Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

After an incident, a bank's investigation finds that a former employee's account was never deactivated and was used to download client files. Which weakness in information security management does this most directly show?

It shows inadequate identity and access management, specifically a failed leaver process that did not deactivate the departed employee's account. That left valid credentials usable to download client files, producing a confidentiality breach, which backups, bandwidth or transit encryption would not have prevented.

  1. AInadequate identity and access management, in the joiner-mover-leaver processCorrect
  2. BInsufficient network bandwidth
  3. CLack of encryption in transit
  4. DPoor data backup frequency

Explanation

A leaver's account that stays active points to a failure in identity and access management, specifically timely deprovisioning. The result was a confidentiality breach. Backup frequency, bandwidth and transit encryption do not explain use of a stale account.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions