Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's security operations centre receives thousands of alerts daily from separate tools, and analysts miss a slow data exfiltration that spans several systems over weeks. Which improvement best addresses this detection weakness?

Centralising logs and correlating events across systems, with behavioural baselines, best improves detection of slow multi-system exfiltration. Individual alerts look benign in isolation. Stronger passwords and offsite backups do not aid detection, and logging less data would worsen visibility.

  1. ACentralise log collection and correlate events across systems with analytics and baselining of normal behaviourCorrect
  2. BIncrease the length of required passwords
  3. CMove backups to an offsite location
  4. DReduce the number of logged event types to cut alert volume

Explanation

Slow, multi-system activity is visible only when events are aggregated and correlated against normal behaviour baselines. Longer passwords and offsite backups are not detection measures, and reducing logged events removes the data needed to spot the pattern.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions