EBIOS Risk Manager

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. Domain 2 - Risk Management Framework

   The chief executive of an organization believes that a firewall and an antivirus are enough and that no risk management approach is needed. Which argument drawn from EBIOS RM shows the limits of this reasoning?

   1. These two tools must first be matched against the likelihood of the feared events, estimated in Workshop 1 with the business, in order to adjust their configuration to what is at stake for the organization
   2. A firewall and an antivirus fall under the scenario-based approach, whereas the compliance-based approach addresses the targeted or sophisticated attacks aimed at the organization
   3. Before it can control its exposure, the organization must know what is liable to cause it harm, which requires listing the feared events and assessing their impacts
   4. The security baseline to which these tools belong is determined in Workshop 5, from the selected risk scenarios, each measure having to be justified by a scenario

2. Domain 1 - Fundamental Principles and Concepts

   At the kick-off meeting, a project manager proposes running the strategic cycle and the operational cycle as two independent analyses. How do these cycles fit together in EBIOS RM?

   1. The strategic cycle covers Workshops 1 to 3 and the operational cycle Workshops 4 and 5; their durations are set by management in Workshop 5
   2. The operational cycle reviews the whole study and the strategic cycle updates the strategic scenarios; their durations are defined in Workshop 1
   3. The strategic cycle reviews the strategic scenarios and the operational cycle the security baseline; their durations are set by the method at three years and one year
   4. The strategic cycle reviews the whole study and the operational cycle updates the operational scenarios; their durations are defined in Workshop 1

3. Domain 3 - Risk Assessment

   A consultant wants to assess the parts of the ecosystem according to whether they are external and to exclude all internal relationships on principle. According to EBIOS RM, which criterion brings an element into the ecosystem to be assessed, before any estimate of its threat level?

   1. The motivation, resources and activity attributed to it, whether internal or external to the organization
   2. The relevant attack vector that it represents, owing to its privileged access or to its vulnerability
   3. The support it provides to the business assets, whether digital, physical or organizational in nature
   4. The relevance of its interaction with the studied object, whether internal or external to the organization

4. Domain 2 - Risk Management Framework

   A CISO rates the severity of a feared event at G3, while a business manager rates it at G1. The CISO cites technical damage. Which definition of severity should guide the discussion according to EBIOS RM?

   1. The probability that the event will occur, given the existing measures and the vulnerabilities of the supporting assets concerned
   2. The intensity of the harmful consequences of the event on the business assets and the missions of the organization
   3. The combination of the observed frequency of the event and the number of supporting assets affected when it materializes
   4. The sum of the direct and indirect costs incurred to restore all the supporting assets concerned

5. Domain 1 - Fundamental Principles and Concepts

   During a training course, one participant maintains that the EBIOS Risk Manager method has 4 workshops, while another claims that it has 6. What is the exact number of workshops and in what order do they follow one another?

   1. 6 workshops: Introduction, Scope, Risk origins, Strategic scenarios, Operational scenarios and Treatment, covering the whole process including initial awareness-raising
   2. 5 workshops: Scope and security baseline, Risk origins, Strategic scenarios, Operational scenarios and Risk treatment, forming an iterative approach
   3. 3 workshops: Context analysis, Risk assessment and Risk treatment, following the classic cycle of the ISO 27005 standard for risk management
   4. 4 workshops: Scope, Risk origins, Attack scenarios and Risk treatment, enabling a sequential analysis of risk from identification to treatment

6. Domain 3 - Risk Assessment

   A study uses the illustrative model that divides exposure by cyber reliability, with comparable positive ratings. Which combination most clearly indicates a high threat level?

   1. Low exposure with high reliability: few access opportunities against solid protection
   2. High exposure with high reliability: many access opportunities against solid protection
   3. High exposure with low reliability: many access opportunities against insufficient protection
   4. Low exposure with low reliability: few access opportunities against insufficient protection

7. Domain 2 - Risk Management Framework

   A consultant proposes using EBIOS RM to analyse physical and environmental risks as well as cyberattacks. Through which component of the method are risks linked to accidental or environmental events addressed?

   1. The compliance-based approach, which determines in Workshop 1 the security baseline covering the studied object's common risks
   2. The scenario-based approach, which identifies in Workshops 3 and 4 the advanced risks and particularly targeted attacks
   3. The operational cycle, which revisits the operational scenarios in the light of the security incidents that have occurred
   4. The mapping of the ecosystem, which positions the stakeholders in Workshop 3 according to their threat level

8. Domain 1 - Fundamental Principles and Concepts

   Which expansion of the acronym EBIOS and which description of its origin are correct?

   1. Expression des Besoins et Identification des Objectifs de Sécurité: a method created by ANSSI when it was founded, then overhauled by the Agency under the name Risk Manager
   2. Expression des Besoins et Inventaire des Objectifs de Sécurité: a method created by Club EBIOS, then published by ANSSI under the name Risk Manager
   3. Expression des Besoins et Identification des Objectifs de Sécurité: a French method that predates ANSSI, which became Risk Manager driven by the Agency
   4. Étude des Besoins et Identification des Objectifs de Sécurité: a French method derived from the ISO/IEC 27005 standard, then adapted by ANSSI under the name Risk Manager

9. Domain 3 - Risk Assessment

   After the threat level estimate, ORVALYS decides to impose new contractual security requirements on its SaaS provider Cargonis. Under what condition can the threat level of Cargonis be revised downwards for the rest of the analysis?

   1. Provided that the measure is actually implemented before the rest of the analysis, failing which it has no immediate effect
   2. As soon as the measure is entered in the risk treatment plan, with an owner and a deadline, its effect then being deemed achieved
   3. As soon as management has approved the principle of the measure, this decision being enough to change the stakeholder's rating
   4. Only in the next strategic cycle, as no reassessment of the threat level is allowed while the study is under way

10. Domain 2 - Risk Management Framework

    An ISO 27001 auditor notes that the organization's asset inventory does not distinguish "primary assets" from "supporting assets". The CISO explains to her that EBIOS RM uses a different vocabulary. What is the definition of a supporting asset in EBIOS RM?

    1. A component important to the organization in fulfilling its mission, which may be a service, a support function or an item of information
    2. An element interacting directly or indirectly with the studied object, which may be a person, an information system or an organization
    3. An element considered highly likely to be targeted by a risk origin to achieve its objective, as it appears in the operational scenarios
    4. A component of the information system on which one or more business assets rely, which may be digital, physical or organizational in nature

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.