Explain How a Businesss Risk Tolerance Informs a Security Programs Metrics. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does risk tolerance influence which security metrics are relevant for monitoring?

   • AMetrics are selected based solely on industry best practices, regardless of risk tolerance
   • BMetrics are selected to maximize the number of security controls implemented
   • CMetrics that measure risks within the organization's tolerance level are prioritized for monitoring
   • DMetrics are selected to minimize the number of reported risks
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A utility company has a low risk tolerance for grid failures and a high risk tolerance for data collection inefficiencies. The security team is setting a threshold for the metric 'percentage of critical systems with backup power.' The operations team argues that 95% is sufficient, while the security team wants 100%. Which threshold is most appropriate?

   • A95% of critical systems with backup power
   • B90% of critical systems with backup power
   • CSet no threshold and rely on periodic testing
   • D100% of critical systems with backup power
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A tech startup has a high risk appetite for innovation and speed to market, but a low risk tolerance for downtime of its customer-facing platform. The security team is selecting metrics for the new DevOps pipeline. Which metric should be prioritized to align with this risk profile?

   • AMean time to recover (MTTR) from service incidents
   • BNumber of code vulnerabilities found in production
   • CPercentage of features deployed without rollback
   • DTime to patch critical vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key benefit of clearly communicating risk tolerance to stakeholders?

   • AIt reduces the need for security monitoring
   • BIt ensures metrics are interpreted consistently and acted upon appropriately
   • CIt guarantees that all security risks will be eliminated
   • DIt eliminates the need for security policies
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is it important for security metrics to reflect business objectives?

   • ATo simplify the security reporting process
   • BTo increase the number of security controls
   • CTo ensure security investments are directed toward protecting what matters most to the business
   • DTo satisfy external auditors' requirements
   Reveal Solution Discussion Select an answer first