FRM Part II · FRM Exam Part II · Risk Mitigation
A global bank relies on one cloud provider for its card authorisation service. A resilience review finds that both the primary and backup environments are hosted in the same provider region. Which action most directly addresses the weakness identified?
Moving the backup to an independent region or provider and testing failover addresses the identified single point of failure. Both environments sharing one region means a regional outage defeats both. Insurance transfers financial loss but does not restore the card authorisation service for customers.
- AIncrease operational risk insurance coverage for outage losses
- BShorten the frequency of employee code-of-conduct training
- CRe-locate the backup to an independent region or provider and test failover from itCorrect
- DRaise the loss-event reporting threshold for the incident database
Explanation
The weakness is a concentration/single point of failure in the recovery arrangement. Geographically and technically independent backup, proven by failover testing, mitigates it directly. Insurance only transfers part of the financial loss without restoring service. Training and reporting thresholds do not alter the dependency.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- A bank considers insurance mitigation under an advanced measurement approach-style framework. A risk manager notes that the insurance policy…
- A risk manager compares two mitigation options for a fraud risk with expected annual loss of USD 2.0 million. Option A costs USD 0.6 million…
- A bank's ransomware scenario shows an annual probability of 5% and a loss of USD 40 million if it occurs. Management considers two options. …
- A bank estimates that, without a new email-filtering control, phishing-related losses would have an expected annual loss of USD 4.0 million.…
- A bank considers shifting part of its cyber risk to a captive insurance subsidiary that reinsures with external markets. Which statement bes…
- A bank has a cyber insurance policy with a USD 50 million limit. Its scenario analysis shows a severe but plausible cyber event could cause …