2.19 Apply Dashboard Data to Communicate with Technical, Leadership, or Executive Stakeholders 350-201 Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   A security analyst needs to brief both the Chief Information Security Officer (CISO) and the SOC team on the same security incident. The dashboard shows the attack vector, the affected systems, the indicators of compromise (IOCs), and the current containment status. Which approach best communicates to both audiences?

   • AProvide only the containment status to both audiences to avoid overwhelming them with details.
   • BPresent the same detailed technical briefing to both the CISO and the SOC team.
   • CGive the CISO the detailed IOCs and technical analysis, and give the SOC team the high-level summary.
   • DGive the CISO a high-level summary of the attack vector, affected systems, and containment status, and give the SOC team the detailed IOCs and technical analysis.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security manager must present a quarterly report to the executive team. The dashboard shows a 15% increase in the number of vulnerabilities, a 25% decrease in the mean time to remediate (MTTR) critical vulnerabilities, and a 10% increase in the number of security incidents. The executive team is considering whether to allocate additional budget to the vulnerability management program. Which presentation best supports the decision?

   • ARecommend against additional budget because the decrease in MTTR shows the program is already effective.
   • BPresent only the increase in vulnerabilities and incidents, omitting the MTTR data to avoid confusion.
   • CPresent the decrease in MTTR as evidence that the vulnerability management program is becoming more efficient, and recommend additional budget to further reduce the backlog of vulnerabilities.
   • DShow the increase in vulnerabilities as a sign that the program is failing and recommend replacing the current team.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security manager must present to the board of directors after a ransomware attack. The board is concerned about the financial impact and the potential for future attacks. The dashboard shows the ransom demand, the cost of downtime, the percentage of systems restored from backups, and the number of systems that remain encrypted. Which presentation best supports the board's decision on whether to pay the ransom?

   • AShow the percentage of systems restored from backups and the number of systems still encrypted, and explain the residual risk and financial impact of not paying.
   • BShow only the cost of downtime and state that the decision is a financial matter for the CFO.
   • CShow the ransom demand and the cost of downtime, and recommend paying the ransom to minimize financial loss.
   • DPresent the ransom demand and the number of encrypted systems, and recommend negotiating with the attackers.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security architect is preparing a report for the Chief Information Officer (CIO) and the security engineering team. The dashboard shows the number of vulnerabilities by severity, the percentage of systems patched, the mean time to patch, and the number of active exploits. The CIO needs to understand the overall risk, and the engineering team needs to prioritize patching efforts. Which presentation approach best serves both audiences?

   • AProvide only the number of active exploits to both audiences to keep the report focused.
   • BPresent the same dashboard to both audiences, highlighting all metrics equally.
   • CGive the CIO a high-level summary of the overall risk based on the vulnerability severity and active exploits, and give the engineering team the detailed vulnerability list and patch metrics.
   • DGive the CIO the detailed vulnerability list and patch metrics, and give the engineering team the high-level risk summary.
   Reveal Solution Discussion Select an answer first