Question 26

Question

A risk practitioner is defining metrics for security threats that were not identified by antivirus
software. Which type of metric is being developed?

Accepted Answer

Key risk indicator (KRI)

SharpCandidate6957 · Answer

A, I get why folks pick B, but tracking what the antivirus missed seems like a direct control metric to me (KCI). Easy to mix those up in practice.

Jamie X. · Answer

B

Morgan Q. · Answer

Yeah, I think B is spot on here. A KRI measures the level of risk, so tracking threats missed by antivirus fits that. KCIs (A) would be more about whether the controls themselves are doing their job, not directly measuring undetected threats. Pretty sure this one's B but open if someone sees it differently.

Ben T. · Answer

Probably B. If the question had said "measuring mitigation performance" instead of risk from unidentified threats, would that make it more of a KCI (A)?

ISACA CRISC Real Exam Questions [October 2026 Update] Quiz

A risk practitioner is defining metrics for security threats that were not identified by antivirus software. Which type of metric is being developed?

Premium Access Includes