CAS-004 Governance, Risk, and Compliance Practice Question
A security manager is selecting key risk indicators (KRIs) for the organization's risk management program. Which THREE of the following are examples of KRIs that can provide early warning of increasing risk?
⚠ Common exam trap
CAS-005 often tests the confusion between KRIs and Key Performance Indicators (KPIs), where candidates may select lagging metrics like MTTD as KRIs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Number of failed login attempts per hour
Option A (number of failed login attempts per hour) is a valid KRI because a rising rate of authentication failures is a leading indicator of brute-force, password-spraying, or credential-stuffing attacks, giving early warning before a breach occurs. Option C (percentage of users with privileged access) is a KRI because excessive or growing privileged accounts expand the attack surface and the potential blast radius of a compromise, signaling creeping access-control risk. Option D (number of unpatched critical vulnerabilities) is a KRI because a growing count of unpatched critical CVEs directly raises the likelihood of exploitation and is a measurable, forward-looking exposure metric. Option B (MTTD) is a key performance indicator of detection efficiency, not an early-warning risk indicator, and Option E (percentage of systems with current backups) is a control-effectiveness or compliance metric rather than a leading indicator of increasing risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Number of failed login attempts per hour
Why this is correct
Failed login attempts per hour is a leading indicator of credential-stuffing or brute-force activity, rising before a successful compromise. Monitoring this rate provides early warning of authentication attacks, letting the security manager intervene before an account is breached.
- ✗
Mean time to detect (MTTD) for incidents
Why it's wrong here
MTTD is a lagging operational metric: it measures detection performance after incidents have already occurred, so it cannot provide early warning of rising risk. It is tempting because it is a widely tracked security KPI, but KRIs must be forward-looking indicators such as control coverage or vulnerability ageing.
- ✓
Percentage of users with privileged access
Why this is correct
Tracking the percentage of users holding privileged access gives early warning of creeping entitlement sprawl, since growth in administrative accounts widens the attack surface before any breach occurs. It is a measurable, forward-looking indicator rather than a lagging incident count.
- ✓
Number of unpatched critical vulnerabilities
Why this is correct
Tracking unpatched critical vulnerabilities directly satisfies the KRI requirement for early warning, since a rising count signals deteriorating patch management before exploitation occurs. Unlike lagging indicators such as incident counts, this metric is forward-looking and measurable, letting the security manager intervene while exposure is still increasing.
- ✗
Percentage of systems with current backups
Why it's wrong here
This is a control metric, not a risk indicator; it measures readiness.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.