Key Performance Indicators (KPI) ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A CISO reviews quarterly KPI reports and notices that the 'percentage of systems with endpoint protection updated' KPI has remained at 98% for three quarters, while the number of endpoint-related incidents has increased. What should the CISO do?

   • ALower the target to 95% to make the KPI easier to achieve
   • BKeep the KPI unchanged because it meets the target
   • CStop reporting the KPI because it is not improving
   • DInvestigate whether the KPI is still relevant and aligned with security outcomes
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing company's CISO is asked to justify the security budget to the CFO. The CFO wants to see how security investments contribute to the company's strategic goal of reducing production downtime. Which KPI would best demonstrate this contribution?

   • ANumber of security incidents that caused production downtime per quarter
   • BPercentage of security team members with certifications
   • CNumber of security policies approved by the board
   • DTotal number of security alerts generated per month
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A CISO is developing a KPI for the incident response team. The team can measure 'time to contain' incidents, but the data is manually entered and often incomplete. The CISO wants to set a target of containing 90% of incidents within 2 hours. What is the most critical prerequisite before setting this target?

   • AIncrease the number of incident response team members
   • BEnsure the data collection process is reliable and complete
   • CGet approval from the board for the target
   • DPurchase new incident response tools
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A CISO is developing a KPI for the security operations center (SOC) to measure its effectiveness. The SOC manager wants a KPI that can be measured with current tools, but the CISO wants the KPI to reflect the SOC's contribution to reducing business risk. The SOC currently tracks alert volume, time to triage, and number of incidents escalated. Which KPI development approach best reconciles these needs?

   • ACreate a KPI that measures the SOC's contribution to revenue, such as 'percentage of revenue protected'
   • BUse 'number of alerts triaged per day' as the KPI because it is easily measured
   • CAdopt 'total number of security incidents per month' as the KPI because it is a standard industry metric
   • DDefine the KPI as 'percentage of high-severity incidents contained within one hour' and set a target based on historical data
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What does it mean for a KPI to be aligned with an organization's strategic goals?

   • AThe KPI is approved by the board of directors
   • BThe KPI is used by all departments in the organization
   • CThe KPI is directly linked to the achievement of a specific strategic objective
   • DThe KPI is easy to calculate and understand
   Reveal Solution Discussion Select an answer first