Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's security team wants to reduce the damage an attacker can do if a single employee's credentials are stolen. Which protective control most directly applies the principle of least privilege?

Granting users only the access their role needs, and reviewing it regularly, applies least privilege. It limits what an attacker can reach with a stolen credential. Password rotation, perimeter firewalls and awareness training are other controls but do not restrict account permissions.

  1. AGranting each user only the access rights needed for their current role and reviewing them regularlyCorrect
  2. BRequiring all staff to change passwords every 30 days
  3. CInstalling a perimeter firewall at the network edge
  4. DRunning annual phishing awareness training

Explanation

Least privilege limits each account to the access its role requires, so stolen credentials expose less. Password rotation, firewalls and training are useful controls but do not restrict the scope of access granted to an account.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions