1.8 Describe Characteristics and Areas of Improvement Using Common Incident Response Metrics 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   An organization tracks its MTTD over the past two years and notices a steady decrease. What does this trend indicate?

   • AResponse is getting slower
   • BContainment is becoming less effective
   • CDetection is improving over time
   • DThe number of incidents is increasing
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company's incident response metrics show: MTTD = 8 hours, MTTR (response) = 1 hour, MTTC = 3 hours, and MTTR (resolution) = 20 hours. The team has a limited budget and must choose one improvement. Which improvement would have the most impact on reducing the overall incident duration?

   • AImprove recovery procedures and post-incident analysis to reduce MTTR (resolution).
   • BInvest in advanced monitoring to reduce MTTD.
   • CAutomate alert routing to reduce MTTR (response).
   • DDeploy automated isolation playbooks to reduce MTTC.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard · select all that apply

   A SOC is evaluating the effectiveness of its incident response program. The team has collected the following metrics over the past year: false positive rate decreased from 35% to 15%, containment success rate increased from 75% to 95%, and repeat incident rate decreased from 20% to 8%. Which conclusions are supported by these metrics? Select all that apply.

   • AThe likelihood of recurring incidents has decreased.
   • BContainment effectiveness has improved.
   • CResolution time has improved.
   • DDetection speed has improved.
   • EDetection accuracy has improved.
   Check answers Discussion Select an answer first
5. 39application · medium

   After a server outage caused by a security incident, the IT team restored the affected servers from backups and verified that services were operational. The team recorded the time from when the restoration began to when services were fully available. Which metric does this represent, and what improvement would most directly reduce it?

   • AMTTD; improve monitoring to detect the outage sooner.
   • BMTTR (recovery); implement faster backup restoration procedures and test recovery runbooks.
   • CMTTC; isolate the affected systems more quickly.
   • DTTE; focus on removing the root cause of the incident.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   After a server outage caused by a security incident, the IT team restored services from backups at 6:00 PM, but the threat was not fully removed from the environment until 8:00 PM. The incident was detected at 2:00 PM. Which metric best reflects the time to restore normal operations after eradication?

   • ATime to eradicate (TTE)
   • BMean time to recover (MTTR)
   • CMean time to resolve (MTTR)
   • DTime to recover (TTR)
   Reveal Solution Discussion Select an answer first