What should an organization do when a KPI is no longer relevant to its strategic goals?

Modify or replace the KPI to align with current objectives

Increase the target value to make it more challenging

Remove it from all reports without any communication

Continue tracking it to maintain historical consistency

A CISO is building a KPI dashboard for the executive team. The executives want to see both the efficiency of the security operations and the overall risk posture. The CISO has data on mean time to respond (MTTR), number of open high-risk findings, and percentage of systems patched. Which combination of KPIs would best serve the executives' dual focus?

Percentage of systems patched and number of open high-risk findings

Number of open high-risk findings and MTTR

MTTR and percentage of systems patched

MTTR, percentage of systems patched, and number of open high-risk findings

Which of the following is a common method for collecting data to measure a KPI?

Unstructured interviews with customers

Random guesses based on past experience

Personal opinions of team members

Automated system logs and analytics tools

Which statement best describes the role of KPIs in measuring strategic and operational performance?

KPIs translate objectives into measurable indicators that can be tracked over time to assess progress

KPIs provide a snapshot of performance at a single point in time and are not meant for trend analysis

KPIs are used only for financial reporting to external stakeholders

KPIs are subjective assessments used to gauge employee morale

A CISO is asked to select KPIs for the upcoming fiscal year. The organization's strategic goal is to 'reduce the impact of cyber incidents on business operations'. Which KPI best aligns with this goal?

Number of security tools deployed

Average downtime per security incident

Number of security staff certifications

EC-CouncilAssociate C|CISO

Domain 5Objective 3

Key Performance Indicators (KPI) ACCISO Practice Questions (Page 5)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 21–25

21foundation · easy
What should an organization do when a KPI is no longer relevant to its strategic goals?
Select an answer first
22expert · hard
A CISO is building a KPI dashboard for the executive team. The executives want to see both the efficiency of the security operations and the overall risk posture. The CISO has data on mean time to respond (MTTR), number of open high-risk findings, and percentage of systems patched. Which combination of KPIs would best serve the executives' dual focus?
Select an answer first
23foundation · easy
Which of the following is a common method for collecting data to measure a KPI?
Select an answer first
24foundation · easy
Which statement best describes the role of KPIs in measuring strategic and operational performance?
Select an answer first
25application · medium
A CISO is asked to select KPIs for the upcoming fiscal year. The organization's strategic goal is to 'reduce the impact of cyber incidents on business operations'. Which KPI best aligns with this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.