Comprehensive and Detailed Step-by-Step Explanation:
Metrics should provide meaningful insights into the organization's risk exposure and security performance.
Evaluating this option:
* A. The number of blocked external attacks is not representative of the true threat profile: This is the BEST answer because counting attacks blocked does not reveal the effectiveness of security controls or the real risk environment.
* B. The number of blocked external attacks will vary by month, causing inconsistent graphs: While variability is a concern, it does not make the metric invalid.
* C. The number of blocked external attacks is an indicator of the organization's popularity: This is true but irrelevant to assessing the effectiveness of security measures.
* D. The number of blocked external attacks over time does not explain the attackers' motivations:
Understanding motivations is useful but not directly tied to evaluating the firewall metric's effectiveness.
Reference: CISM Job Practice Area 2 (Risk Management) emphasizes the need for meaningful and risk-based metrics.