Question

Which of the following provides the MOST comprehensive understanding of an organization’s information security posture?

A. Risk management metrics
B. External audit findings
C. Results of vulnerability assessments
D. The organization’s security incident trends

Correct Answer: A ???? or D?????? or ...........

______________________

Note

■ Some good websites claim that the correct answer is A ("Risk management metrics").

■ Others good websites claim that the correct answer is D ("The organization’s security incident trends").

■ Why A and not D? Why D and not A?

Many thanks!

Answer 1

Answer : A. Risk management metrics

Explanation :

• Both Risk management metrics and The organisation’s security incident trends contains the data of previous occurred security incidents.
• Risk management metrics is more comprehensive than The organisation’s security incident trends. Risk management metrics contains information like total number of risks that are identified and the number of risks which occurred. It also contains the frequency of risks, cost incurred for the risk and the status of the risk.
• So, Risk management metrics is more comprehensive than The organisation’s security incident trends.