FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices
A payments firm maps its cyber-resilience framework to the five functions commonly used in cyber guidance: identify, protect, detect, respond and recover. During a ransomware event, the firm restores clean backups, rebuilds affected servers and resumes customer processing. Which function is primarily being exercised?
The firm is exercising the recover function. Restoring clean backups, rebuilding servers and resuming customer processing are activities that return operations to normal after an incident, whereas detection finds the event, protection prevents it, and identification maps assets and risks beforehand.
- AIdentify
- BProtect
- CDetect
- DRecoverCorrect
Explanation
Restoring systems from backups and resuming services is the recover function, which returns operations to normal after an incident. Detect would be spotting the anomaly, and protect covers preventive safeguards put in place beforehand. Identify concerns understanding assets and risks.
Did you get it right without looking?
One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.
More Cyber-resilience: Range of Practices questions
- A bank's CISO reports to the Chief Information Officer (CIO), who also owns IT budgets and system delivery deadlines. An internal review not…
- A bank scores cyber scenarios by annual frequency and loss per event. Scenario A: frequency 0.20, loss USD 10 million. Scenario B: frequency…
- A bank hesitates to join a sector-wide cyber threat intelligence exchange because it fears that sharing details will expose it to legal and …
- A bank's board is reviewing its cyber-resilience framework. Which of the following best describes the board's appropriate role under the ran…
- Which approach to cyber strategy best reflects the practice of integrating cyber risk into the bank's broader enterprise risk management?
- A bank's board is reviewing how its approach to cyber risk should differ from a traditional information-security programme. Which statement …