A company's incident response metrics show that MTTD is 12 hours, MTTR (response) is 1 hour, and MTTC is 6 hours. The team wants to identify the weakest area in their response process. Which area should they focus on, and what improvement would be most effective?

Containment; deploy automated isolation playbooks to reduce MTTC.

Response; automate alert routing to reduce MTTR (response).

Recovery; improve backup restoration procedures to reduce recovery time.

Detection; invest in advanced monitoring and correlation rules to reduce MTTD.

During a breach investigation, the response team spends 3 hours analyzing logs and conducting root cause analysis before they can determine how the attacker gained access. Which metric does this 3-hour effort represent, and what improvement would most directly reduce it?

MTTD; improve detection capabilities to identify the breach sooner.

TTI; use threat intelligence feeds and centralized log correlation to speed up analysis.

MTTC; isolate affected systems more quickly.

TTE; focus on removing the attacker from the environment.

A security operations center (SOC) reviews its incident metrics and finds that the average time from when an intrusion begins to when the SIEM generates an alert is 14 hours. The team also notes that after the alert is generated, it typically takes an additional 2 hours for an analyst to acknowledge the ticket. Which metric is most directly responsible for the 14-hour figure, and what improvement would most directly reduce it?

MTTR (response); streamline the alert acknowledgment process.

MTTD; improve detection capabilities such as log ingestion and correlation rules.

TTA; reduce the time analysts take to acknowledge the alert.

MTTC; deploy automated containment actions to stop the intrusion sooner.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 8

1.8 Describe Characteristics and Areas of Improvement Using Common Incident Response Metrics 350-201 Practice Questions (Page 7)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

15concepts

20%of the exam

Questions 31–35

31foundation · easy
Which metric assesses the quality of incident detection by measuring the proportion of alerts that are not real incidents?
Select an answer first
32application · medium
A company's incident response metrics show that MTTD is 12 hours, MTTR (response) is 1 hour, and MTTC is 6 hours. The team wants to identify the weakest area in their response process. Which area should they focus on, and what improvement would be most effective?
Select an answer first
33application · medium
During a breach investigation, the response team spends 3 hours analyzing logs and conducting root cause analysis before they can determine how the attacker gained access. Which metric does this 3-hour effort represent, and what improvement would most directly reduce it?
Select an answer first
34foundation · easy
Which metric measures the time to completely remove the threat from the environment?
Select an answer first
35application · medium
A security operations center (SOC) reviews its incident metrics and finds that the average time from when an intrusion begins to when the SIEM generates an alert is 14 hours. The team also notes that after the alert is generated, it typically takes an additional 2 hours for an analyst to acknowledge the ticket. Which metric is most directly responsible for the 14-hour figure, and what improvement would most directly reduce it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

1.8 Describe Characteristics and Areas of Improvement Using Common Incident Response Metrics 350-201 Practice Questions (Page 7)

Questions 31–35

Which metric assesses the quality of incident detection by measuring the proportion of alerts that are not real incidents?

A company's incident response metrics show that MTTD is 12 hours, MTTR (response) is 1 hour, and MTTC is 6 hours. The team wants to identify the weakest area in their response process. Which area should they focus on, and what improvement would be most effective?

During a breach investigation, the response team spends 3 hours analyzing logs and conducting root cause analysis before they can determine how the attacker gained access. Which metric does this 3-hour effort represent, and what improvement would most directly reduce it?

Which metric measures the time to completely remove the threat from the environment?

Keep studying — Fundamentals