PK0-005 Premium Exam Questions

Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and protect information assets. Control objectives should be the primary basis for establishing metrics that measure the effectiveness of an information security program, as they align with the business objectives, requirements, and expectations of the organization and its stakeholders. Metrics based on control objectives can help to evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and areas for improvement. The other options are not correct because:

• Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk should be monitored and reported, but it does not define the desired outcomes or goals of the security program.
• Regulatory requirements are the external standards, laws, and regulations that the organization must comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for establishing metrics, but rather a constraint or a driver for the security program. Metrics based on regulatory requirements can help to demonstrate compliance, but they may not reflect the actual effectiveness or efficiency of the security program.
• Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on risk tolerance can help to prioritize and allocate resources, but they may not measure the actual outcomes or goals of the security program. References = Key Performance Indicators for Security Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information Security: The 10 Most Important Security Metrics; Why metrics are crucial to proving cybersecurity programs’ value; Implementing and Maintaining Security Program Metrics

Avoiding is a conflict resolution technique that involves postponing or withdrawing from a conflict situation. The project manager is using this technique by taking a break and continuing the meeting on another day, hoping that the conflict will resolve itself or become less important over time. This technique may be appropriate when the conflict is trivial, the potential damage is greater than the benefits, or more information is needed before making a decision. References = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition, Chapter 10: Executing and Closing Projects, page 287; [CompTIA Project+ Certification Exam Objectives], Domain 3: Project Execution, Objective 3.2: Given a scenario, apply appropriate conflict resolution techniques.

The project manager should review existing artifacts to get an understanding of the purpose of the project. Existing artifacts are documents or records that provide information about the project background, context, scope, objectives, requirements, stakeholders, and deliverables. They may include documents such as project proposal, project charter, business case, feasibility study, statement of work (SOW), or contract. Reviewing existing artifacts can help to clarify the project vision and expectations and provide a basis for planning and executing the project.

A transition plan is a document that outlines how the project deliverables will be transferred to the operations team or the end users, and how the project team will disengage from the project. It typically includes details such as operational training, go-live date, support arrangements, roles and responsibilities, and acceptance criteria. A transition plan is different from a project closeout report, which summarizes the project performance, lessons learned, and final status. A handover to operations is a process of transferring the project deliverables to the operations team, but it is not a document. A phase-gate review documentation is a set of documents that are used to evaluate the project progress and readiness to move to the next phase, but it is not related to the operational handoff. References = CompTIA Project+ PK0-005 Certification Study Guide, Chapter 14: Closing the Project, p. 409-410; [CompTIA Project+ Certification Exam Objectives], Domain 4: Project Closure, Objective 4.1: Compare and contrast various project closure activities.