Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's threat-intelligence function receives 400 indicator feeds from forums, vendors and peers. Analysts spend most time triaging low-value alerts, and several relevant indicators were missed last quarter. Which response best improves the effectiveness of the bank's information-sharing programme?

The bank should prioritise and filter intelligence by relevance to its own technology and threat profile, integrate it into detection and response, and use feedback on usefulness. Adding feeds worsens overload, abandoning external intelligence loses peer learning, and a lone junior analyst is inadequate.

  1. ASubscribe to additional feeds to increase coverage
  2. BStop consuming external intelligence and rely on internal logs only
  3. CPrioritise and filter intelligence by relevance to the bank's own technology and threat profile, and integrate it into detection and response processes with feedback on usefulnessCorrect
  4. DAssign all feed review to a single junior analyst to reduce cost

Explanation

The problem is volume without relevance, not coverage. Contextual prioritisation, integration into operations and a feedback loop turn intelligence into action. More feeds worsen overload, and dropping external data forfeits learning.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions