grceng.academy
YAML lab 40 bonus XP

Author a supported risk entry

Start labRead the room

Objectives

Build the decision fields for AQ-17 from the fixed requirements. The reviewer has already approved the scenario narrative and evidence links; this exercise checks the structured fields, not the completeness of a real register.

Controls have been tested. Do not substitute the planned target for the current residual estimate, or assign business acceptance to the person running the safeguard.

AQ-17 mandatory register fields

asset_id: exports-01
classification: confidential
scenario: Former contractor uses an unrevoked account to download customer exports, causing disclosure.
inherent: likelihood 4, impact 4, score 16
existing_controls: account removal and recurring access review; operating test passed 2026-06-01
current_residual: likelihood 2, impact 4, score 8
risk_owner: operations director
control_owner: identity administrator
treatment: mitigate
review: quarterly (every 3 months) for current medium residual risk; reassess on material change

Checks the server runs (5)

  • Identify and classify the asset
  • Record the pre-control assessment
  • Use the tested current exposure
  • Separate business and safeguard accountability
  • Declare treatment and routine and triggered review

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Anchor the entry

    Transfer the asset identifier and handling label from the requirement block.

    Identify and classify the asset

  2. Step 2

    Record the baseline

    Use the before-control ratings and multiply them under the room's scoring policy.

    Record the pre-control assessment

  3. Step 3

    Apply operating evidence

    Use only the demonstrated change in the event pathway; preserve the consequence rating.

    Use the tested current exposure

  4. Step 4

    Allocate responsibilities

    Assign the business decision to its authorized role and control operation to its maintainer.

    Separate business and safeguard accountability

  5. Step 5

    Keep the decision alive

    Record the chosen response, translate the current band cadence into months, and enable reassessment when conditions change.

    Declare treatment and routine and triggered review

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.