FRM Part II · FRM Exam Part II · Risk Mitigation
After a breach investigation, a bank finds that an attacker used stolen credentials of a vendor to move laterally from a low-sensitivity reporting server to the core customer database. Which mitigation would most directly limit the impact of a similar intrusion in future, assuming credentials may still be stolen?
Network segmentation with least-privilege access and multi-factor authentication for vendor accounts is best. It assumes credentials can be stolen and limits what they can reach, blocking lateral movement to the core database. Password rotation, insurance and longer log retention do not constrain the attacker's movement.
- ANetwork segmentation combined with least-privilege access and multi-factor authentication for vendor accountsCorrect
- BIncreasing the password rotation frequency to every 7 days for all staff
- CPurchasing additional cyber insurance cover to raise the policy limit
- DExtending the retention period of server logs from 90 to 180 days
Explanation
The failure was lateral movement from a low-value system to a critical one using a trusted credential. Segmentation and least privilege restrict what a compromised account can reach, and MFA makes stolen passwords less useful. Frequent rotation is weak against active theft, insurance transfers rather than reduces impact, and longer logs help detection and forensics only after the event.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- Which contractual provision best supports a bank's ability to oversee an outsourced critical service on an ongoing basis?
- A bank's expected annual loss from a process is USD 4 million with an event frequency of 20 per year. A new control is projected to cut freq…
- A bank's disaster recovery test shows that its trading system, supported by a secondary data center, recovers in 6 hours. The business conti…
- A bank's incident response plan is reviewed. Which element most improves its ability to limit damage during an actual cyber incident?
- A bank's cyber-risk manager wants to limit the damage if an attacker compromises one employee's credentials, so that the attacker cannot mov…
- A bank outsources its loan-servicing platform to a vendor that itself relies on a single cloud provider. The bank's risk committee wants to …