Governance, Risk, and Compliance →mediumMultiple SelectObjective-mapped

CAS-004 Governance, Risk, and Compliance Practice Question

A security manager is selecting metrics to present to the board. Which two of the following are key risk indicators (KRIs) that would be most relevant for executive oversight? (Choose two.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Number of security incidents per quarter

KRIs provide early warning of increasing risk. Percentage of systems with critical vulnerabilities indicates exposure; number of security incidents indicates threat activity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Average time to patch critical vulnerabilities
Why it's wrong here
This is a KPI for patch management efficiency.
✗
Mean time to detect (MTTD)
Why it's wrong here
This is a KPI for detection capability.
✓
Number of security incidents per quarter
Why this is correct
This indicates the level of threat activity.
✗
Number of security awareness training completions
Why it's wrong here
This is a KPI, not a KRI; it measures activity, not risk.
✓
Percentage of systems with critical vulnerabilities
Why this is correct
This indicates exposure to exploitation.

Go deeper

CAS-004 Governance, Risk, and Compliance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question