Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

After a ransomware event at a peer firm, a bank reviews its backup design. Which design feature best protects the bank's ability to restore if attackers with administrator credentials try to destroy backups?

Immutable or offline backup copies are best because even an attacker holding administrator credentials cannot modify or delete them. Backups sharing the production domain or storage remain exposed to the same compromise, so they may be destroyed along with the primary data.

  1. ABackups stored on the same network domain, replicated hourly for speed
  2. BImmutable or offline backup copies that administrator accounts cannot alter or deleteCorrect
  3. CEncrypting production data with the same keys held on the backup server
  4. DIncreasing the retention period of backups on the production storage array

Explanation

Immutable or offline (air-gapped) copies cannot be altered even by privileged accounts, so they survive an attacker with admin rights. Same-domain replication exposes backups to the same compromise, and longer retention on the production array does not remove that exposure.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions