CAS-004 Governance, Risk, and Compliance Practice Question
A security manager is selecting key risk indicators (KRIs) for the organization's risk management program. Which THREE of the following are examples of KRIs that can provide early warning of increasing risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Number of failed login attempts per hour
KRIs measure risk levels and can indicate changes. Unpatched critical vulnerabilities, number of failed login attempts, and percentage of users with privileged access are direct indicators of risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Number of failed login attempts per hour
Why this is correct
Correct: An increase may indicate brute-force attacks, increasing risk.
- ✗
Mean time to detect (MTTD) for incidents
Why it's wrong here
MTTD is a performance metric, not a risk indicator; it measures efficiency.
- ✓
Percentage of users with privileged access
Why this is correct
Correct: More privileged users increase the risk of insider threats or credential misuse.
- ✓
Number of unpatched critical vulnerabilities
Why this is correct
Correct: An increase indicates higher risk of exploitation.
- ✗
Percentage of systems with current backups
Why it's wrong here
This is a control metric, not a risk indicator; it measures readiness.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.