Explain How a Businesss Risk Tolerance Informs a Security Programs Metrics. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An e-commerce company has a high risk tolerance for fraud-related losses but a low risk tolerance for website downtime. The security team is developing metrics for the payment processing system. Which metric should be given the highest priority in executive dashboards?

   • AAverage time to detect a fraudulent transaction
   • BAvailability of the payment processing system
   • CNumber of payment gateway errors per hour
   • DPercentage of payment transactions that are fraudulent
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A software company has a high risk appetite for rapid feature development but a low risk tolerance for security vulnerabilities in production. The security team has set a metric for 'percentage of vulnerabilities remediated within 30 days.' The development team is not prioritizing this metric because they do not see it as aligned with their goal of shipping features quickly. What should the security team do?

   • AIncrease the remediation time to 60 days to reduce pressure on developers
   • BRemove the metric and replace it with a feature delivery metric
   • CCommunicate the company's risk tolerance and how the metric supports business objectives
   • DReport the metric only to the CISO, not to the development team
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement best defines risk tolerance in the context of a security program?

   • AThe process of transferring all risks to third-party vendors
   • BThe total amount of risk that must be eliminated to achieve a zero-risk posture
   • CThe maximum level of risk an organization is willing to accept in pursuit of its objectives
   • DThe minimum level of risk required to achieve business objectives
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A retail company has a high risk appetite for adopting new technologies but a low risk tolerance for customer data exposure. The security team is setting a threshold for the metric 'percentage of customer data encrypted at rest.' Which threshold is most appropriate?

   • A100% of customer data encrypted at rest
   • B70% of customer data encrypted at rest
   • C80% of customer data encrypted at rest
   • D90% of customer data encrypted at rest
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important to communicate risk tolerance to stakeholders?

   • ASo stakeholders understand why certain metrics are prioritized and what actions are expected
   • BSo stakeholders can set the security budget
   • CSo stakeholders can approve every security decision
   • DSo stakeholders can identify all security vulnerabilities
   Reveal Solution Discussion Select an answer first