Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A regional bank's security team observes that a group has gained access to its payment-messaging environment, remained undetected for several months, and used custom tooling to study internal processes before initiating fraudulent transfers. Which description of the threat actor best fits this behaviour?

The behaviour matches an advanced persistent threat. Such actors are targeted and well resourced, stay undetected for long periods, use custom tools and study internal processes before acting. Opportunistic attackers, DDoS campaigns and accidental disclosures do not combine prolonged covert access with deliberate fraud.

  1. AAn advanced persistent threat using stealthy, long-term, targeted intrusionCorrect
  2. BAn opportunistic script-based attacker using publicly available tools for a one-off defacement
  3. CA distributed denial-of-service campaign aimed at overwhelming web capacity
  4. DAn accidental insider disclosure caused by misdirected email

Explanation

Long dwell time, custom tooling, reconnaissance of internal processes and a targeted financial objective are hallmarks of an advanced persistent threat. A script-based opportunist would not remain hidden for months or study payment processes. DDoS and accidental disclosure do not involve prolonged covert access.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions