Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank's security team discovers that attackers entered through a third-party vendor's stolen credentials, then moved across internal systems for months before being detected. Which control improvement would most directly limit the attackers' ability to move laterally after an initial compromise?

Network segmentation with least-privilege access best limits lateral movement, because it confines an intruder to a small part of the environment after initial entry. Training and backups address entry probability or recovery, not containment of an attacker already moving inside the network.

  1. ANetwork segmentation combined with least-privilege access controlsCorrect
  2. BIncreasing the frequency of employee phishing awareness training
  3. CExtending the retention period for backup tapes
  4. DAdding a second sign-off on all marketing communications

Explanation

Lateral movement is constrained by dividing the network into segments and restricting accounts to the minimum access needed. Awareness training reduces initial entry likelihood but does not contain an intruder already inside. Backup retention aids recovery, not containment.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions