問題文
An auditor is following one entry in a risk register from end to end. The entry names a customer database, mentions a criminal group that sells stolen data, notes that the database accepts unfiltered query strings, and points at a treatment. Why does the auditor read the entry as a chain instead of a list?
選択肢
- Because the asset carries the value, the weakness opens the route, the threat travels the route, and the treatment shuts the route.
- Because the items follow the importance, the asset takes the lead, the threat takes the middle, and the treatment takes the closure.
- Because the items carry the proprietors, the asset shows the drafter, the risk shows the reviewer, and the treatment shows the finisher.
- Because the standard fixes the wording, the auditor reads the entry, the annex holds the phrasing, and the report notes the gap.