Key Performance Indicators (KPI) ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization's security KPI for 'percentage of endpoints with antivirus updates within 24 hours' has been consistently at 99% for two years. The CISO notices that the metric no longer drives improvement and that the organization has moved to a cloud-first strategy. What should the CISO do to keep the KPI relevant?

   • AKeep the KPI unchanged because it is consistently met and shows success
   • BIncrease the target to 99.9% to make it more challenging
   • CDiscontinue all KPI tracking because the current KPI is no longer useful
   • DReplace the KPI with one that measures the security posture of cloud workloads, such as percentage of cloud resources with compliance scanning enabled
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A CISO wants to measure the effectiveness of a new security awareness program. The program's goal is to reduce the likelihood of successful phishing attacks. Which KPI would be the most valid measure of this goal?

   • ANumber of training sessions held
   • BEmployee satisfaction score for the training
   • CPercentage of employees who completed the training
   • DClick rate on simulated phishing emails
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which category of KPIs would an organization use to measure the efficiency of its internal processes?

   • AStrategic KPIs
   • BOperational KPIs
   • CCustomer satisfaction KPIs
   • DFinancial KPIs
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A CISO needs to present quarterly KPI results to the executive board. The board is primarily interested in whether the security program is reducing risk and supporting business objectives. The CISO has data on vulnerability remediation rates, security incidents, and budget utilization. Which reporting approach would best support the board's decision-making?

   • APresent a dashboard showing KPI trends with commentary linking results to strategic risk reduction and business objectives
   • BProvide a detailed technical report with raw data tables for each KPI
   • CFocus exclusively on financial KPIs such as budget utilization
   • DHighlight only the KPIs that met their targets and omit those that did not
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A CISO is developing KPIs for a new security strategy focused on enabling digital transformation. The strategy includes moving to the cloud, adopting DevOps, and increasing remote work. The CISO must select KPIs that align with this strategy. Which KPI would best support the digital transformation strategy?

   • APercentage of security team members with cloud certifications
   • BNumber of security policies updated per quarter
   • CPercentage of cloud workloads with automated security monitoring enabled
   • DNumber of security incidents per month
   Reveal Solution Discussion Select an answer first