Key Performance Indicators (KPI) ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of strategic KPIs?

   • ATo evaluate the performance of a specific project team
   • BTo track progress toward the organization's long-term goals and objectives
   • CTo calculate the return on investment for a marketing campaign
   • DTo monitor the daily output of individual employees
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A CISO prepares a quarterly KPI report for the executive team. The report shows that the 'percentage of systems with endpoint protection' KPI is at 99%, but the 'number of endpoint compromises' has increased. What is the most appropriate action for the CISO?

   • AAnalyze the relationship between the KPI and the outcome
   • BRemove the KPI from the report to avoid confusion
   • CPresent the KPI as is, since it meets the target
   • DIncrease the target to 100% to force improvement
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A CISO is reviewing the quarterly KPI report and notices that the 'percentage of critical vulnerabilities remediated within 30 days' KPI has dropped from 95% to 80%. The CISO suspects the drop is due to a change in the vulnerability scanning tool that now detects more vulnerabilities. What should the CISO do first?

   • ARemove the KPI from the report because it is no longer reliable
   • BImmediately implement a new remediation process to improve the KPI
   • CChange the KPI target to 80% to reflect the new baseline
   • DInvestigate the data collection and measurement methodology to confirm the drop is real and not an artifact of the tool change
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A CISO needs to report to different stakeholders: the board, the IT operations manager, and the CFO. The board cares about strategic risk, the IT operations manager cares about operational efficiency, and the CFO cares about financial impact. Which KPI set would best address all three stakeholders?

   • ATotal security budget, number of staff, and number of projects
   • BNumber of security tools, number of alerts, and number of incidents
   • CNumber of high-risk findings, mean time to patch, and cost per incident
   • DPercentage of employees trained, number of policies, and number of audits
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A regional bank's CISO wants to measure the effectiveness of the new security awareness program. The board has asked for a metric that directly reflects a reduction in human-caused incidents. The CISO has access to phishing simulation results, help desk ticket categories, and quarterly training completion rates. Which KPI would be most aligned with the board's request?

   • APercentage of employees who completed the quarterly training
   • BAverage time to close help desk tickets related to security
   • CNumber of reported phishing emails per quarter
   • DRate of human-caused security incidents per 1,000 employees
   Reveal Solution Discussion Select an answer first