Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

After a breach, a review finds that attackers who compromised one employee's credentials moved freely from the corporate network into the payment processing environment and the customer database. Which control improvement would MOST directly limit this lateral movement in future?

Network segmentation with least-privilege access between zones is the best fix. It separates sensitive environments such as payments and customer data from the general corporate network, so one compromised credential cannot be used to roam across systems. Insurance and password expiry do not restrict lateral movement.

  1. ANetwork segmentation with least-privilege access between zonesCorrect
  2. BIncreasing the frequency of employee password expiry to weekly
  3. CPurchasing additional cyber insurance cover
  4. DExpanding the public website's content filtering

Explanation

The failure was unrestricted movement between environments. Segmentation and least-privilege access confine an intruder to one zone. Insurance transfers loss but does not limit spread, and frequent password changes do not stop use of already stolen valid credentials.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions