Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

After a penetration test reveals that privileged accounts at a bank are shared among administrators with no individual accountability, which control improvement is most appropriate?

Privileged access management with unique credentials, multi-factor authentication, session logging and periodic access reviews is most appropriate because it restores individual accountability and least privilege for administrators. Changing general staff passwords, disabling logs or granting broad permanent access would not fix, and could worsen, the weakness.

  1. AImplement privileged access management with unique credentials, multi-factor authentication, session logging and periodic access reviewCorrect
  2. BIncrease the password length for general staff only
  3. CDisable logging to reduce storage costs
  4. DGrant all administrators permanent access to every system

Explanation

Shared privileged accounts undermine accountability and least privilege. Privileged access management with unique IDs, MFA, logging and review addresses this. The other options leave the weakness or worsen it.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions