Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

Following a ransomware incident, a firm finds its backups were stored on the same network and were encrypted along with production data. Which remediation best addresses this specific weakness?

The best remediation is keeping offline or immutable backups segregated from production and regularly testing restores. Ransomware encrypted backups because they were network-reachable, so adding more copies on the same share would not help. Isolation ensures data can be recovered without paying the ransom.

  1. AMaintain offline or immutable backups segregated from the production network and test restoration regularlyCorrect
  2. BIncrease the number of daily backups stored on the same network share
  3. CReplace antivirus software with a new vendor only
  4. DShorten the incident response report template

Explanation

The weakness is that backups were reachable by the attacker. Segregated, offline or immutable copies with tested restores preserve recoverability. More copies on the same share would be encrypted too, and an antivirus swap does not fix backup exposure.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions