FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks
A bank's security team notes that its intrusion detection tools produce thousands of alerts daily, and analysts miss genuine attacks because of alert fatigue. Which control-framework action most directly addresses the detection weakness?
Tuning detection rules and prioritizing alerts by risk, within a security operations process that has clear escalation, directly fixes alert fatigue. The other options are preventive or recovery measures and do not improve analysts' ability to identify genuine attacks among the volume of alerts.
- ATune detection rules and prioritize alerts by risk, supported by a security operations process with defined escalationCorrect
- BIncrease the number of firewall rules at the network perimeter
- CRequire all staff to change passwords monthly
- DMove backups to a different data center
Explanation
Alert fatigue is a detection and response process problem. Tuning rules, risk-based prioritization and defined escalation paths improve the signal-to-noise ratio. Firewall rules and password rotation are preventive controls that do not fix triage of alerts, and backups address recovery.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.
More Case Study: Cyberthreats and Information Security Risks questions
- A bank classifies threat actors by motivation. Which pairing of actor and typical primary motivation is most accurate?
- After a breach, a review finds that attackers who compromised one employee's credentials moved freely from the corporate network into the pa…
- After a ransomware incident, a bank finds that attackers first sent employees emails mimicking an internal HR notice, harvested credentials,…
- A regional bank's security team observes a group that has quietly maintained access to its payment-switch network for eleven months, exfiltr…
- Which feature of cyber risk most complicates its quantification relative to other operational risk categories?
- A bank estimates that a phishing-led breach occurs with annual frequency 0.4 and an average loss of USD 5 million per event. A proposed cont…