion at the perimeter. Which statement best reflects the concept of cyber resilience as distinct from traditional cybersecurity?

Cyber resilience assumes some attacks will get through and stresses the capacity to keep critical operations running, respond and recover. It is broader than perimeter prevention or backups alone, and it still relies on identifying critical assets and threats.

  1. ACyber resilience assumes some attacks will succeed and emphasizes the ability to continue critical operations, respond and recoverCorrect
  2. BCyber resilience is achieved when perimeter controls block all known malware signatures
  3. CCyber resilience concerns only the recovery of data backups after an outage
  4. DCyber resilience replaces the need for identification of critical assets and threats

Explanation

Cyber resilience extends beyond prevention: it accepts that breaches can occur and focuses on anticipating, withstanding, responding to and recovering from them while maintaining critical services. Perimeter-only prevention and backup-only recovery are each just one component, and resilience still depends on identifying critical assets.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions