Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

A bank's security architecture assumes no user or device is trusted by default, even inside the corporate network, and requires continuous verification and least-privilege access for each request. Which approach does this describe?

This describes a zero trust architecture. It treats every user and device as untrusted regardless of network location, verifying each request continuously and granting only least-privilege access. Perimeter defense, by contrast, trusts those already inside the network, which is the assumption zero trust rejects.

  1. APerimeter-based defense
  2. BZero trust architectureCorrect
  3. CSecurity by obscurity
  4. DDisaster recovery site failover

Explanation

Zero trust assumes no implicit trust based on network location and verifies every request with least privilege. Perimeter defense trusts internal users once inside, and security by obscurity relies on secrecy of design. Failover is a resilience measure, not an access model.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions