Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank's risk team ranks a customer-data repository as high priority because a breach would expose personal information and trigger regulatory fines and reputational damage, although a brief outage would cause little harm. Which CIA objective should the team weight most heavily when selecting controls for this asset?

Confidentiality should be weighted most heavily, using access control, encryption and data-loss prevention. The main harm from this repository is unauthorised exposure of personal data leading to fines and reputational damage, while short outages matter little, so controls should target disclosure rather than uptime.

  1. AAvailability, through hot-standby systems
  2. BIntegrity, through checksum validation of every record
  3. CConfidentiality, through access control, encryption and data-loss preventionCorrect
  4. DRecoverability, through more frequent backups only

Explanation

The loss scenario is unauthorised disclosure, with outages tolerable. That makes confidentiality the dominant objective, served by access management, encryption and DLP. Standby systems and backups address availability, which is low priority here.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions