Instant Access CompTIA.PK0-005.v2026-11-03.q180 Actual Practice Test Engine for Free (Page 3)

Question 6

Which of the following should be the PRIMARY basis for establishing metrics that measure the effectiveness of an information security program?

A.Residual risk
B.Regulatory requirements
C.Risk tolerance
D.Control objectives

Correct Answer: D

Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and protect information assets. Control objectives should be the primary basis for establishing metrics that measure the effectiveness of an information security program, as they align with the business objectives, requirements, and expectations of the organization and its stakeholders. Metrics based on control objectives can help to evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and areas for improvement. The other options are not correct because:
Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk should be monitored and reported, but it does not define the desired outcomes or goals of the security program.
Regulatory requirements are the external standards, laws, and regulations that the organization must comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for establishing metrics, but rather a constraint or a driver for the security program. Metrics based on regulatory requirements can help to demonstrate compliance, but they may not reflect the actual effectiveness or efficiency of the security program.
Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on risk tolerance can help to prioritize and allocate resources, but they may not measure the actual outcomes or goals of the security program. Reference = Key Performance Indicators for Security Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information Security: The 10 Most Important Security Metrics; Why metrics are crucial to proving cybersecurity programs' value; Implementing and Maintaining Security Program Metrics

Question 7

An opportunity emerged in the middle of a project life cycle. Which of the following is the BEST action for the project manager to take?

A.Exploit the risk.
B.Accept the risk.
C.Avoid the risk.
D.Transfer the risk.

Question 8

A client provides a project plan to the assigned project manager and suggests that the project manager and team just need to execute the plan. Upon further investigation, the document contains:
* Purpose
* Scope of work
* Location of work
* Period of performance
* Deliverables schedule
* Applicable standards
* Acceptance criteria
* Special requirements
* Payment schedule
Which of the following documents did the client provide to the project manager?

A.RFP
B.WBS
C.SLA
D.SOW

Question 9

A project manager is assigned to a project that has contracted with vendors. Which of the following actions should the project manager most frequently take? (Select two).

A.Update the issue log
B.Create a project charter
C.Validate the status report
D.Monitor performance
E.Approve deliverables
F.Baseline the project schedule

Question 10

Which of the following would be considered operational security?

A.Mobile device compliance
B.Background screening
C.Multifactor authentication
D.Facility access

Question 6

Question 7

Question 8

Question 9

Question 10

Download PDF File