Exam CRISC topic 1 question 610 discussion

The number of false positives (C) is indeed an important metric for evaluating the performance of an anti-virus program. A low number of false positives is generally desired, as it means legitimate activities are not being incorrectly flagged as malicious, which can be disruptive and require unnecessary follow-up. However, the **percentage of IT assets with current malware definitions** (D) is often considered a more direct measure of an anti-virus program's effectiveness because it indicates the readiness of the anti-virus software to detect and protect against the latest threats across all IT assets. If this KPI is high, it suggests that the anti-virus program is being maintained properly and is capable of providing the most up-to-date protection, which is critical for its overall effectiveness. While both are valid KPIs, the context of the question seems to prioritize ensuring comprehensive, up-to-date protection, which is why option D would be the best choice in this scenario.

Low number of false positives should indicate the effectiveness of an anti-virus.

C. Percentage of IT assets with current malware definitions. The best key performance indicator (KPI) to measure the effectiveness of an anti-virus program is "C. Percentage of IT assets with current malware definitions." This KPI reflects the extent to which the anti-virus program is up-to-date across the organization's IT assets. Keeping malware definitions current is essential for the anti-virus program to detect and mitigate new threats effectively. While the other options (frequency of anti-virus software updates, number of alerts generated by the anti-virus software, number of false positives detected) are relevant measures, the percentage of IT assets with current malware definitions directly assesses the readiness and coverage of the anti-virus program in preventing malware infections.

As its about program effectiveness, it is about program not about installing but about function. Of those variants propose alerts. But agree its not good option

Voting C

Agree it is C.

Sorry, agree 'C'. Explain: This KPI measures the percentage of IT assets that have the most up-to-date malware definitions installed, which is a critical component of an effective antivirus program. If the percentage of IT assets with current malware definitions is high, it indicates that the antivirus program is doing a good job of keeping the system protected from known threats. The number of false positives detected over a period of time is not a good KPI for measuring the effectiveness of an antivirus program because false positives do not necessarily indicate that the antivirus program is ineffective. False positives occur when the antivirus program mistakenly identifies a harmless file or activity as malicious, and while they can be frustrating for users, they are not indicative of a problem with the antivirus program's ability to detect real threats.

The percentage of assets with their definitions does not say anything about the effectiveness.

Voting C