Explain How a Businesss Risk Tolerance Informs a Security Programs Metrics. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why does risk tolerance affect the prioritization of security metrics for reporting?

   • AMetrics are prioritized based on the ease of data collection
   • BMetrics are prioritized based on the number of security tools deployed
   • CMetrics that reflect risks exceeding tolerance are given higher priority in reporting
   • DMetrics that show low risk are always reported first
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A media company has a high risk tolerance for content piracy but a low risk tolerance for service outages. The security team is defining metrics for the streaming platform. Which metric should be the primary focus?

   • AAverage time to detect a security breach
   • BStreaming service uptime percentage
   • CNumber of pirated content takedowns
   • DPercentage of content delivered in high definition
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A regional bank is expanding its mobile banking app. The board has stated that the bank will accept moderate risk to gain market share, but will not tolerate any breach that exposes customer financial data. The CISO is defining the security metrics for the new app. Which metric should be prioritized for executive reporting?

   • APercentage of transactions completed within two seconds
   • BNumber of failed login attempts per day
   • CNumber of new mobile app features released per quarter
   • DTime to detect and contain a data breach involving customer financial data
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A multinational corporation has a high risk appetite for entering new markets, but a low risk tolerance for regulatory fines. The security team is setting a threshold for the metric 'percentage of systems compliant with data protection regulations.' The compliance team argues for a 100% threshold, while the business development team argues that 90% is sufficient because the company can accept some risk. The CISO must decide. Which threshold is most appropriate?

   • A95% compliance threshold
   • B90% compliance threshold
   • C100% compliance threshold
   • DSet no threshold and rely on periodic audits
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do risk appetite and risk tolerance relate in setting security program boundaries?

   • ARisk tolerance operationalizes risk appetite by defining acceptable limits for specific security activities
   • BRisk appetite defines the maximum security budget, while risk tolerance defines the minimum
   • CRisk appetite and risk tolerance are independent and do not influence each other
   • DRisk tolerance is the overall strategy, and risk appetite is the tactical implementation
   Reveal Solution Discussion Select an answer first