Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

After a destructive malware attack, a bank's incident team wants to restore services from backups. Which practice best supports cyber-resilient recovery in this situation?

Maintain offline or immutable backups and verify their integrity before restoring. Destructive malware can spread to connected backups and to mirrored sites, so restoring the latest copy without checks risks reinfection. Isolated, validated backups let the bank recover to a known clean state.

  1. ARestoring from the most recent backup immediately, since it minimizes data loss
  2. BKeeping backups on the same network segment so they can be restored quickly
  3. CRelying on synchronous mirroring to the secondary site as the sole recovery source
  4. DMaintaining offline or immutable backups and verifying their integrity before restoring, to avoid reintroducing the malwareCorrect

Explanation

Destructive attacks can corrupt or encrypt connected backups and mirrored copies, so isolated or immutable backups with integrity checks are essential. Restoring the latest backup without checking may reintroduce the malware. Synchronous mirroring replicates corruption to the second site.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions