I85PREP
⌘ K
CISAW Risk Management study materials
CISAW Risk Management study resources

CISAW Risk Management practice questions

One question at a time. Build your CISAW Risk Management understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber-risk identification and analysis

Why must assets be identified in a GB/T 20984 information security risk assessment?

  1. Because asset identification replaces the need for threat identification
  2. Because only leased assets can have residual risk
  3. Because ISO 31000 forbids naming information systems
  4. Because threats and vulnerabilities only become meaningful in relation to assets that support objectives Correct answer.

Explanation

Risk is the effect of uncertainty on objectives, and those objectives are carried by assets. Without identifying what is valuable, threat and vulnerability findings cannot be associated or valued.

Question 2Cyber-risk identification and analysis

GB/T 20984-2022 groups assets into which hierarchy?

  1. Only laptops, only printers, and only chairs
  2. Business assets, system assets, and system-component / unit assets Correct answer.
  3. Public cloud, private cloud, and paper only
  4. Confidential, secret, and top secret personnel clearances

Explanation

The 2022 method identifies 业务资产, 系统资产, and 系统组件和单元资产. Business is the highest management object; systems carry business; components and units are finer technical assets.

Question 3Cyber-risk identification and analysis

A customer database is rated confidentiality 5, integrity 4, and availability 2 on a 1–5 scale. What does a confidentiality rating of 5 indicate in a GB/T 20984-style assignment?

  1. Disclosure would cause very high harm relative to the chosen scale Correct answer.
  2. The database has no users
  3. Availability is more important than confidentiality
  4. The asset must be excluded from the assessment

Explanation

On the usual 5-level qualitative scale, 5 is the highest grade (很高). A confidentiality 5 means unauthorized disclosure would cause very serious harm under the project's assignment rules.

Question 4Cyber-risk identification and analysis

In GB/T 20984-2022, what extra attributes are used when valuing system assets beyond component CIA?

  1. Office-paint color and cafeteria rating
  2. The CISAW candidate's years of experience
  3. Business bearing (业务承载性) and business importance (业务重要性), combined with CIA Correct answer.
  4. The number of unused Ethernet ports only

Explanation

System-asset value uses CIA assignment together with how strongly the system bears business processes and how important those businesses are. That is the business-oriented shift of the 2022 method.

Question 5Cyber-risk identification and analysis

In information security risk assessment, a threat (威胁) is best described as:

  1. A documented residual-risk acceptance memo
  2. The name of the assessment standard itself
  3. A mandatory firewall brand
  4. A potential cause of an unwanted incident that may harm a system or organization Correct answer.

Explanation

A threat is a potential cause of an unwanted incident that can result in harm. CISAW identification looks at threat source, actor, motivation, capability, and frequency, then associates threats with assets and vulnerabilities.

Question 6Cyber-risk identification and analysis

Which grouping is a standard way to classify threat sources in a CISAW-style identification workshop?

  1. Only expired SSL certificates
  2. Only 等保 paperwork delays
  3. Only printer jams
  4. Environmental / natural, human accidental, and human deliberate (including external and insider) Correct answer.

Explanation

Threat identification commonly covers environmental events, accidental human error, and deliberate human action from outsiders or insiders. A complete survey does not stop at a single technical symptom.

Question 7Cyber-risk identification and analysis

What is a vulnerability (脆弱性) in GB/T 20984-style identification?

  1. The organization's mission statement
  2. The pass mark of the CISAW paper
  3. A weakness of an asset or control that a threat could exploit Correct answer.
  4. A residual risk that has already been accepted

Explanation

A vulnerability is a weakness in an asset, process, or control that can be exploited by a threat. Identification covers physical, network, system software, middleware, application, and management weaknesses.

Question 8Cyber-risk identification and analysis

GB/T 20984-2022 threat assignment should consider which combination?

  1. Only the color of the threat-actor logo
  2. Threat capability and frequency, together with timing / opportunity Correct answer.
  3. Only the asset's depreciation schedule
  4. Only whether the assessor personally likes the system owner

Explanation

The 2022 method assigns threats using behavior capability and frequency, combined with timing (when the threat can act). Frequency alone, which was the older emphasis, is no longer the whole story.

Question 9Cyber-risk identification and analysis

Under GB/T 20984-2022, vulnerability assignment is split so that:

  1. Exploitability (how easily a threat can use the weakness, considering existing controls) and impact degree are rated separately Correct answer.
  2. Only CVSS marketing slogans are copied into the report
  3. Vulnerabilities are never linked to assets
  4. Management weaknesses are excluded by definition

Explanation

The 2022 method rates how easily the vulnerability can be exploited (after considering 已有安全措施) and how severe the impact would be. Those two inputs feed likelihood and loss respectively.

Question 10Cyber-risk identification and analysis

Why must existing security measures (已有安全措施) be identified before final vulnerability and risk ratings?

  1. Because existing controls have no effect on exploitability
  2. Because identification of controls replaces risk evaluation
  3. Because already-implemented controls change how easily a vulnerability can be exploited and therefore change likelihood and residual exposure Correct answer.
  4. Because CCRC forbids listing firewalls in reports

Explanation

Existing preventive and detective controls reduce exploitability or impact. If they are ignored, the team overstates current risk; if they are assumed without verification, the team understates it.

Question 11Cyber-risk identification and analysis

Which finding is a physical vulnerability (物理脆弱性) rather than a network vulnerability?

  1. An unpatched VPN concentrator exposing IKE to the internet
  2. A missing HTTP-only cookie flag on a web session
  3. An unlocked equipment room with no visitor log or camera coverage Correct answer.
  4. A default SNMP community string on a core switch

Explanation

Physical vulnerabilities concern premises, environment, and physical access. An unlocked equipment room is a classic physical weakness. The other options are network or application issues.

Question 12Cyber-risk identification and analysis

Which item is a network-layer vulnerability in CISAW identification practice?

  1. Absence of a documented residual-risk owner
  2. Missing fire extinguishers in the tape library
  3. An incomplete business-continuity policy paragraph
  4. Flat network with no segmentation between office users and the payment system Correct answer.

Explanation

Missing segmentation is a network architecture weakness that lets a threat move laterally toward high-value systems. Policy and physical-safety gaps belong to other vulnerability classes.

Question 13Cyber-risk identification and analysis

Which example is a management vulnerability (管理脆弱性)?

  1. A buffer overflow in a custom binary
  2. An open Telnet service on a router
  3. A water leak above a UPS
  4. No access-review process and no named owner for privileged accounts Correct answer.

Explanation

Management vulnerabilities are weaknesses in policy, process, organization, and supervision. Missing access reviews and ownership are process failures even if technical tools exist.

Question 14Cyber-risk identification and analysis

How should an assessor distinguish application-system vulnerabilities from middleware vulnerabilities?

  1. Application issues sit in business software logic and configuration; middleware issues sit in supporting platforms such as web/application servers, message queues, or database engines Correct answer.
  2. They are the same class and must never be separated
  3. Middleware vulnerabilities are only printer drivers
  4. Application vulnerabilities exist only on paper forms

Explanation

CISAW's outline separates 应用系统脆弱性 from 应用中间件脆弱性. A broken authorization check is an application issue; an unpatched Tomcat or exposed Redis with no auth is middleware.

Question 15Cyber-risk identification and analysis

What is a primary output of asset identification?

  1. A signed residual-risk acceptance for every future threat
  2. A completed 等保 certificate number for the assessor personally
  3. An asset inventory with classification, CIA assignment, owners, and mapping to business/system/unit layers Correct answer.
  4. A list of CISAW exam dates

Explanation

Asset identification produces the inventory and assignments that later analysis will use. It does not itself accept residual risk or issue regulatory certificates.

Question 16Cyber-risk identification and analysis

A scanner reports a critical CVE, but a WAF and network ACL already block the only exploit path. What is the correct identification approach?

  1. Ignore both the CVE and the controls because scanners are never useful
  2. Delete the asset from the inventory so the CVE cannot be reported
  3. Automatically set residual risk to zero without testing the ACL
  4. Record the vulnerability and independently verify the existing controls, then rate exploitability in light of those controls Correct answer.

Explanation

Existing measures must be identified and their effectiveness checked. A blocked path lowers exploitability but does not magically erase the weakness or justify skipping verification.

Question 17Cyber-risk identification and analysis

Risk-element association in GB/T 20984 connects which items before calculation?

  1. Only the project logo and the cover page date
  2. Only the training invoice and the hotel receipt
  3. Assets, threats that can act on them, vulnerabilities that can be exploited, and relevant existing controls Correct answer.
  4. Only the CISAW certificate number of the team leader

Explanation

Calculation needs an associated tuple: which threat uses which vulnerability on which asset, after considering existing measures. Unassociated lists cannot produce a defensible likelihood or loss.

Question 18Cyber-risk identification and analysis

Which activity belongs in assessment preparation rather than in risk calculation?

  1. Computing ALE from SLE and ARO
  2. Looking up a 5×5 score after likelihood and impact are already rated
  3. Selecting a treatment option for an already evaluated high risk
  4. Forming the team, confirming scope, collecting materials, and obtaining authorization for tools Correct answer.

Explanation

Preparation (评估准备) establishes authorization, scope, methods, team, and logistics. Calculation and treatment come after identification and analysis.

Question 19Cyber-risk identification and analysis

Which mix of methods is appropriate for threat and vulnerability identification?

  1. Interviews, document review, on-site inspection, questionnaires, and authorized technical detection Correct answer.
  2. Guessing from the assessor's hometown only
  3. Copying another organization's report and changing the cover
  4. Waiting for a regulator to invent the asset list after the deadline

Explanation

CISAW and GB/T 31509 expect combined methods: people, documents, inspection, and approved tools. No single method is complete, and copied reports fail the integrity of identification.

Question 20Cyber-risk identification and analysis

Why does GB/T 20984-2022 start identification with business and strategy, not only servers?

  1. Because business importance and inter-business correlation determine which systems matter and how business risk is later aggregated Correct answer.
  2. Because servers cannot be listed until 等保 Level 5 is granted
  3. Because ISO 31000 forbids technical inventories
  4. Because business identification replaces vulnerability scanning forever

Explanation

Business identification sets importance, relationships, and boundaries. System and unit assets are then valued and rolled up so that business risk reflects the systems that carry those businesses.

Question 21Cyber-risk identification and analysis

An inherited organizational control (central SOC monitoring) covers a business system, and a local compensating control (additional allow-list) also exists. What is the identification error to avoid?

  1. Recording both controls and testing whether they actually cover the threat path
  2. Double-counting them as if each fully eliminated the same likelihood, or ignoring one without checking residual gaps Correct answer.
  3. Naming the SOC as an existing measure
  4. Noting the allow-list in the control inventory

Explanation

Layered controls can reduce exploitability together, but they are not independent full eliminations of the same risk. Identification should list each control, verify coverage, and avoid both double-counting and silent omission.

Question 22Cyber-risk identification and analysis

An unpatched operating-system kernel with a known remote exploit is classified as which vulnerability class?

  1. System-software vulnerability (系统软件脆弱性) Correct answer.
  2. Physical vulnerability only
  3. Business-strategy vulnerability only
  4. Risk-acceptance vulnerability only

Explanation

Operating systems, hypervisors, and similar platforms are system software. An unpatched kernel is a system-software 脆弱性, even though it may also have network exposure.

Question 23Cyber-risk identification and analysis

A threat actor can exploit a batch-import interface only during a nightly window when the WAF rule set is relaxed. How should GB/T 20984-2022-style threat assignment treat this?

  1. Ignore timing because only annual frequency matters
  2. Treat timing/opportunity as part of threat assignment together with capability and frequency Correct answer.
  3. Automatically rate the threat as zero because the window is at night
  4. Move the finding to physical vulnerability only

Explanation

The 2022 method explicitly combines capability, frequency, and timing. A constrained but real window still contributes to likelihood; it is not ignored and not automatically zero.

Question 24Cyber-risk identification and analysis

Two unit assets have identical CIA scores, but only one carries a core customer-payment business with no substitute system. Which GB/T 20984-2022 idea explains why their system-level risk contribution can differ?

  1. Business bearing and business importance adjust system-asset value and later business-risk aggregation Correct answer.
  2. CIA scores must be discarded whenever a payment system exists
  3. Unit assets are forbidden from being associated with businesses
  4. Substitute systems are ignored in all China assessments

Explanation

CIA at unit level can be similar while system-asset value still rises with business bearing, importance, and poor substitutability. Business risk then aggregates those system risks.

Question 25Cyber-risk identification and analysis

GB/T 31509 states that it applies to information security risk-assessment projects for which class of systems?

  1. Non-secret information systems; secret-related systems follow secrecy laws and secrecy standards instead Correct answer.
  2. Only foreign-owned networks physically located outside China
  3. Only paper archives with no computers
  4. Only CISAW examination servers operated by training firms

Explanation

GB/T 31509 guides assessment of non-secret (非涉密) information systems. Work involving state secrets follows dedicated secrecy regulations and standards, not this implementation guide.

Question 26Cyber-risk identification and analysis

A file server has asset value (AV) of RMB 500,000. A successful ransomware incident is estimated to destroy 40% of that value (EF = 0.40). What is the single loss expectancy (SLE)?

  1. RMB 500,000
  2. RMB 40,000
  3. RMB 200,000 Correct answer.
  4. RMB 1,250,000

Explanation

SLE = AV × EF = 500,000 × 0.40 = RMB 200,000. SLE is the expected loss from one occurrence, before multiplying by annual frequency.

Question 27Cyber-risk identification and analysis

SLE for a denial-of-service scenario is RMB 80,000 and the annual rate of occurrence (ARO) is 3. What is the annual loss expectancy (ALE)?

  1. RMB 80,000
  2. RMB 26,667
  3. RMB 3
  4. RMB 240,000 Correct answer.

Explanation

ALE = SLE × ARO = 80,000 × 3 = RMB 240,000. ALE annualizes a single-event loss using how often the event is expected each year.

Question 28Cyber-risk identification and analysis

When is a qualitative 5-level method more appropriate than SLE/ALE?

  1. When exact invoice-level loss data exist for every incident type and must be ignored
  2. When the organization has forbidden any risk criteria
  3. When GB/T 20984 bans all non-numeric words
  4. When credible RMB loss and frequency data do not exist, but experts can consistently rate likelihood and impact on a defined scale Correct answer.

Explanation

Qualitative or semi-quantitative 5-level scales are used when numerical loss/frequency data are weak. GB/T 20984 supports both matrix/multiplication on assigned grades and, where data exist, monetary formulas such as SLE/ALE.

Question 29Cyber-risk identification and analysis

A core billing database has AV = RMB 1,200,000. A integrity-corrupting attack has EF = 0.25 and is expected twice per year (ARO = 2). What is ALE?

  1. RMB 75,000
  2. RMB 300,000
  3. RMB 600,000 Correct answer.
  4. RMB 1,200,000

Explanation

SLE = AV × EF = 1,200,000 × 0.25 = RMB 300,000. ALE = SLE × ARO = 300,000 × 2 = RMB 600,000.

Question 30Cyber-risk identification and analysis

In GB/T 20984-2022 analysis, what primarily determines the likelihood of a security incident (安全事件发生的可能性)?

  1. The assessor's preferred report template font
  2. Threat assignment together with how easily the vulnerability can be exploited Correct answer.
  3. Only the hardware warranty end date
  4. Only the residual-risk signature date

Explanation

Likelihood L is a function of the threat and the vulnerability's exploitability (considering existing controls). Loss is a separate function of asset value and vulnerability impact.

Question 31Cyber-risk identification and analysis

In GB/T 20984-2022, what primarily determines loss if a security incident occurs (安全事件发生后的损失)?

  1. Only the number of unused software licenses
  2. The CISAW exam fee of RMB 1,080
  3. Asset value together with the vulnerability's impact degree Correct answer.
  4. Only whether the report is printed in color

Explanation

Loss F is a function of the affected asset's value and the vulnerability impact degree. Likelihood is calculated separately, then both feed the risk value.

Question 32Cyber-risk identification and analysis

AV = RMB 800,000 and ARO = 2. A control reduces EF from 0.50 to 0.10. What is residual ALE after the control?

  1. RMB 800,000
  2. RMB 400,000
  3. RMB 80,000
  4. RMB 160,000 Correct answer.

Explanation

After the control, SLE = 800,000 × 0.10 = RMB 80,000. Residual ALE = 80,000 × 2 = RMB 160,000. Original ALE would have been 800,000 × 0.50 × 2 = RMB 800,000.

Question 33Cyber-risk identification and analysis

What is the matrix method (矩阵法) in GB/T 20984 risk calculation?

  1. A method that constructs a two-dimensional mapping so two input grades determine an output grade at their intersection Correct answer.
  2. A method that always multiplies RMB prices by 12
  3. A method that deletes all medium risks
  4. A method that is illegal whenever ISO 31000 is cited

Explanation

矩阵法 is used when two element values determine a third. The team defines a two-dimensional matrix and reads the result at the row/column intersection. CISAW practice questions should use a matrix the stem actually states, not an unpublished official lookup table invented from memory.

Question 34Cyber-risk identification and analysis

What is the multiplication method (相乘法) in GB/T 20984?

  1. A method that forbids any function of two or more assigned grades
  2. A method that copies ALE formulas without asset identification
  3. A method used only for physical key management
  4. An empirical function, often a product or a derived form such as a rounded square root of a product, combining two or more element values into one result Correct answer.

Explanation

相乘法 combines two or more assigned values with an increasing function, commonly a product or √(x×y) with rounding as in published GB/T 20984 examples. The assessor must state the function used rather than inventing a secret table.

Question 35Cyber-risk identification and analysis

ALE before a safeguard is RMB 300,000. After the safeguard, ALE is RMB 50,000. The safeguard costs RMB 80,000 per year. What is the annual net benefit of the safeguard (ALE reduction minus annual cost)?

  1. RMB 80,000
  2. RMB 170,000 Correct answer.
  3. RMB 250,000
  4. RMB −30,000

Explanation

ALE reduction = 300,000 − 50,000 = RMB 250,000. Net benefit = 250,000 − 80,000 = RMB 170,000. The control is cost-effective on this annualized comparison.

Question 36Cyber-risk identification and analysis

On a GB/T 20984-style 5-level qualitative scale (很低, 低, 中, 高, 很高), what does a risk grade of 很高 mean?

  1. The risk is negligible and need not be communicated
  2. The assigned combination of likelihood and loss is at the highest defined level and requires priority evaluation and treatment decisions Correct answer.
  3. The asset has been removed from the organization
  4. The standard forbids further analysis

Explanation

很高 is the top qualitative grade. It means the evaluated risk is at the most severe defined level and must be compared with criteria for urgent treatment or, if treatment is impossible, explicit escalation-not silent neglect.

Question 37Cyber-risk identification and analysis

What does risk evaluation (风险评价) do with the calculated risk values?

  1. Deletes the asset inventory
  2. Replaces communication with encryption of the report filename only
  3. Compares them with predefined risk criteria to support ranking and treatment decisions Correct answer.
  4. Converts every qualitative grade into an unpublished criminal penalty

Explanation

Evaluation judges analysis results against the criteria set during context establishment: which risks are acceptable, which must be treated, and in what priority. It does not invent legal penalties.

Question 38Cyber-risk identification and analysis

A unit asset is assigned C = 5, I = 3, A = 4 on a 1–5 scale. Using the simple average method stated for this item, (C + I + A) / 3, what CIA composite is used before any later rounding policy?

  1. 4 Correct answer.
  2. 5
  3. 3
  4. 12

Explanation

(5 + 3 + 4) / 3 = 12 / 3 = 4. Some projects take the maximum instead of the average; this item uses the average method stated in the stem. Do not invent an unpublished national lookup table.

Question 39Cyber-risk identification and analysis

Which contents belong in a GB/T 20984-style risk-assessment report?

  1. Only a cover photo of the data center
  2. Scope and method, asset/threat/vulnerability/control results, calculation and evaluation, and treatment recommendations with residual-risk discussion Correct answer.
  3. Only the assessors' CISAW certificate numbers with no findings
  4. Only a statement that all risks are zero because the project is finished

Explanation

The report is the principal assessment output. It must reconstruct how the team moved from scope to identification, analysis, evaluation, and recommended treatment, including residual risk-not a decorative cover or an empty zero-risk claim.

Question 40Cyber-risk identification and analysis

What is residual risk (残余风险)?

  1. Risk that existed only before the organization was founded
  2. A synonym for threat actor
  3. The CISAW exam time limit
  4. Risk that remains after treatment measures have been applied Correct answer.

Explanation

Residual risk is what remains after controls and other treatments. It must be compared with acceptance criteria and monitored; it is not automatically acceptable just because treatment occurred.

Question 41Cyber-risk identification and analysis

An organization states that its 5×5 qualitative matrix uses risk score = likelihood × impact, each rated 1–5. Likelihood is 4 and impact is 5. What is the risk score?

  1. 9
  2. 5
  3. 20 Correct answer.
  4. 1.25

Explanation

With the scoring rule stated in the stem, 4 × 5 = 20. This is a teaching 5×5 product, not a claim that GB/T 20984 publishes this exact unpublished table as mandatory.

Question 42Cyber-risk identification and analysis

How is business risk obtained in GB/T 20984-2022 after system-asset risks are calculated?

  1. By ignoring systems and using only the office-lease amount
  2. By setting business risk equal to the CISAW pass mark
  3. By copying a foreign ALE worksheet without assets
  4. By aggregating the risk values of the system assets that carry that business, using a defined function such as a reasoned combination of those system risks Correct answer.

Explanation

Business risk Rb is a function of the system-asset risks RA_1 … RA_n that support the business. The 2022 method adds this aggregation; it does not stop at isolated unit CVEs.

Question 43Cyber-risk identification and analysis

A team has reliable incident-frequency data and RMB loss estimates for ransomware, but only expert grades for a rare supply-chain compromise. What mixed approach is consistent with ISO/IEC 27005 and GB/T 20984?

  1. Use ALE for ransomware and a stated qualitative matrix for the supply-chain scenario, keeping both comparable to the same evaluation criteria Correct answer.
  2. Discard the ransomware data so that everything is a guess
  3. Invent an unpublished national table that claims 3 always equals RMB 1 million
  4. Refuse to assess either scenario

Explanation

Hybrid analysis is allowed: quantitative where data quality is good, qualitative where it is not. Both outputs still face the same risk criteria during evaluation.

Question 44Cyber-risk identification and analysis

Using a GB/T 20984-style multiplication example where L = round(√(T × Ve)) and values are T = 4, Ve = 3, what is L? (round half up to integer)

  1. 12
  2. 3 Correct answer.
  3. 7
  4. 1

Explanation

T × Ve = 12, √12 ≈ 3.464, which rounds to 3. Published GB/T 20984 examples use this form of 相乘法; the stem states the function so no unpublished table is required.

Question 45Cyber-risk identification and analysis

A qualitative matrix yields a risk score of 12 on a 1–25 product scale. Which interpretation is valid?

  1. The score may be compared with this project's stated thresholds, but it is not automatically a precise RMB ALE Correct answer.
  2. The score is legally identical to RMB 12 million of annual loss
  3. The score proves residual risk is zero
  4. The score means no threat exists

Explanation

Qualitative or semi-quantitative scores are ordinal/interval teaching tools inside a stated matrix. They must not be silently converted into unpublished money amounts.

Question 46Cyber-risk identification and analysis

Threat A has SLE = RMB 100,000 and ARO = 4. Threat B has SLE = RMB 500,000 and ARO = 0.5. Independent scenarios on the same asset. Which statement is correct?

  1. Threat A has the higher ALE at RMB 400,000 versus RMB 250,000 for B Correct answer.
  2. Threat B has the higher ALE because its SLE is larger
  3. Both ALEs are RMB 100,000
  4. ARO cannot be a fraction, so B is invalid

Explanation

ALE_A = 100,000 × 4 = RMB 400,000. ALE_B = 500,000 × 0.5 = RMB 250,000. Annualized loss, not single-event SLE, drives this comparison. ARO may be a fraction when the event is expected less than once per year.

Question 47Cyber-risk identification and analysis

SLE remains RMB 20,000. A monitoring control cuts ARO from 12 per year to 3 per year. What is the ALE reduction?

  1. RMB 20,000
  2. RMB 60,000
  3. RMB 240,000
  4. RMB 180,000 Correct answer.

Explanation

Original ALE = 20,000 × 12 = RMB 240,000. Residual ALE = 20,000 × 3 = RMB 60,000. Reduction = 240,000 − 60,000 = RMB 180,000.

Question 48Cyber-risk identification and analysis

A 5×5 product score is 20. The organization's documented criterion treats scores ≥ 15 as unacceptable. What is the correct evaluation result?

  1. The risk is below criteria and may be silently ignored
  2. The risk exceeds criteria and requires a treatment decision (reduce, avoid, share, or exceptionally retain with recorded justification) Correct answer.
  3. The score must be rewritten to 10 so that it passes
  4. Evaluation is skipped because a number already exists

Explanation

Evaluation compares the analysis result with criteria. A 20 against a ≥15 unacceptable threshold is out of appetite and must be treated or, if retained, retained by an informed recorded decision-not by editing the score.

Question 49Cyber-risk identification and analysis

AV = RMB 2,000,000, initial EF = 0.30, ARO = 1. After encryption and backups, EF falls to 0.05 and ARO stays 1. What is residual ALE?

  1. RMB 600,000
  2. RMB 2,000,000
  3. RMB 100,000 Correct answer.
  4. RMB 1,900,000

Explanation

Initial SLE = 2,000,000 × 0.30 = RMB 600,000 and initial ALE = RMB 600,000. Residual SLE = 2,000,000 × 0.05 = RMB 100,000. With ARO = 1, residual ALE = RMB 100,000.

Question 50Cyber-risk identification and analysis

Two independent assets in one business: Asset 1 ALE = RMB 90,000, Asset 2 ALE = RMB 40,000. Using simple addition as the aggregation rule stated for this item, what combined annualized loss is reported?

  1. RMB 90,000
  2. RMB 130,000 Correct answer.
  3. RMB 50,000
  4. RMB 3,600,000

Explanation

With independent scenarios and addition as the stated aggregator, 90,000 + 40,000 = RMB 130,000. Real GB/T 20984-2022 business aggregation may use other documented functions; this item tests the stated additive rule, not an unpublished table.