Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's cyber risk officer reviews the access management programme for its core payment platform. Several system administrators hold permanent privileged accounts that they use for routine email and web browsing. Which control change would most directly reduce the risk of credential compromise leading to full system takeover?

The best change is just-in-time privileged access with separate, monitored administrative accounts protected by multi-factor authentication. This applies least privilege and removes standing high-level rights from everyday use, so a phished credential cannot easily give an attacker full control of the payment platform.

  1. AIncrease the frequency of antivirus signature updates on administrator workstations
  2. BUse just-in-time privileged access with separate, monitored administrative accounts and multi-factor authenticationCorrect
  3. CExtend the password expiry period for privileged accounts to 365 days
  4. DDisable logging on privileged accounts to reduce storage costs

Explanation

Least-privilege principles call for limiting standing privileges, separating admin from everyday accounts, and strong authentication with monitoring. This shrinks the exposure window if credentials are phished. Longer password life or reduced logging weakens control, and antivirus updates do not address excessive privilege.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions