Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and protect information assets. Control objectives should be the primary basis for establishing metrics that measure the effectiveness of an information security program, as they align with the business objectives, requirements, and expectations of the organization and its stakeholders. Metrics based on control objectives can help to evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and areas for improvement. The other options are not correct because:

Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk should be monitored and reported, but it does not define the desired outcomes or goals of the security program.

Regulatory requirements are the external standards, laws, and regulations that the organization must comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for establishing metrics, but rather a constraint or a driver for the security program. Metrics based on regulatory requirements can help to demonstrate compliance, but they may not reflect the actual effectiveness or efficiency of the security program.

Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on risk tolerance can help to prioritize and allocate resources, but they may not measure the actual outcomes or goals of the security program. References = Key Performance Indicators for Security Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information Security: The 10 Most Important Security Metrics; Why metrics are crucial to proving cybersecurity programs’ value; Implementing and Maintaining Security Program Metrics

The project charter is a foundational document that formally authorizes a project and provides the project manager with the authority to apply organizational resources to project activities. Reviewing the project charter is essential at the outset to understand the project ' s objectives, scope, stakeholders, and any constraints or assumptions. This understanding is crucial, especially for large, complex projects with regulatory and environmental considerations, as it sets the direction for detailed planning and stakeholder engagement.

According to the CompTIA Project+ PK0-005 exam objectives, under Domain 2.1: Explain the value of artifacts in the discovery/concept preparation phase for a project, the project charter is a key artifact that guides the initiation and planning phases.

A wiki knowledge base is a collaborative online platform that allows users to create, edit, and share information about a specific topic or domain1. A wiki knowledge base is best to use for storing lessons learned because it enables easy access, retrieval, and update of the lessons learned by project teams and stakeholders2. A wiki knowledge base can also support keyword search, version control, and linking of related documents3. A wiki knowledge base is different from a whiteboard, which is a physical or digital board that can be used for brainstorming, sketching, or presenting ideas; a content management system, which is a software application that allows users to create, manage, and publish digital content; and a workflow platform, which is a software tool that automates and streamlines business processes4. References = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition, Chapter 14: Closing the Project, page 403; Capturing Lessons Learned in Project Management [2023] • Asana, Different types of lessons learned sessions and Lessons Learned Process in Project Management sections; Project Management Lessons Learned | Smartsheet, What Are Lessons Learned in Project Management? and Lessons Learned Process in Project Management sections; How to Do Lessons Learned in Project Management, Store and Retrieve sections.

This answer is based on the best practice of stakeholder management, which is to identify and document the communication preferences of each stakeholder or stakeholder group12. The project manager should update the stakeholder register with the information gathered from the stakeholder analysis, which includes the preferred communication channel for each stakeholder3. The preferred reported communication channel reflects the majority preference of the stakeholders, as well as the minority preference of the face-to-face communicators. The project manager should use this information to plan and execute effective communication throughout the project life cycle4. References = CompTIA Project+ Certification Study Guide5, CompTIA Project+ Certification Exam Objectives6, Stakeholder Register in Project Management1, What is a Stakeholder Register?2, How to Develop a Stakeholder Register3

Background screening is an operational security control: it helps organizations reduce the risk of insider threats, fraud, and inappropriate access by verifying identity, employment history, and other relevant checks before granting trust, credentials, and system access. This aligns with security governance practices that protect organizational assets (data, systems, finances, customers) by ensuring personnel are vetted according to policy and role sensitivity.

Option A (“increase access restrictions”) is related but incomplete—screening doesn’t restrict access by itself; it supports decisions about whether access should be granted at all, and at what level. Option B (define KPIs) is performance management, not security. Option C (evaluate PHI) is healthcare-data specific and not the purpose of background checks.

In project environments, especially those handling sensitive data (PII/financial/customer records) or regulated work, background screening supports compliance and reduces risk exposure. It’s part of broader operational security controls alongside least privilege, need-to-know, MFA, monitoring, and offboarding. Therefore, the best explanation is to apply operational security.

To account for potential risks, project managers use Expected Monetary Value (EMV) analysis. EMV is calculated by multiplying the probability of a risk event by its potential impact and adding this to the base estimate.

Base estimate: 9 days, $3,000

Risk impact: 5 additional days, $1,000 extra cost

Probability of risk: 20% (0.2)

Calculations:

Time: 9 days + (0.2 * 5 days) = 9 + 1 = 10 days

Cost: $3,000 + (0.2 * $1,000) = $3,000 + $200 = $3,200

However, to ensure sufficient contingency, it ' s prudent to budget for the full potential impact:

Time: 9 days + 5 days = 14 days

Cost: $3,000 + $1,000 = $4,000

But since the risk has only a 20% chance of occurring, the EMV approach provides a balanced estimate:

Time: 9 days + 1 day (20% of 5 days) = 10 days

Cost: $3,000 + $200 (20% of $1,000) = $3,200

Therefore, the most accurate budget considering the risk is 10 days and $3,200.

This aligns with the CompTIA Project+ PK0-005 exam objectives under Domain 1.4: Given a scenario, perform risk management activities, which includes understanding and applying EMV analysis.

Outsourcing the development of a system component due to a lack of internal resources is a risk response strategy known as ‘transfer.’ This approach shifts the risk to a third party who will now be responsible for managing that portion of the project. It is commonly used when an organization does not have the expertise or capacity to handle specific risks internally.

References = The answer is based on standard project management practices and the typical use of risk response strategies in the field. For detailed information, please refer to the CompTIA Project+ Study Guide and other official CompTIA resources.