Explain How a Businesss Risk Tolerance Informs a Security Programs Metrics. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A logistics company has a moderate risk tolerance for supply chain disruptions but a low risk tolerance for cyberattacks on its tracking systems. The security team is presenting metrics to the board. Which approach best ensures the board understands and acts on the metrics?

   • APresent metrics that show only positive trends
   • BPresent only technical metrics without context
   • CPresent metrics with clear explanations of how they relate to the company's risk tolerance
   • DPresent metrics in a single dashboard with no explanation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company has a low risk tolerance for operational technology (OT) network intrusions. The security team has defined a metric for 'unauthorized connection attempts to the OT network.' The plant managers, however, are ignoring the metric because they do not understand why it matters. What should the security team do to improve the effectiveness of this metric?

   • ACommunicate the risk tolerance and the metric's relevance to plant managers
   • BReplace the metric with a more technical one, such as 'number of IDS alerts'
   • CSet a lower threshold for the metric to make it easier to meet
   • DIncrease the frequency of reporting the metric to plant managers
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of setting metric targets based on risk tolerance?

   • ATo define the acceptable performance level for security controls
   • BTo ensure all security metrics are reported to the board
   • CTo guarantee that no security incidents occur
   • DTo reduce the number of security tools needed
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A government agency has a very low risk tolerance for unauthorized access to classified data. The security team is deciding which metrics to include in the monthly report to the agency director. Which metric should be included as a key indicator?

   • APercentage of employees who completed security awareness training
   • BNumber of new software features deployed
   • CNumber of access requests denied by the identity management system
   • DAverage time to resolve help desk tickets
   Reveal Solution Discussion Select an answer first