grceng.academy
YAML lab 40 bonus XP

Repair the incident vocabulary

Start labRead the room

Objectives

An analyst has put confident but contradictory labels into a risk record. Build a structured replacement from the fixture; use the short canonical terms requested, not a narrative.

This checks classification and simple arithmetic, not whether an implemented safeguard actually works. The given residual assumptions are supported by testing for this exercise.

Risk record requirements

asset: address records
weakness: supplier login lacks a second factor
classify the weakness using the risk vocabulary
baseline: inherent annual probability 0.20; loss per incident 100000
post-control: residual annual probability 0.05; loss per incident 40000
calculate each expected annual loss as probability times loss per incident
alert: notifies an analyst after an export; implemented in software
permission: policy authority permits a 30-day departure from the login rule
risk owner has NOT made a decision to retain the exposure

Checks the server runs (5)

  • Identify the asset and classify the weakness
  • Calculate inherent and residual expected annual loss
  • Classify the alert by function
  • Classify the alert by implementation
  • Separate a policy departure from retained-risk authorization

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Separate value from weakness

    Locate what the company wants to protect, then name the category of the condition that enables harm. Do not put the incident itself in the asset field.

    Identify the asset and classify the weakness

  2. Step 2

    Keep baselines aligned

    Compute the before-control and after-control estimates independently using the paired assumptions. Enter numbers, not qualitative ratings or currency symbols.

    Calculate inherent and residual expected annual loss

  3. Step 3

    Ask when the mechanism acts

    Determine whether the software stops an action, reports it, or repairs its consequences. Then classify the mechanism on the separate implementation axis.

    Classify the alert by functionClassify the alert by implementation

  4. Step 4

    Read the actual authorization

    Name the kind of permission the signer granted, and use a boolean to record whether the separate exposure-retention decision has occurred. Do not infer that decision from silence.

    Separate a policy departure from retained-risk authorization

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.