PK0-005 Exam Dumps : CompTIA Project+ Certification (2025)

Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and protect information assets. Control objectives should be the primary basis for establishing metrics that measure the effectiveness of an information security program, as they align with the business objectives, requirements, and expectations of the organization and its stakeholders. Metrics based on control objectives can help to evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and areas for improvement. The other options are not correct because:

Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk should be monitored and reported, but it does not define the desired outcomes or goals of the security program.

Regulatory requirements are the external standards, laws, and regulations that the organization must comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for establishing metrics, but rather a constraint or a driver for the security program. Metrics based on regulatory requirements can help to demonstrate compliance, but they may not reflect the actual effectiveness or efficiency of the security program.

Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on risk tolerance can help to prioritize and allocate resources, but they may not measure the actual outcomes or goals of the security program. References = Key Performance Indicators for Security Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information Security: The 10 Most Important Security Metrics; Why metrics are crucial to proving cybersecurity programs’ value; Implementing and Maintaining Security Program Metrics

When a project manager receives an escalation about a deliverable that was actually provided on time, it indicates a communication issue. The next step should be to revise the communication plan to ensure that all stakeholders are properly informed about project progress and deliverables in the future. This helps to prevent misunderstandings and ensures that everyone has the correct information.

References = CompTIA Project+ Certification Study Guide (PK0-005)

The project manager should ask the developer to create a change request, which is a formal document that describes the proposed change, its benefits, costs, risks, and impacts on the project scope, schedule, budget, and quality. A change request is the first step in the change control process, which involves evaluating, approving, or rejecting changes to the project baselines. The project manager should not do nothing, because ignoring the recommendation could result in poor performance and customer dissatisfaction. The project manager should not ask the developer to implement the recommendation without following the change control process, because that could cause scope creep, which is the uncontrolled expansion of the project scope without proper authorization or adjustment of the project resources and objectives. The project manager should not communicate the change status before the change request is submitted and approved, because that could create confusion and false expectations among the project stakeholders. References = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition, Chapter 4: Project Integration Management1; CompTIA Project+ Certification Study Guide, 3rd Edition, Chapter 4: Project Integration Management2; What is a Change Request and How to Manage It3