Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A regional bank's security team observes a group that has quietly maintained access to its payment-switch network for eleven months, exfiltrating data in small volumes and avoiding any actions that would disrupt operations. Which description of the threat actor and its behavior fits best?

The behavior describes an advanced persistent threat. Eleven months of quiet access, small-volume data exfiltration and avoidance of disruption show a stealthy, patient, well-resourced actor focused on long-term access, unlike hacktivists, ransomware affiliates or opportunistic low-skill attackers who seek publicity or quick returns.

  1. AAn advanced persistent threat that prioritizes stealth and long-term accessCorrect
  2. BA hacktivist group seeking immediate publicity through website defacement
  3. CAn opportunistic script kiddie running automated scans for known vulnerabilities
  4. DA ransomware affiliate seeking rapid encryption of systems to force payment

Explanation

Long dwell time, low-and-slow exfiltration and avoidance of disruption are hallmarks of an advanced persistent threat. Hacktivists seek visibility and ransomware affiliates seek rapid monetization through disruption, so both conflict with the observed quiet behavior. Script kiddies rarely sustain such access for eleven months.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions