FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices
A bank's red team tests defences by simulating a realistic, intelligence-led attack on live production systems without the knowledge of most defenders. Which assessment technique does this describe?
This is threat-led penetration testing, or red teaming. It uses realistic adversary tactics against live systems, with few defenders informed, to test detection and response. Vulnerability scans, tabletop discussions and business impact analyses do not emulate an actual attacker in production.
- AThreat-led penetration testing (red teaming)Correct
- BAutomated vulnerability scanning
- CTabletop exercise
- DBusiness impact analysis
Explanation
Intelligence-led simulated attacks on live systems with limited defender awareness are red-team or threat-led penetration tests. Vulnerability scanning is automated and does not emulate an adversary's path. Tabletop exercises are discussion-based, and a business impact analysis measures consequences of disruption.
Did you get it right without looking?
One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.
More Cyber-resilience: Range of Practices questions
- During a cyber risk self-assessment, a bank's business units rate their own control effectiveness as strong, yet internal audit finds repeat…
- A firm relies on a cloud provider that itself uses several subcontractors. In the cyber risk identification process, what is the most approp…
- After a significant cyber incident is contained, a firm's CISO proposes a post-incident review. Which outcome of the review is most consiste…
- A bank's board is reviewing its cyber-resilience framework based on the range of practices observed across large financial institutions. Whi…
- A bank's board sets a cyber risk appetite statement. Which of the following is the most appropriate form of the statement for it to be effec…
- A bank is deciding how to govern cyber risk. Which arrangement is most consistent with sound cyber-resilience practice?