Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

A bank's operational risk team classifies a newly adopted control: a network intrusion detection system that raises an alert when unusual outbound data transfers occur, but does not block them. Under the standard classification of control types used in operational risk mitigation, this control is best described as:

The control is detective. It identifies unusual outbound data transfers and raises alerts but does not block them. Preventive controls stop events before they occur, while corrective controls repair damage afterwards, so an alert-only intrusion detection system fits the detective category.

  1. APreventive
  2. BDetectiveCorrect
  3. CCorrective
  4. DDirective

Explanation

An intrusion detection system that alerts on unusual activity identifies events after they begin but does not stop them. That is a detective control. A preventive control would block the transfer, and a corrective control would restore systems or limit damage after detection.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions