When stakeholders express concerns about the volume of communication, it's important to review and adjust
the communication plan to ensure it meets the project's needs and stakeholders' preferences. A RACI matrix is
useful for defining roles and responsibilities but does not address communication frequency or methods
directly. Escalating the issue may not be necessary if it can be resolved by revising the plan. Informing the
CCB (Change Control Board) to stop communication is not advisable as the CCB's role is to oversee changes,
not to manage day-to-day communications. References = The CompTIA Project+ Certification Study Guide
provides detailed information on managing the project life cycle, establishing communication plans, and
handling stakeholder concerns1.

A focus group is a technique that involves gathering a group of people who share some characteristics or interests related to a product, service, or issue, and asking them for their opinions, perceptions, or feedback. The project manager acts as a moderator or facilitator who guides the discussion and records the results. A focus group can help to collect information from a representative sample of the target population, explore ideas, identify needs and preferences, and support the completion of larger projects. The other options are not correct because:
A demonstration is a technique that involves showing the features or capabilities of a product, service, or process to the stakeholders or customers, usually in a live or simulated environment. A demonstration can help to validate the requirements, obtain feedback, and verify the functionality of a deliverable.
A workshop is a technique that involves bringing together a group of stakeholders or experts to work on a specific topic, problem, or issue, usually in a structured and facilitated way. A workshop can help to define the scope, plan the activities, identify the risks, resolve the conflicts, and generate the solutions of a project.
Brainstorming is a technique that involves generating a large number of ideas or alternatives for a problem or opportunity, usually in a creative and spontaneous way. Brainstorming can help to enhance the creativity, diversity, and quality of the ideas, and encourage the participation and collaboration of the team members. Reference = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition, Chapter 6: Planning Projects, Part 2 (Scope, Quality, and Risk), page 191; CompTIA Project+ Certification Exam Objectives, Domain 2: Project Planning, Objective 2.1: Given a scenario, create a project charter and project management plan.

Issue log and change log are documents that should be used to record the event where the project team has just
experienced an unexpected event and implemented a work-around. An issue log is a document that tracks and
records any issues or problems that arise during a project and how they are resolved. An issue log can help to
monitor and control the project performance and quality and prevent any negative impacts on the project
objectives and deliverables. A change log is a document that tracks and records any changes or modifications
that are made to the project scope, schedule, cost, quality, or resources during a project. A change log can help
to document the change request, approval, implementation, and impact of each change and ensure traceability
and transparency.

The waterfall methodology is a project management framework that follows a linear and sequential process, where each stage of the project must be completed before moving on to the next one. The stages of the waterfall model are initiation, planning, execution, and closure, as described in the question12.

Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and
protect information assets. Control objectives should be the primary basis for establishing metrics that measure
the effectiveness of an information security program, as they align with the business objectives, requirements,
and expectations of the organization and its stakeholders. Metrics based on control objectives can help to
evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and
areas for improvement. The other options are not correct because:
Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for
establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk
should be monitored and reported, but it does not define the desired outcomes or goals of the security
program.
Regulatory requirements are the external standards, laws, and regulations that the organization must
comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for
establishing metrics, but rather a constraint or a driver for the security program. Metrics based on
regulatory requirements can help to demonstrate compliance, but they may not reflect the actual
effectiveness or efficiency of the security program.
Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a
basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on
risk tolerance can help to prioritize and allocate resources, but they may not measure the actual
outcomes or goals of the security program. References = Key Performance Indicators for Security
Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information
Security: The 10 Most Important Security Metrics; Why metrics are crucial to proving cybersecurity
programs' value; Implementing and Maintaining Security Program Metrics