You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 301
What is 'cyber risk' in financial services and what are its main sources?
Select an option first.
Correct answer: B — The risk of financial, operational, or reputational harm to an organisation arising from the compromise of digital systems, data, or networks — main sources: (1) External attacks: ransomware, DDoS, phishing, account takeover; (2) Insider threats: employees with malicious intent or who inadvertently create vulnerabilities; (3) Third-party vulnerabilities: attacks through outsourced IT providers; (4) System vulnerabilities: unpatched software, misconfigured systems
Explanation: B is correct. Cyber risk: classified as an operational risk (system failure / external fraud categories). Financial sector is the most targeted industry for cyber attacks. Key threat actors: nation-state actors (sophisticated, persistent), organised crime (ransomware, fraud), hacktivists, and insiders. Impact: direct financial loss (theft, ransomware payments), operational disruption, regulatory fines (GDPR), and reputational damage. A is technology obsolescence. B has the definition. C: IT alone cannot manage enterprise cyber risk. D: all systems, not just internet-facing, are at risk.
Question 302
What is 'threat intelligence' in the context of cyber risk management?
Select an option first.
Correct answer: B — Systematic collection and analysis of information about current and potential cyber threats targeting an organisation or its sector — types: strategic (high-level, for executives and boards — what threats are facing the industry), tactical (TTPs — tactics, techniques, and procedures used by attackers), operational (specific ongoing campaigns or threat actors), and technical (indicators of compromise, malware signatures)
Explanation: B is correct. Threat intelligence: informs cyber risk management decisions. Sources: commercial providers (CrowdStrike, Recorded Future), sector-specific information sharing (FS-ISAC for financial services), government agencies (NCSC in UK, CISA in US). Threat intelligence enables proactive defence — understanding what attackers are doing allows defenders to prioritise controls. A is passive observation. C is a specific security test. D is an insurance product.
Question 303
What is a 'ransomware' attack and how should financial institutions respond?
Select an option first.
Correct answer: B — A malicious attack where criminals encrypt an organisation's data or systems and demand payment (ransom) for the decryption key — responses: activate incident response plan immediately, isolate affected systems (contain the spread), assess the scope and identify the attack vector, notify regulators (within DORA/GDPR timelines), restore from clean backups (do not pay the ransom), conduct forensic investigation
Explanation: B is correct. Ransomware response: the NIST Cybersecurity Framework response cycle — Identify → Protect → Detect → Respond → Recover. Key principles: isolation (prevent spread to unaffected systems), do not pay (it funds criminals, does not guarantee decryption, and encourages repeat attacks), restore from backups (which must be tested and offline/air-gapped), and report to regulators. The 2017 WannaCry attack (NHS, global banks) showed the devastating impact. A is a software error. C is a regulatory sanction. D is financial risk from crypto prices.
Question 304
What is 'phishing' and 'spear phishing' in the context of financial sector cyber threats?
Select an option first.
Correct answer: B — Phishing: mass-sent fraudulent emails designed to trick recipients into clicking malicious links or revealing credentials. Spear phishing: a targeted, personalised version of phishing aimed at specific individuals (e.g., CFO, treasury staff) using their name, role, and company details to appear legitimate — harder to detect and used in sophisticated BEC (Business Email Compromise) attacks
Explanation: B is correct. Phishing/spear phishing: the most common initial attack vector in financial sector breaches. Spear phishing examples: an email appearing to be from the CEO asking the CFO to transfer funds urgently (BEC fraud — costs $50B+ globally). Defence: email filtering, multi-factor authentication (MFA), staff awareness training, verification procedures for large wire transfers. A is marketing. C is surveillance. D: applicable to all banking sectors and beyond.
Question 305
What is 'multi-factor authentication' (MFA) and why is it important for operational risk control?
Select an option first.
Correct answer: B — An authentication mechanism requiring users to prove their identity using two or more independent factors: something you know (password), something you have (hardware token, smartphone app), and something you are (biometric). MFA significantly reduces the risk of account compromise from stolen credentials
Explanation: B is correct. MFA: even if an attacker steals a password (via phishing, data breach), they cannot access the account without the second factor (hardware token, OTP from authenticator app). Reduces risk of: credential stuffing attacks, brute-force attacks, and phishing-enabled account takeover. Regulatory requirements: PSD2 (EU) mandates Strong Customer Authentication (SCA) for banking payments. A is not MFA. C: MFA is also required for internal systems (employee access). D: applies to both customer-facing and internal systems.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 306
What is 'penetration testing' and how does it relate to operational resilience?
Select an option first.
Correct answer: B — A simulated cyber attack conducted by authorised security professionals to identify vulnerabilities in an organisation's IT systems, networks, and applications before real attackers exploit them — integral to operational resilience as it tests whether controls can withstand sophisticated attacks. DORA requires 'Threat-Led Penetration Testing' (TLPT) for significant financial institutions
Explanation: B is correct. Penetration testing (pen testing): types — black box (tester has no prior knowledge, simulates an external attacker), white box (full knowledge, used to test specific vulnerabilities), and grey box (partial knowledge). TLPT (DORA): intelligence-led pen testing based on actual threat intelligence relevant to the entity. Unlike standard pen tests, TLPT is more sophisticated and targets critical systems and functions. A is regulatory capital stress testing. C is system testing (UAT). D is BCP/resilience testing.
Question 307
What is 'access control' in information security and what is the principle of 'least privilege'?
Select an option first.
Correct answer: B — The set of security mechanisms that regulate who or what can access specific resources in an IT environment — the 'least privilege' principle states that users, processes, and systems should have only the minimum access rights needed to perform their legitimate functions, reducing the attack surface and limiting damage from compromised accounts
Explanation: B is correct. Access control and least privilege: a user in the payments team should have access to the payments system but not to the trading system or the HR database. 'Need to know' principle. Implementation: Role-Based Access Control (RBAC), regular access reviews (users who change roles should have old access removed), and privileged access management (PAM) for administrator accounts. A is physical security. C is account management. D: annual access reviews are a good practice control, not the principle itself.
Question 308
What is 'patch management' and why is it critical for cyber risk reduction?
Select an option first.
Correct answer: B — The process of regularly applying updates (patches) to software, operating systems, and firmware to fix known security vulnerabilities — critical because: most successful cyber attacks exploit known vulnerabilities that have patches available but haven't been applied. The 2017 Equifax breach (148M records stolen) exploited an unpatched Apache Struts vulnerability
Explanation: B is correct. Patch management: WannaCry (2017) exploited a Windows vulnerability (EternalBlue) for which Microsoft had issued a patch two months earlier — organisations that hadn't patched were compromised. Best practice: patch critical vulnerabilities within 24-48 hours; high within 7 days; medium within 30 days. Challenge: patching requires testing (patches can break existing applications) and system downtime. Automated patch management systems help. A is contract management. C is project management. D is physical security.
Question 309
What is 'incident response' and what are the typical phases of an incident response plan?
Select an option first.
Correct answer: B — The organised approach to addressing and managing the aftermath of a security breach or IT incident — phases: (1) Preparation (plans, tools, training); (2) Detection and analysis (identify and triage the incident); (3) Containment (stop the spread); (4) Eradication (remove the threat); (5) Recovery (restore systems); (6) Post-incident review (lessons learned). Based on NIST SP 800-61 or SANS frameworks
Explanation: B is correct. Incident response plan (IRP): having a tested, well-rehearsed IRP reduces the cost and time to recover from a cyber incident. Key roles: incident response team (technical), communications (internal/external), legal/compliance, executive management (for major incidents). Regulatory notification: under DORA, major ICT incidents must be reported to the competent authority within 4 hours of classification. A is loss recovery. C is credit risk. D is regulatory reporting (a component of incident response, not the plan itself).
Question 310
What is 'internal audit' and what is its role in operational risk governance?
Select an option first.
Correct answer: B — The independent, objective assurance and consulting activity that evaluates the effectiveness of an organisation's risk management, control, and governance processes — in the third line of defence, internal audit provides independent assurance that the 1st and 2nd lines are functioning effectively. IA does not manage risks (that is 1st line) or set policies (2nd line)
Explanation: B is correct. Internal audit role (IIA standards): internal audit must be independent (reports to the audit committee, not management), objective (free from conflicts of interest), and competent (skills in operational risk, IT, and financial processes). For OpRisk: IA tests whether RCSA is being conducted effectively, whether the loss database is complete and accurate, and whether capital modelling processes are robust. A is the accounting function. C is 1st line. D is regulatory reporting (2nd line).
Question 311
What is 'conduct risk' and how does it relate to operational risk?
Select an option first.
Correct answer: B — The risk that the behaviour of a firm or its employees leads to poor outcomes for customers, market integrity, or the financial system — classified as operational risk under 'Clients, Products and Business Practices'. Examples: mis-selling of financial products, manipulation of benchmarks (LIBOR), inadequate disclosure, discriminatory practices, and unfair treatment of customers
Explanation: B is correct. Conduct risk: accelerated in prominence following the 2008 crisis and subsequent fines (LIBOR manipulation: $9B+ in global fines; PPI mis-selling: £50B+ in UK redress). Conduct risk is primarily an OpRisk category but also has reputational consequences. FCA focus: 'Treating Customers Fairly' (TCF) and 'Consumer Duty' (UK). Management: culture change, incentive redesign, product governance, complaint monitoring, and conduct risk dashboards. A is a performance issue. B has the right answer. C is market risk. D: conduct risk is within OpRisk.
Question 312
What is 'compliance risk' and how is it managed in financial institutions?
Select an option first.
Correct answer: B — The risk of legal or regulatory sanctions, financial penalties, or reputational damage from failure to comply with laws, regulations, and internal policies — managed through: maintaining a compliance function (separate from operational risk but related), monitoring regulatory changes, conducting compliance testing, training staff, and reporting breaches to regulators
Explanation: B is correct. Compliance risk: within the Basel OpRisk framework, classified under 'Clients, Products and Business Practices' (regulatory failures) or 'Internal Fraud/External Fraud' (intentional non-compliance). The compliance function (CCO): monitors laws and regulations, develops policies, conducts training, and reports to senior management and the board. Key regulations: AML/KYC (money laundering), MiFID II (market conduct), GDPR (data privacy). A is interest rate risk. C: compliance risk clearly overlaps with OpRisk. D is a competitive risk.
Question 313
What is 'money laundering' and what is the 'three stages' model?
Select an option first.
Correct answer: B — The process of making criminally obtained funds appear legitimate — the three stages model: (1) Placement: introducing illicit cash into the financial system; (2) Layering: disguising the trail through complex transactions (wire transfers, shell companies, currency exchange); (3) Integration: reintroducing the laundered money into the legitimate economy as clean funds
Explanation: B is correct. Three stages: Placement (riskiest for the launderer — interacting with financial institutions, e.g., structuring deposits below reporting thresholds). Layering (e.g., international wire transfers, purchasing and reselling assets, converting to cryptocurrency). Integration (e.g., purchasing property, investing in businesses). Banks must implement AML controls at all stages: KYC at account opening, transaction monitoring, suspicious activity reports (SARs), and trained staff. A is literal cleaning. C is accounting fraud. D is a regulatory consequence.
Question 314
What is 'Know Your Customer' (KYC) in the context of AML compliance?
Select an option first.
Correct answer: B — The process of verifying the identity of customers and understanding the nature of their business before establishing or maintaining a financial relationship — includes: identity verification (passport, ID), source of funds verification, beneficial ownership identification (who ultimately owns/controls the entity), and ongoing monitoring
Explanation: B is correct. KYC (AML/KYC regulations: FATF recommendations, EU AML Directives, Bank Secrecy Act in US): three tiers — Standard Due Diligence (SDD) for low-risk customers, Enhanced Due Diligence (EDD) for high-risk (PEPs, high-risk jurisdictions, complex structures), and Simplified Due Diligence (SDD) for government entities. Beneficial ownership: identifying the person who ultimately controls/benefits from a legal entity (EU 5th AML Directive: 25%+ ownership threshold). A is customer relationship management. C is marketing. D: in-person is one method but not the only one.
Question 315
What is a 'Suspicious Activity Report' (SAR) and what are the obligations related to it?
Select an option first.
Correct answer: B — A report filed with a financial intelligence unit (e.g., the NCA in the UK, FinCEN in the US) when a financial institution has reason to suspect that a transaction involves money laundering, terrorist financing, or other financial crime — the institution must NOT tip off the subject (tipping off is a criminal offence) and must file the SAR confidentially
Explanation: B is correct. SAR obligations: mandatory in most jurisdictions. UK: NCA (National Crime Agency). Tipping off: warning the suspect that a SAR has been filed is a criminal offence (it would allow them to destroy evidence). Banks must also have an MLRO (Money Laundering Reporting Officer) — the authorised person to receive internal disclosures and decide whether to file with NCA. SARs are a key source of law enforcement intelligence. A is HR/management. C is a risk reporting concept. D is a KYC system output.
Question 316
What is 'data governance' in operational risk management?
Select an option first.
Correct answer: B — The framework of policies, standards, and processes ensuring that data used in operational risk management (loss data, KRIs, RCSA outputs) is accurate, complete, timely, and consistent — BCBS 239 (Principles for Effective Risk Data Aggregation and Risk Reporting) requires large banks to have strong data governance across all risk types, including operational risk
Explanation: B is correct. Data governance for OpRisk: poor data governance produces unreliable capital models, misleading KRI dashboards, and incomplete loss databases. BCBS 239 requirements: data accuracy (reconciled to source), completeness (no gaps), timeliness (available when needed), and adaptability (can produce ad-hoc reports during stress). DQ (Data Quality) testing: regular automated checks for completeness, accuracy, and timeliness. A is regulatory compliance. C: data governance is a shared responsibility. D is data management.
Question 317
What is 'vendor risk management' and what due diligence is required before outsourcing?
Select an option first.
Correct answer: B — The process of assessing, monitoring, and managing the risks associated with third-party vendors who provide services or products critical to the bank's operations — pre-outsourcing due diligence includes: financial stability assessment, security posture review (penetration test results, ISO 27001 certification), operational resilience capability, regulatory track record, and contractual protections (audit rights, data security requirements, exit plan)
Explanation: B is correct. Vendor risk management (EBA Guidelines on Outsourcing, 2019; DORA): risk-based approach — critical vendors (whose failure would disrupt critical business services) receive the most intensive due diligence and monitoring. Contractual requirements: right of audit (bank and regulator), notification of incidents, data protection standards, business continuity requirements for the vendor, and exit provisions (transition plan if vendor is terminated). A: cost is only one factor. C: applies to all service providers. D: risk-based, not cost-based threshold.
Question 318
What is 'concentration risk' in the context of third-party operational risk?
Select an option first.
Correct answer: B — The risk that multiple financial institutions depend on the same third-party providers — if that provider fails or is disrupted, the impact cascades across the entire financial system. Examples: major cloud providers (AWS, Azure, Google Cloud), payment processors, and software vendors provide services to hundreds of banks, creating systemic concentration risk
Explanation: B is correct. Third-party concentration risk: a 2021 UK survey found that over 65% of major UK banks used the same top 5 cloud providers. If AWS had a major outage, many banks' critical services would fail simultaneously. This is a systemic risk concern. Regulators (FSB, EBA) are developing frameworks to monitor and address systemic concentration in critical third-party providers. DORA: introduces oversight of 'critical ICT third-party providers' directly by regulators (ESAs). A is credit concentration. C is internal risk concentration. D is model risk.
Question 319
What is 'risk culture' and what are the key behavioural indicators of a strong or weak risk culture?
Select an option first.
Correct answer: B — The shared values, beliefs, attitudes, and behaviours regarding risk across all levels of the organisation — indicators of a strong risk culture: willingness to report errors and near misses, risk concerns are escalated without fear of reprisal, management sets the tone by modelling risk-aware behaviour, and incentives reward long-term risk-adjusted performance. Weak culture indicators: 'shoot the messenger,' short-term P&L prioritised over risk management, and HR consequences for raising risk concerns
Explanation: B is correct. Risk culture (FSB Guidance on Supervisory Interaction with Financial Institutions on Risk Culture, 2014): four elements — tone from the top (leadership demonstrates risk awareness), accountability (clear ownership of risks), effective communication (risk information flows up and down), and incentives (compensation and career progression aligned with risk-taking). Weak culture enabled: Barings (Leeson — management ignored concerns), Wells Fargo (fake accounts — pressure to meet sales targets), SocGen (Kerviel — trading positions unchallenged). A is a policy document. C is a regulatory standard. D is training.
Question 320
What is 'tone from the top' in operational risk governance?
Select an option first.
Correct answer: B — The commitment and behaviour of senior leadership (board, CEO, CRO) toward risk management — leaders who visibly champion risk management, allocate adequate resources, hold business leaders accountable for risk outcomes, and make decisions that reflect risk awareness create a culture where operational risk is taken seriously throughout the organisation
Explanation: B is correct. Tone from the top: research consistently shows that organisational culture flows from leadership. When senior leaders tolerate shortcuts on controls to boost short-term profits, employees learn that risk management is secondary. Conversely, when leaders visibly support risk investment, report losses transparently, and hold themselves accountable, the culture follows. Board responsibilities: approve risk appetite, review major incidents, oversee the CRO. A is communication method. C: board sign-off is a process, not 'tone.' D is a communication plan.
Question 321
What is 'regulatory reporting' in operational risk and what are the key requirements?
Select an option first.
Correct answer: B — Banks must report operational risk information to regulators including: Pillar 3 disclosures (public disclosure of operational risk capital, approaches used, and major losses), COREP reporting (standardised capital reporting to EBA/national regulators), material loss event reporting (individual large losses above thresholds), and regulatory capital calculations under the applicable approach
Explanation: B is correct. Regulatory reporting for OpRisk: Pillar 3: required public disclosure under Basel III — qualitative (risk management framework description) and quantitative (capital by approach, major loss events). COREP: standardised electronic reporting via XBRL to European regulators. Material loss events: in many jurisdictions, individual losses above a threshold (e.g., €10M for significant institutions) must be notified to supervisors. DORA: adds ICT incident reporting requirements. A is financial reporting. C is media relations. D is internal reporting.
Question 322
What is 'control testing' and how frequently should controls be tested?
Select an option first.
Correct answer: B — Regular, risk-proportionate testing to verify that controls are functioning as designed — detective controls (reconciliations): tested with every execution. Key preventive controls: monthly or quarterly testing. All material controls: at minimum annually, more frequently for high-risk controls. Methods: walkthroughs (observe the control being performed), sample testing (check a sample of instances where the control should have operated), and continuous monitoring (automated testing of every instance)
Explanation: B is correct. Control testing frequency: risk-proportionate — high-risk controls (e.g., dual authorisation for large payments) tested frequently (monthly or quarterly). Lower-risk controls (e.g., annual physical asset verification) tested less frequently. Automated controls: can be tested continuously (system logs checked daily). Manual controls: sampled testing (e.g., test 25 out of 250 authorisation sign-offs per quarter). Results feed back into RCSA — a failed control raises the residual risk rating. A is episodic. C: proactive testing prevents losses. D: frequency proportional to risk.
Question 323
What is 'exception management' in operational processes and why is it important for operational risk?
Select an option first.
Correct answer: B — The process of identifying, investigating, and resolving instances where standard procedures were not followed (exceptions) or system controls were overridden — important because: exception rates are a leading indicator of operational risk, high exception rates indicate process or system problems, and unresolved exceptions can accumulate into significant losses
Explanation: B is correct. Exception management: examples — payment approval exceptions (large payments approved without second sign-off), system override exceptions (trader exceeds position limit with manager approval), and reconciliation exceptions (items that don't reconcile automatically). Exception tracking: each exception should be documented, escalated appropriately, and resolved within a defined timeframe. KRI: exception rate (exceptions per 1,000 transactions) — high rate signals increasing OpRisk. A is perfection-seeking. C is only one category. D is customer complaints management.
Question 324
What is 'information security management' and what frameworks guide it?
Select an option first.
Correct answer: B — The set of policies, procedures, and controls protecting an organisation's information assets from unauthorized access, use, disclosure, disruption, or destruction — guided by frameworks including: ISO 27001 (international standard for information security management systems), NIST Cybersecurity Framework (identify, protect, detect, respond, recover), SOC 2 (US service organisation controls), and DORA (EU digital operational resilience)
Explanation: B is correct. Information security management: ISO 27001 is the most widely adopted international standard — its Annex A provides 93 security controls organised across four themes (organisational, people, physical, technological). The NIST CSF provides a risk-based approach to managing cyber risk. PCI DSS applies specifically to payment card data. For banks: supervisors assess ISMS quality as part of operational risk supervision. A is physical security. C is a specific security control (encryption). D is a personnel requirement.
Question 325
What is 'system availability' as a KRI in operational risk and how is it measured?
Select an option first.
Correct answer: B — The percentage of time a critical system is available and functioning as intended — measured as Uptime = (Total Time − Downtime) / Total Time × 100%. For core banking systems: 99.99% availability (four nines) = maximum 52 minutes downtime per year. Unplanned downtime (system failure) is a key operational risk indicator; planned downtime (maintenance) is managed separately
Explanation: B is correct. System availability KRI: thresholds — green: >99.95% availability. Amber: 99.90-99.95%. Red:
Question 326
What is 'encryption' and why is it critical for data security?
Select an option first.
Correct answer: B — The process of converting readable data (plaintext) into an unreadable format (ciphertext) using an algorithm and key — only parties with the correct decryption key can read the original data. Critical for: protecting data in transit (TLS/SSL for web traffic), data at rest (database encryption), and data on portable devices (full-disk encryption). Prevents data theft even if an attacker gains physical or network access
Explanation: B is correct. Encryption in banking: AES-256 for data at rest and TLS 1.3 for data in transit are current standards. Regulatory requirements: GDPR requires appropriate technical measures (encryption). PCI DSS mandates encryption for cardholder data. Banking regulations increasingly require encryption for sensitive customer data. Key management: encryption is only as strong as the key management — poorly managed keys negate the protection. A is data compression. C is performance optimisation. D: encryption requirements extend to all sensitive data.
Question 327
What is 'social engineering' in the context of cyber risk?
Select an option first.
Correct answer: B — Psychological manipulation techniques used by attackers to deceive individuals into revealing confidential information or performing actions that compromise security — examples: phishing emails, pretexting (creating false scenarios), vishing (voice phishing), baiting (infected USB drives), and tailgating (following an authorised person through a secure door)
Explanation: B is correct. Social engineering: exploits human psychology rather than technical vulnerabilities — often the easiest attack vector because it bypasses technical controls. Phishing (email), vishing (phone), smishing (SMS). Pretexting: an attacker calls IT support pretending to be an employee to reset a password. Defence: security awareness training, strict call-back procedures for password resets, physical access controls, and healthy scepticism of unusual requests. A is marketing. C is customer acquisition. D: social engineering targets people, not systems directly.
Question 328
What is 'data loss prevention' (DLP) and how does it protect against insider threats?
Select an option first.
Correct answer: B — Technology and processes that detect and prevent unauthorised transmission or exfiltration of sensitive data — DLP systems monitor: email attachments, USB uploads, cloud uploads, printing, and screen captures. Alerts are raised when sensitive data (customer PII, trading data, passwords) appears in unauthorised channels. Particularly relevant for insider threats where authorised users misuse their access
Explanation: B is correct. DLP: classifies sensitive data (PII, financial data, intellectual property), defines policies (no sensitive data to personal email), and monitors for violations. Examples: a DLP system alerts when an employee emails a customer database to their personal Gmail account. DLP doesn't eliminate insider risk — a determined insider can find workarounds — but it catches careless or opportunistic data theft and provides an audit trail. A is disaster recovery. C is a retention policy. D: DLP prevents unauthorised disclosure, not retention.
Question 329
What is 'zero trust security' and how does it change the traditional network perimeter approach?
Select an option first.
Correct answer: B — A security model that assumes no user, device, or network should be trusted by default — even if they are inside the corporate network perimeter. Every access request is verified (authentication), every device is checked (health compliance), and access is granted with minimum privileges (least privilege). Traditional model: inside the firewall = trusted. Zero trust: trust must be earned continuously
Explanation: B is correct. Zero trust (NIST SP 800-207): driven by: cloud adoption (perimeter is meaningless when workloads are in AWS), mobile workforce (users accessing from home/mobile), and insider threats (perimeter model trusts employees unconditionally). Principles: verify explicitly (use MFA, device health, location), use least privilege access (just-in-time, just-enough access), assume breach (segment networks, monitor all traffic). Financial institutions are adopting zero trust frameworks for critical systems. A and C are not zero trust. D is wrong.
Question 330
What is 'cyber insurance' and what are its limitations for financial institutions?
Select an option first.
Correct answer: B — An insurance policy covering financial losses and expenses resulting from cyber incidents — including: incident response costs, business interruption losses, data breach notification costs, regulatory fines (where insurable), legal costs, and cyber extortion payments. Limitations: increasing exclusions (nation-state attacks, pandemic-scale events), capacity constraints (insurers limiting exposure), premium increases, and coverage gaps (silent cyber in non-cyber policies)
Explanation: B is correct. Cyber insurance limitations: following major ransomware waves (Colonial Pipeline, JBS Foods), insurers tightened: exclusions for nation-state attacks (increasingly attributed to state actors), minimum security requirements (MFA, endpoint protection) before coverage, sub-limits for ransomware, and aggregate caps. Banking-specific concerns: regulatory fines are not always insurable (public policy — paying a fine with insurance reduces deterrence). Cyber insurance supplements but does not replace cyber risk management. A: many losses are excluded. C: technology failures are one category. D: capital requirements remain.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.