FRM Part II · FRM Exam Part II · Risk Mitigation
A firm is designing scenario testing for operational resilience. Which scenario design best tests resilience of a critical service rather than only the technical recovery of one system?
The best design is a severe but plausible scenario, such as losing a key third-party provider, tested end to end across people, processes, technology and dependencies. This shows whether the whole service stays within impact tolerance, unlike single-system restores, document reviews, or tests restricted to likely events.
- AA severe but plausible scenario, such as loss of a key third-party provider, tested end to end across people, processes, technology and dependenciesCorrect
- BA routine backup restore test of a single database during a planned maintenance window
- CA review of the business continuity policy document for formatting and approval dates
- DA test limited to scenarios the firm considers very likely to occur
Explanation
Resilience testing should use severe but plausible scenarios and examine the whole service chain, including third parties, staff, and processes, against impact tolerance. A single-system restore, a document review, or only likely events do not show whether the service can remain within tolerance.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- Which contractual provision best supports a bank's ability to oversee an outsourced critical service on an ongoing basis?
- A bank's expected annual loss from a process is USD 4 million with an event frequency of 20 per year. A new control is projected to cut freq…
- A bank's disaster recovery test shows that its trading system, supported by a secondary data center, recovers in 6 hours. The business conti…
- A bank's incident response plan is reviewed. Which element most improves its ability to limit damage during an actual cyber incident?
- A bank's cyber-risk manager wants to limit the damage if an attacker compromises one employee's credentials, so that the attacker cannot mov…
- A bank wants its annual continuity testing to provide the strongest evidence that critical staff and systems can actually perform under a se…