Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A risk manager wants to test whether the bank's cyber defences and response would hold up against a realistic, targeted attack by a skilled adversary, including detection and response capabilities. Which assessment is most appropriate?

A threat-led penetration test or red-team exercise, based on current threat intelligence, is most appropriate because it emulates a realistic adversary and tests detection and response as well as technical defences. Automated scans and policy reviews do not test an end-to-end attack or the bank's response.

  1. AAn automated vulnerability scan run weekly against internet-facing hosts
  2. BA threat-led penetration test or red-team exercise based on current threat intelligenceCorrect
  3. CA review of the written information security policy for completeness
  4. DA tabletop discussion limited to the finance department

Explanation

Threat-led penetration or red-team testing emulates real adversary tactics and tests people, process and technology including detection and response. A vulnerability scan finds known weaknesses but does not test an attack chain or response, and policy reviews test documentation only.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions