2.19 Apply Dashboard Data to Communicate with Technical, Leadership, or Executive Stakeholders 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security operations center (SOC) manager must present a quarterly report to the executive team. The dashboard shows a 20% increase in phishing simulations clicked by employees, a 15% decrease in the time to detect (TTD) incidents, and a 30% increase in the number of security incidents. The executive team is considering a new security awareness training program but is concerned about the cost. Which presentation best supports the decision?

   • APresent the phishing click rate as a key risk indicator, and show that the decrease in TTD demonstrates the SOC's ability to respond, making the training program a strategic investment to reduce the click rate.
   • BShow the increase in incidents as a sign that the security team is overwhelmed and needs more staff immediately.
   • CRecommend against the training program because the decrease in TTD shows the SOC is already effective.
   • DPresent only the increase in incidents and the phishing click rate, omitting the TTD data to avoid confusion.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing the dashboard and sees that the number of alerts from the intrusion detection system (IDS) has doubled, but the number of confirmed incidents has remained the same. The analyst also notices that a new rule was added to the IDS. What is the most likely explanation?

   • AThe attackers have become more active, but the security team is successfully blocking them.
   • BThe increase in alerts is due to a misconfiguration in the log collector.
   • CThe IDS is failing and generating random alerts.
   • DThe new rule is generating false positives, increasing the alert volume without a corresponding increase in true incidents.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing the weekly dashboard and notices that the number of blocked web requests has increased by 300%, while the number of malware detections has decreased by 50%. The analyst also sees that a new web filtering category was enabled mid-week. What is the most accurate interpretation of this data?

   • AThe data is unreliable and should be ignored because the metrics are contradictory.
   • BThe increase in blocked requests is likely due to the new web filtering category, which may also be preventing malware from reaching users, explaining the decrease in detections.
   • CThe security posture has significantly improved because malware detections are down.
   • DThe decrease in malware detections indicates that the security tools are failing to detect threats.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is preparing a report for the system administrators about a recent malware outbreak. The dashboard shows the malware family, the affected hosts, and the propagation method. The administrators need to know how to clean the infected systems and prevent reinfection. Which presentation is most useful?

   • AA step-by-step guide that includes the specific indicators of compromise (IOCs), the propagation method, and recommended remediation actions for each affected host.
   • BA high-level summary stating that the outbreak was contained and no action is needed.
   • CA list of the malware family names and the number of affected hosts.
   • DA graph showing the number of infections over time, without any technical details.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is preparing a weekly status report for the Chief Executive Officer (CEO). The dashboard shows the number of security incidents, the average time to resolve, the number of open action items, and the risk score trend. Which summary best communicates the security posture to the CEO?

   • AReport that the security team is handling everything and no action is needed from the CEO.
   • BShow the risk score trend graph and state that the risk score is the only metric that matters.
   • CState that the number of incidents is within normal range and the risk score is stable, while noting that open action items are being tracked.
   • DList every incident with its resolution time and the responsible team.
   Reveal Solution Discussion Select an answer first