Exam CAS-003 topic 1 question 280 discussion

C would complement what they already have which is the `Number of successful phishing attacks`. Also, including the "The number of unsuccessful phishing attacks" can easily allow them to get the * The ratio of phishing emails to non-phishing emails, * The number of phishing attacks per employee * The percent of successful phishing attacks

If this were an exam question i would have chosen A. Firstly all CISOs are ratios and percentages driven. second, ratio of phishing to non phishing would show an increasing threat profile. This would be a good KRI. Then, from the phishing ratio, we can get the number of successful phishing attacks. Not sure if this is right or wrong but i'd chose that

I agree the answer is C. If you're looking at N successful attacks, that doesn't give you the total number of attacks. The information needs to be supplemented with the number of net attacks, just not the attacks the are successful. Including the number of successful attacks and then percentage of successful attacks would also be confusing to report-readers, because they would see a decreasing percentage as the total volume of attacks went up and may not understand the correlation.

I agree that D is correct, but so is C. If the # of successful phishing attacks is already being presented, and we add the number of unsuccessful attacks, we have the same information as the percentage.....