I85PREP
⌘ K
EBIOS Risk Manager study materials
EBIOS Risk Manager study resources

EBIOS Risk Manager practice questions

One question at a time. Build your EBIOS Risk Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1EBIOS Risk Manager

In EBIOS Risk Manager, what is the primary purpose of the 'Cadrage et socle' (framing and baseline) workshop?

  1. To enumerate every threat source that could target the organization
  2. To select the final treatment measures and their residual risk
  3. To compute the annualized loss expectancy for each feared event
  4. To define the scope, the values to protect, and the security baseline already in place Correct answer.

Explanation

The framing workshop establishes the study perimeter, the essential values to protect, and the existing security baseline (socle) against which gaps will be assessed. Threat enumeration happens in later workshops, and risk computation or treatment selection comes after scenario assessment.

Question 2EBIOS Risk Manager

Which pair of concepts forms the basis of the 'Sources de risque / Objectifs visés' workshop?

  1. Feared events and business impacts
  2. Assets and their security requirements
  3. Vulnerabilities and controls
  4. Threat sources and their target objectives Correct answer.

Explanation

This workshop pairs each threat source (sources de risque) with the objectives it pursues (objectifs visés), which later feeds strategic scenario building. It deliberately stays at the attacker-motivation level rather than listing technical vulnerabilities.

Question 3EBIOS Risk Manager

What distinguishes a strategic scenario from an operational scenario in EBIOS Risk Manager?

  1. Strategic scenarios are built after operational scenarios are validated
  2. Strategic scenarios are quantitative; operational scenarios are qualitative
  3. Strategic scenarios describe the threat source's high-level path to its objective; operational scenarios detail the concrete actions and assets involved Correct answer.
  4. Strategic scenarios cover only insiders; operational scenarios cover only external attackers

Explanation

A strategic scenario stays at the level of a threat source pursuing an objective against a business value, describing the high-level attack path. The operational scenario then breaks that path down into concrete actions, supporting assets, and elementary events.

Question 4EBIOS Risk Manager

A team lists a feared event as 'disclosure of customer medical records'. Which workshop does this item primarily belong to?

  1. Workshop 3, strategic scenario construction
  2. Workshop 2, threat source and objective pairing
  3. Workshop 4, operational scenario construction
  4. Workshop 1, framing and baseline Correct answer.

Explanation

Feared events (événements redoutés) are defined during the framing and baseline workshop, where business values and the consequences of their degradation are identified. Threat sources and scenarios are elaborated in later workshops using these feared events as anchors.

Question 5EBIOS Risk Manager

What is the role of 'gravité' (severity) in the EBIOS RM risk assessment?

  1. It measures the likelihood that a threat source initiates an attack
  2. It counts the number of supporting assets exposed to the scenario
  3. It captures the magnitude of impact on the business value if the feared event occurs Correct answer.
  4. It records the maturity level of the security baseline controls

Explanation

Severity in EBIOS RM expresses the impact on the organization if a feared event is realized, independent of how likely it is. Likelihood is captured separately through the threat source's motivation and the feasibility of the attack path.

Question 6EBIOS Risk Manager

In EBIOS RM, how is the likelihood of a strategic scenario typically assessed?

  1. By measuring the residual risk after treatment
  2. By multiplying severity by the number of supporting assets
  3. By auditing the security baseline controls one by one
  4. By combining the threat source's motivation and the feasibility of reaching the objective Correct answer.

Explanation

Likelihood for a strategic scenario is derived from the threat source's motivation (interest in the objective) together with the feasibility of the attack path given the current baseline. It is a qualitative judgment, often scored on a defined scale.

Question 7EBIOS Risk Manager

What does the risk matrix in EBIOS RM combine to position a scenario?

  1. Vulnerability and exploitability
  2. Cost and benefit
  3. Confidentiality and availability
  4. Severity and likelihood Correct answer.

Explanation

The EBIOS RM risk map places scenarios on a grid of severity (impact) versus likelihood, producing a qualitative risk level. This lets teams prioritize scenarios for treatment.

Question 8EBIOS Risk Manager

Which of the following best describes a 'mesure de sécurité' in the EBIOS RM treatment step?

  1. A countermeasure selected to reduce the likelihood or severity of a scenario Correct answer.
  2. A feared event recorded during framing
  3. A threat source's stated objective
  4. A supporting asset added to the scope

Explanation

Security measures are the treatment options chosen to lower either the likelihood of a scenario or the severity of its impact. They are mapped to the scenarios they address and then assessed for residual risk.

Question 9EBIOS Risk Manager

After selecting security measures, what does EBIOS RM require regarding residual risk?

  1. It must be ignored because measures are assumed effective
  2. It must be re-evaluated to confirm the scenario's risk level is acceptable Correct answer.
  3. It must be reported only to external auditors
  4. It must be converted into an annualized financial figure

Explanation

Once measures are chosen, the scenario is re-assessed to estimate the residual risk level and confirm it falls within the organization's acceptance criteria. If not, additional measures or a different treatment option are considered.

Question 10EBIOS Risk Manager

What is the purpose of the 'socle' (baseline) in the framing workshop?

  1. To list the security controls already deployed that scenarios can rely on or that reveal gaps Correct answer.
  2. To define the threat sources to be considered
  3. To name the auditors who will validate the study
  4. To record the budget allocated to the risk study

Explanation

The socle documents the security measures already in place across the organization, giving a realistic starting point. Scenario feasibility and gap analysis are judged against this baseline rather than assuming a blank slate.

Question 11EBIOS Risk Manager

A hospital wants to build strategic scenarios for its patient-record system. Which input is most essential from the previous workshop?

  1. The pairing of threat sources with their target objectives Correct answer.
  2. The residual risk scores of treated scenarios
  3. The audit findings from the last penetration test
  4. The list of security measures already budgeted

Explanation

Strategic scenarios are constructed by combining threat sources with the objectives they pursue against the organization's values. This pairing, produced in the earlier workshop, is the direct input for building those scenarios.

Question 12EBIOS Risk Manager

In EBIOS RM, what does an 'elementary event' represent within an operational scenario?

  1. The overall business impact of the scenario
  2. A single concrete action or occurrence that contributes to the attack path Correct answer.
  3. The threat source's long-term motivation
  4. The final decision to accept or reduce risk

Explanation

Operational scenarios are decomposed into elementary events, each a discrete action or occurrence along the attack path. Assessing each event's likelihood and the controls in place helps estimate the overall scenario feasibility.

Question 13EBIOS Risk Manager

How does EBIOS RM treat the relationship between supporting assets and business values?

  1. Each business value maps to exactly one supporting asset by rule
  2. Supporting assets replace feared events in the risk matrix
  3. Supporting assets are the technical elements whose compromise can degrade a business value Correct answer.
  4. Supporting assets are irrelevant to business values and assessed separately

Explanation

Business values (what matters to the organization) are realized through supporting assets such as systems, people, and facilities. Compromising those assets is how a feared event on a business value becomes possible.

Question 14EBIOS Risk Manager

Which statement best captures how EBIOS RM handles the concept of 'risk origin' versus 'impact'?

  1. It treats impact as a property of the threat source only
  2. It merges origin and impact into a single monetary score
  3. It separates the source and path of the risk from the consequences on business values Correct answer.
  4. It ignores impact and focuses solely on attacker capability

Explanation

EBIOS RM deliberately distinguishes the risk's origin (threat source and attack path) from its impact (feared event and severity on business values). Keeping them separate allows targeted treatment of either likelihood or severity.

Question 15EBIOS Risk Manager

During treatment, a team decides to transfer part of a risk via insurance. In EBIOS RM terms, this is best described as:

  1. A likelihood reduction measure
  2. A risk sharing or transfer option Correct answer.
  3. A risk acceptance option with no measure
  4. A risk avoidance option

Explanation

EBIOS RM recognizes treatment options aligned with standard risk management: avoid, reduce, transfer/share, and accept. Insurance transfers part of the financial consequence, so it is a sharing/transfer option rather than a reduction of likelihood.

Question 16EBIOS Risk Manager

What is the main output of the EBIOS RM study that decision-makers use to prioritize action?

  1. A list of employee names with access rights
  2. A complete inventory of every network packet captured
  3. A ranked set of scenarios with risk levels and proposed treatments Correct answer.
  4. A financial audit report of the organization

Explanation

The study produces a prioritized view of scenarios mapped on the risk grid, each with associated treatment measures and residual risk. Decision-makers use this to allocate effort to the highest risks.

Question 17EBIOS Risk Manager

Which activity belongs to the operational scenario workshop rather than the strategic one?

  1. Naming the threat source pursuing a business objective
  2. Defining the organization's essential values
  3. Selecting the security baseline controls to keep
  4. Identifying the concrete supporting assets and elementary actions used in the attack Correct answer.

Explanation

The operational workshop drills into how the attack would actually unfold, naming supporting assets and elementary events. The strategic workshop stays at the level of source, objective, and high-level path.

Question 18EBIOS Risk Manager

In EBIOS RM, why are threat sources characterized by motivation and capability rather than by name alone?

  1. Because motivation determines the severity scale value
  2. Because names are confidential and cannot be recorded
  3. Because motivation and capability drive the likelihood judgment for scenarios Correct answer.
  4. Because only capability affects severity

Explanation

Knowing why a source is interested and what it can do allows the team to judge how plausible a scenario is. A named source without these attributes gives little basis for a likelihood estimate.

Question 19EBIOS Risk Manager

A scenario is rated high severity but low likelihood. What is a reasonable EBIOS RM treatment stance?

  1. Always ignore it because likelihood is low
  2. Monitor it and consider low-cost measures to reduce severity or improve detection Correct answer.
  3. Remove it from the risk map to simplify reporting
  4. Reduce its severity rating to match the likelihood

Explanation

High-severity, low-likelihood scenarios still deserve attention because consequences could be severe. EBIOS RM supports choosing proportionate measures, such as monitoring or contingency planning, rather than dismissing the scenario.

Question 20EBIOS Risk Manager

What does the term 'valeur métier' (business value) refer to in EBIOS RM?

  1. What is essential to the organization's mission and must be protected Correct answer.
  2. The technical configuration of a firewall
  3. The market price of the organization's shares
  4. The monetary cost of a security measure

Explanation

Business values are the processes, information, and assets essential to fulfilling the organization's mission. Feared events describe what happens when these values are degraded.

Question 21EBIOS Risk Manager

Which sequence reflects the logical flow of EBIOS RM workshops from framing to treatment?

  1. Strategic scenarios, framing, operational scenarios, threat sources, treatment
  2. Treatment, operational scenarios, strategic scenarios, framing, threat sources
  3. Framing, threat sources/objectives, strategic scenarios, operational scenarios, treatment Correct answer.
  4. Threat sources, framing, treatment, strategic scenarios, operational scenarios

Explanation

EBIOS RM proceeds from framing and baseline, to pairing threat sources with objectives, to strategic scenarios, to operational scenarios, and finally to risk treatment. Each step builds on the outputs of the previous one.

Question 22EBIOS Risk Manager

How does EBIOS RM support justification of security investments to management?

  1. By linking each measure to the scenarios and risk levels it reduces Correct answer.
  2. By ranking measures purely by their purchase price
  3. By guaranteeing a fixed return on every measure
  4. By replacing risk analysis with a compliance checklist

Explanation

Each proposed measure is tied to the scenarios it addresses and the expected reduction in likelihood or severity. This traceability lets management see why a measure matters relative to the risk it mitigates.

Question 23EBIOS Risk Manager

In the operational scenario, what does assessing the 'feasibility' of an elementary event depend on?

  1. The number of business values in scope
  2. The organization's annual revenue
  3. The severity of the feared event only
  4. The controls in place and the difficulty for the threat source to perform the action Correct answer.

Explanation

Feasibility of an elementary event reflects how hard it is for the threat source to carry it out given existing controls and conditions. This feeds into the overall likelihood of the operational scenario.

Question 24EBIOS Risk Manager

What is a 'risque résiduel' in the EBIOS RM treatment step?

  1. The risk before any measure is considered
  2. The risk that has been fully eliminated
  3. The risk remaining after selected measures are applied Correct answer.
  4. The risk belonging to a third-party supplier only

Explanation

Residual risk is what remains once the chosen security measures are taken into account. It is compared against acceptance criteria to decide whether further action is needed.

Question 25EBIOS Risk Manager

A team finds that one strategic scenario maps to several operational scenarios. How should EBIOS RM handle this?

  1. Assess each operational scenario and aggregate their contribution to the strategic risk Correct answer.
  2. Keep only the operational scenario with the highest severity
  3. Discard the strategic scenario because it is too broad
  4. Merge all operational scenarios into a single elementary event

Explanation

A single strategic scenario can be realized through multiple concrete attack paths, each an operational scenario. Each is assessed, and their results inform the overall risk judgment for the strategic scenario.

Question 26EBIOS Risk Manager

Which EBIOS RM workshop produces the study's scope, the feared events, and the baseline security framework?

  1. Workshop 4, operational scenarios
  2. Workshop 1, framing and scope Correct answer.
  3. Workshop 3, strategic scenarios
  4. Workshop 5, risk treatment

Explanation

Workshop 1 establishes why the study is conducted, which business values and perimeter are in scope, and what the organisation's baseline (socle) of security requirements is. Feared events (événements redoutés) are also formalised there because they anchor every later scenario. Later workshops build on this foundation rather than redefining scope.

Question 27EBIOS Risk Manager

In EBIOS RM, what is a 'feared event' (événement redouté)?

  1. A technical vulnerability identified during a penetration test
  2. An undesired impact on a business value that the study aims to prevent Correct answer.
  3. A confirmed security incident recorded in the incident register
  4. A regulatory obligation imposed on the organisation

Explanation

A feared event expresses the negative consequence on a business value (valeur métier) that stakeholders refuse to accept, such as loss of patient confidentiality or unavailability of a service. It is defined from the business perspective, not from the attacker's or the tooling's perspective. Feared events are the reference point against which strategic and operational scenarios are judged.

Question 28EBIOS Risk Manager

Which element belongs to the 'supporting assets' (biens supports) layer rather than the business-value layer in EBIOS RM?

  1. The mission of the organisation toward its users
  2. The database server hosting the customer records Correct answer.
  3. The reputation of the organisation with its customers
  4. The contractual obligation to keep customer data confidential

Explanation

Supporting assets are the technical, human, organisational or physical elements on which business values rely, such as servers, applications, networks, premises and staff. They are the layer where elementary events occur and where security measures are ultimately applied. Business values and their feared events sit above them.

Question 29EBIOS Risk Manager

What distinguishes a strategic scenario from an operational scenario in EBIOS RM?

  1. Strategic scenarios are qualitative while operational scenarios are purely quantitative
  2. Strategic scenarios cover only cyber threats while operational scenarios cover physical threats
  3. Strategic scenarios describe threat-source objectives against business values; operational scenarios describe how supporting assets are attacked Correct answer.
  4. Strategic scenarios are built by management while operational scenarios are built only by technical staff

Explanation

A strategic scenario is a high-level narrative of a threat source pursuing an objective against business values, expressed in business language. An operational scenario then details the concrete path on supporting assets, through elementary events, that would realise that strategic scenario. Both use qualitative scales and both can involve cyber and physical elements.

Question 30EBIOS Risk Manager

In the EBIOS RM study, what is a threat source characterised by?

  1. Its motivation, its resources and its level of capability Correct answer.
  2. Its known malware family and command-and-control infrastructure
  3. Its country of origin and its legal status
  4. Its position in the organisation's supplier register

Explanation

Threat sources are described by what they want (motivation or objective) and what they can bring to bear (resources and capability), which allows the analyst to reason about relevance and plausibility. This abstraction avoids tying scenarios to a single named actor whose behaviour may change. It also supports comparing several threat sources against the same business values.

Question 31EBIOS Risk Manager

Which pair of criteria is used to position a scenario on the EBIOS RM risk matrix?

  1. Impact and detectability
  2. Frequency and cost of remediation
  3. Exploitability and patch level
  4. Likelihood and severity Correct answer.

Explanation

EBIOS RM positions scenarios using a likelihood dimension (gravity of the strategic scenario combined with the feasibility of the operational path) and a severity dimension derived from the impact on business values. The resulting cell drives the treatment decision. Detectability and remediation cost are not the matrix axes.

Question 32EBIOS Risk Manager

In the treatment workshop, which category of response corresponds to deciding to stop the activity that creates an unacceptable risk?

  1. Reducing the risk with additional security measures
  2. Accepting the risk with monitoring
  3. Transferring the risk to a third party
  4. Avoiding the risk by removing the activity Correct answer.

Explanation

Risk avoidance means eliminating the activity or the element that generates the risk, so the scenario no longer applies. It is distinct from reduction, which keeps the activity and lowers likelihood or severity, and from transfer or acceptance. EBIOS RM treatment compares these options against cost and residual risk.

Question 33EBIOS Risk Manager

What is the role of the 'reference' or baseline set of security measures in EBIOS RM treatment?

  1. It certifies the organisation against a national scheme
  2. It replaces the need for a risk assessment in small organisations
  3. It defines the maximum budget the organisation may spend
  4. It lists measures already required, so only gaps need to be addressed Correct answer.

Explanation

The baseline (socle) captures the security requirements and measures the organisation already considers mandatory, often drawn from standards or regulation. Treatment then focuses on the gap between this baseline and what the assessed risks require. It does not remove the need for risk assessment nor act as a certification.

Question 34EBIOS Risk Manager

A team rates a strategic scenario as highly plausible, and its operational path uses a well-known technique against an exposed service. How should the likelihood dimension be interpreted?

  1. Likelihood should be set to the lowest value because no incident has occurred yet
  2. Likelihood should be ignored because severity already captures the exposure
  3. Likelihood reflects the feasibility and prospects of success of the operational path, assessed separately from severity Correct answer.
  4. Likelihood should be derived only from the number of past incidents

Explanation

In EBIOS RM, operational likelihood is assessed from the feasibility and prospects of success of attack paths on supporting assets. A well-known technique and exposed service inform that assessment but do not by themselves establish a high rating. Severity reflects the consequences of the strategic scenario and is evaluated separately.

Question 35EBIOS Risk Manager

During workshop 4, analysts decompose an operational scenario into elementary events. What does an elementary event describe?

  1. A business value that must be protected
  2. An action or state on a supporting asset that advances the attack path Correct answer.
  3. A security measure already deployed on the perimeter
  4. A threat source's long-term strategic goal

Explanation

Elementary events are the atomic steps or states on supporting assets, such as gaining access to a server or exfiltrating a database, that together realise the operational scenario. Their feasibility is assessed individually, which lets analysts place measures precisely where they break the path. They are technical and asset-level, unlike business values or strategic goals.

Question 36EBIOS Risk Manager

An analyst must judge the feasibility of an elementary event. Which input is most directly relevant?

  1. The severity rating assigned to the related business value
  2. The number of security measures in the organisation's baseline
  3. The seniority of the manager who sponsors the study
  4. The attacker's capability and the exposure and weakness of the supporting asset Correct answer.

Explanation

Feasibility of an elementary event depends on what the threat source can do and on how exposed and how weak the relevant supporting asset is at that step. This is why the same elementary event can be easy for one threat source and hard for another. Severity, baseline size and sponsorship do not determine technical feasibility.

Question 37EBIOS Risk Manager

A team identifies a strategic scenario that could be realised through three different operational paths. What is the correct EBIOS RM handling?

  1. Delete the strategic scenario because it is too broad to assess
  2. Model each operational path separately and let the strategic scenario aggregate them Correct answer.
  3. Merge the three paths into a single operational scenario with one elementary event
  4. Keep only the path with the highest feasibility and discard the others

Explanation

A strategic scenario can be realised by several operational scenarios, each with its own elementary events and feasibility rating. Keeping them separate preserves the detail needed to place measures on specific assets. The strategic scenario then serves as the umbrella linking them to the same business values.

Question 38EBIOS Risk Manager

An organisation wants to justify a security investment to its executive committee using EBIOS RM outputs. Which combination best supports the argument?

  1. The number of pages in the study report and the number of meetings held
  2. The names of the threat sources considered and their countries of origin
  3. The list of vulnerabilities from the last scan and the patch backlog
  4. The risk map with likelihood and severity, the chosen measures, and the residual risk after treatment Correct answer.

Explanation

Decision-makers need to see which scenarios matter (the risk map), what is proposed in response, and what risk remains once measures are applied. This chain links spending to reduced exposure on the most significant scenarios. Raw vulnerability lists or process metrics do not convey risk reduction in business terms.

Question 39EBIOS Risk Manager

After measures are selected in workshop 5, what does EBIOS RM require the team to do with residual risk?

  1. Recalculate it only after the next annual audit
  2. Declare it out of scope because measures have been approved
  3. Reassess it and obtain explicit acceptance from the accountable authority Correct answer.
  4. Convert it entirely into transferred risk through insurance

Explanation

Residual risk is the risk that remains once the selected measures are assumed effective, and it must be reassessed rather than assumed away. The accountable authority then formally accepts it, which closes the treatment loop. Insurance may address part of it but cannot eliminate it.

Question 40EBIOS Risk Manager

Which statement best describes how EBIOS RM relates risk origin and risk impact?

  1. Origin and impact are the same thing expressed in different units
  2. Origin is always technical while impact is always financial
  3. Origin is assessed only after impact has been fully quantified
  4. Origin concerns threat sources and their intent, while impact concerns the effect on business values Correct answer.

Explanation

EBIOS RM separates the source side of risk, meaning threat sources with their motivation and capability, from the consequence side, meaning feared events and their impact on business values. Scenarios connect the two, which is why likelihood and severity are assessed on distinct scales. Conflating them would prevent analysts from targeting measures at the right place.

Question 41EBIOS Risk Manager

A team wants to enrich workshop 1 with context about the organisation's ecosystem. Which EBIOS RM element captures parties whose compromise could affect the organisation's business values?

  1. The residual risk register
  2. The catalogue of elementary events
  3. The baseline security framework
  4. The ecosystem of stakeholders and dependencies, including suppliers and partners Correct answer.

Explanation

EBIOS RM explicitly maps the ecosystem of the organisation, including partners, suppliers and other parties on which business values depend. This matters because a threat source may reach the organisation through a connected third party. The baseline, elementary events and residual risk belong to other steps of the method.

Question 42EBIOS Risk Manager

A scenario is judged to have very high severity but low likelihood. Which treatment stance is most consistent with EBIOS RM reasoning?

  1. Ignore it because likelihood is low
  2. Reduce the severity rating so the matrix cell looks acceptable
  3. Always transfer it fully to an insurer and close the study
  4. Consider targeted measures or contingency planning, and formally accept the remaining risk Correct answer.

Explanation

High severity means the impact on business values would be unacceptable if realised, so it cannot simply be dismissed on likelihood grounds. EBIOS RM supports choosing proportionate measures, possibly contingency or resilience measures, and having the accountable authority accept the residual risk. Adjusting the rating to improve the picture would falsify the assessment.

Question 43EBIOS Risk Manager

What is the primary purpose of the EBIOS RM study report delivered at the end of the process?

  1. To record every technical vulnerability found in the information system
  2. To list the names of all employees involved in the workshops
  3. To replace the organisation's security policy with a project document
  4. To present the assessed risks, the rationale for measures, and the accepted residual risk to decision-makers Correct answer.

Explanation

The report communicates the study's conclusions: which scenarios carry risk, why the selected measures are appropriate, and what residual risk the accountable authority accepts. It is a decision and justification artefact rather than a vulnerability inventory. It complements, rather than replaces, the security policy.

Question 44EBIOS Risk Manager

A team is choosing between two candidate measures for the same operational scenario. Which comparison is most aligned with EBIOS RM treatment?

  1. Prefer the measure that requires the fewest workshop participants
  2. Select the measure that appears first in the baseline document
  3. Compare their effect on the likelihood or severity of the scenario against their cost and operational impact Correct answer.
  4. Choose the measure with the most advanced technology regardless of effect

Explanation

EBIOS RM treatment weighs the expected risk reduction, expressed through the likelihood or severity of the scenario, against cost and operational constraints. This makes the choice defensible to decision-makers and avoids technology-driven selection. Position in a document or ease of organisation are not risk criteria.

Question 45EBIOS Risk Manager

In EBIOS RM, how are the workshops sequenced to move from context to decision?

  1. Treatment first, then scenarios, then framing
  2. Framing, then strategic scenarios, then operational scenarios, then treatment Correct answer.
  3. Strategic scenarios, then treatment, then framing, then operational scenarios
  4. Operational scenarios, then framing, then treatment, then strategic scenarios

Explanation

The method starts by framing scope, feared events and baseline, then builds strategic scenarios from threat sources and business values. Operational scenarios then detail the attack paths on supporting assets, and treatment selects and justifies measures. Each step depends on the outputs of the previous one.

Question 46EBIOS Risk Manager

An analyst argues that a threat source with high motivation but very limited capability should be rated as highly likely for a sophisticated attack path. How should this be resolved?

  1. Rate likelihood high only if the threat source has a known name
  2. Discard the threat source because it lacks a formal organisation
  3. Weigh motivation against capability and against the feasibility of the operational path before concluding Correct answer.
  4. Rate likelihood high because motivation alone drives the strategic gravity

Explanation

Strategic gravity reflects both the threat source's motivation and its capability, and it is then combined with the feasibility of the operational path. A highly motivated but low-capability source may still be relevant for easy paths but not for sophisticated ones. Naming or organisational form does not determine the rating.

Question 47EBIOS Risk Manager

Two business values depend on the same database server. A single elementary event compromising that server affects both. What does EBIOS RM imply for the analysis?

  1. The shared supporting asset creates a common point of failure that should be reflected when assessing scenarios and placing measures Correct answer.
  2. The database server should be removed from the supporting-asset inventory
  3. Only the business value with the higher severity should be modelled
  4. Each business value must be assessed with a different threat source

Explanation

Because supporting assets can carry several business values, a compromise can propagate to all of them, and the study should make this concentration visible. Measures placed on that asset then protect multiple values at once, which is useful for prioritisation. Dropping a value or the asset would hide real exposure.

Question 48EBIOS Risk Manager

A risk manager proposes to treat a scenario by purchasing cyber insurance and considers the matter closed. Which critique is most consistent with EBIOS RM?

  1. Insurance is never an admissible response in EBIOS RM treatment
  2. Transfer is valid, but likelihood and severity remain and residual risk must still be assessed and accepted Correct answer.
  3. Insurance automatically reduces the severity rating to the lowest level
  4. Insurance removes the need to document the scenario in the risk map

Explanation

Transfer shifts part of the financial consequence but does not prevent the event or remove the impact on business values. EBIOS RM therefore keeps the scenario in the risk map and requires residual risk to be reassessed and accepted. Other options, such as reduction measures, may still be needed.

Question 49EBIOS Risk Manager

During workshop 3, a team struggles because its strategic scenarios read like technical attack descriptions. What correction aligns with EBIOS RM?

  1. Add more technical steps to make the strategic scenarios more precise
  2. Rewrite them as threat-source objectives against business values, and push technical detail into operational scenarios Correct answer.
  3. Replace the business values with server names to simplify the narrative
  4. Merge workshops 3 and 4 to avoid the distinction entirely

Explanation

Strategic scenarios are meant to be expressed at the level of threat-source objectives and the business values at stake, so that business stakeholders can validate them. Technical attack steps belong to operational scenarios built in workshop 4. Merging the workshops would lose the separation that lets each audience contribute.

Question 50EBIOS Risk Manager

An organisation's baseline already mandates multi-factor authentication for all remote access. A scenario's operational path relies on password-only remote login. How should the analyst treat this?

  1. Delete the scenario because the baseline covers it
  2. Assume the path is infeasible because the baseline mandates multi-factor authentication, without further verification
  3. Raise the severity rating to reflect the baseline gap
  4. Assess whether the baseline is actually applied on the relevant assets before judging feasibility Correct answer.

Explanation

A baseline requirement only reduces feasibility if it is effectively deployed on the supporting assets in question. EBIOS RM analysis distinguishes the intended requirement from its real implementation, since gaps are common. Severity, which concerns impact on business values, is not adjusted to reflect an implementation gap.