2.19 Apply Dashboard Data to Communicate with Technical, Leadership, or Executive Stakeholders 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A security analyst needs to present dashboard data to a group of executives. What is the most appropriate way to tailor the presentation for this audience?

   • AUse technical jargon to demonstrate the depth of the security team's expertise.
   • BPresent every metric from the dashboard without filtering to avoid bias.
   • CShow detailed packet captures and raw log entries to provide full transparency.
   • DFocus on high-level metrics such as risk levels, trends, and business impact.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security manager must present the same quarterly security dashboard to two audiences: the board of directors and the IT security engineers. The dashboard shows a 25% increase in ransomware attempts, a 10% decrease in successful phishing simulations, and a 50% increase in the time to remediate (TTR) critical vulnerabilities. The board is focused on risk to the business, while the engineers need to know where to focus their efforts. Which approach best satisfies both audiences?

   • APresent the same slides to both groups, but add a technical appendix for the engineers.
   • BFor the board, focus on the ransomware increase as a top risk and the TTR increase as a control gap; for the engineers, provide a breakdown of the vulnerabilities with the highest TTR and recommend prioritizing remediation.
   • CFor the board, present a detailed technical report on the ransomware attempts; for the engineers, present a high-level summary of the TTR.
   • DFor the board, present only the decrease in phishing simulations as a success; for the engineers, present only the ransomware attempts.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is preparing a monthly summary for the Chief Operating Officer (COO). The dashboard shows a 10% increase in the number of security incidents, a 5% decrease in the average cost per incident, and a 20% increase in the number of security awareness training sessions completed. The COO is interested in operational efficiency. Which summary is most appropriate?

   • APresent the raw numbers for all three metrics and let the COO draw conclusions.
   • BHighlight the decrease in average cost per incident as a sign of improved incident response efficiency, and note the increase in training as a contributing factor.
   • CRecommend canceling the security awareness training program because incidents increased despite more training.
   • DState that the increase in incidents is a concern and recommend hiring more security staff.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst notices that the dashboard shows a sudden spike in alerts from a single host, but the host's vulnerability score is low. The analyst investigates and finds that a scheduled backup job is triggering the alerts. What is the most appropriate way to communicate this finding to the incident response team?

   • APresent the spike to the incident response team without context and let them decide.
   • BExplain that the spike is due to the scheduled backup job, and recommend tuning the detection rule to reduce false positives.
   • CIgnore the spike because the host's vulnerability score is low.
   • DReport the spike as a potential compromise and recommend immediate isolation of the host.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security manager must present a business case to the executive team for investing in a new security information and event management (SIEM) platform. The dashboard shows that the current SIEM has a 40% false positive rate, a mean time to detect (MTTD) of 48 hours, and a 60% alert fatigue rate among analysts. The executive team is concerned about the cost of the new platform. Which presentation best supports the business case?

   • AFocus on the false positive rate and alert fatigue as operational inefficiencies, and show how a new SIEM could reduce these, leading to faster detection and lower analyst burnout.
   • BPresent the MTTD of 48 hours as a compliance issue and recommend the new SIEM to avoid regulatory fines.
   • CRecommend the new SIEM because it is the latest technology, without referencing the dashboard data.
   • DShow the raw metrics and let the executive team draw their own conclusions.
   Reveal Solution Discussion Select an answer first