Free Access to CompTIA.PK0-005.v2026-01-27.q102 with Valid Practice Test (Page 19)

Question 86

Which of the following should be the PRIMARY basis for establishing metrics that measure the effectiveness of an information security program?

A.Residual risk
B.Regulatory requirements
C.Risk tolerance
D.Control objectives

Correct Answer: D

Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and protect information assets. Control objectives should be the primary basis for establishing metrics that measure the effectiveness of an information security program, as they align with the business objectives, requirements, and expectations of the organization and its stakeholders. Metrics based on control objectives can help to evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and areas for improvement. The other options are not correct because:
* Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk should be monitored and reported, but it does not define the desired outcomes or goals of the security program.
* Regulatory requirements are the external standards, laws, and regulations that the organization must
* comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for establishing metrics, but rather a constraint or a driver for the security program. Metrics based on regulatory requirements can help to demonstrate compliance, but they may not reflect the actual effectiveness or efficiency of the security program.
* Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on risk tolerance can help to prioritize and allocate resources, but they may not measure the actual outcomes or goals of the security program. References = Key Performance Indicators for Security Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information Security: The 10 Most Important SecurityMetrics; Why metrics are crucial to proving cybersecurity programs' value; Implementing and Maintaining Security Program Metrics

Question 87

A project team evaluated the performance of a new reporting system and the quantity of queries to be
processed during predetermined time stamps.

Which of the following is the current status of the process?

A.Based on the rule of seven, the process is under control
B.The amount of data is insufficient to determine if quality is low.
C.The process is out of control and should be revised.
D.The goal should be adjusted since most of the data points are close to the lower limit.

Question 88

During the execution of a project, a project manager wanted to discover how the number of worked hours was affecting the quality of given tasks. For a two-month period, the following data was documented:
Average worked hours
Which of the following describes the result?

A.A negative correlation exists between the number of mistakes and the working hours.
B.No correlation exists between the number of mistakes and the working hours.
C.A low correlation exists between the working hours and the number of mistakes.
D.A positive correlation exists between the number of mistakes and the working hours.

Question 89

During the execution phase, user accepted testing failed; nonetheless, the vendor PM is insisting that the program manager approve the invoice for this phase. Which of the following actions should the Program manager take?

A.Escalate the issue with the project sponsor and ask for assistance in managing the situation.
B.Work with the vendor to achieve a compromise that benefits everyone.
C.Approve the invoice to avoid damaging the relationship with the vendor.
D.Schedule a call with the vendor PM and vendor executive to review the statement of work.

Question 90

A project implementation partner and the project manager disagree about completed requirements. The project manager shows the project requirements as 70% complete. The implementation partner validates that all requirements were completed. Which of the following would clarify what the project implementation partner was contractually expected to complete?

A.SOW
B.RFI
C.RFQ
D.WBS

Question 86

Question 87

Question 88

Question 89

Question 90

Download PDF File