What is the primary purpose of KPI analysis?

To replace the need for regular performance reviews

To create a static report that is filed away

To assign blame for poor performance

To identify trends, patterns, and areas for improvement

A CISO is selecting KPIs for a security program that must satisfy both internal management and external regulators. Regulators require evidence of compliance with specific controls, while management wants to see business impact. Which KPI set would best balance these needs?

Mean time to patch and number of security tools

Number of security alerts and number of incidents

Percentage of controls passed in audits and cost per incident

Percentage of employees trained and number of policies updated

A multinational corporation wants to track the percentage of employees who complete security awareness training each quarter. The training is delivered through different platforms in different regions, and some employees are remote. The CISO needs a reliable measurement method. Which approach best ensures data reliability for this KPI?

Estimate completion based on the number of employees who accessed the training portal

Send a survey to employees asking if they completed the training

Integrate all training platforms into a single learning management system that automatically records completion and exports standardized data

Use the training platform's built-in completion reports for each region and manually consolidate them in a spreadsheet

In the KPI development process, what is the purpose of setting targets and thresholds?

To ensure that the KPI is aligned with the organization's mission statement

To make the KPI more complex and challenging to interpret

To provide a benchmark against which actual performance can be compared

To replace the need for regular data collection

What is the first step in the KPI development process?

Defining the strategic or operational objectives

EC-CouncilAssociate C|CISO

Domain 5Objective 3

Key Performance Indicators (KPI) ACCISO Practice Questions (Page 7)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 31–35

31foundation · easy
What is the primary purpose of KPI analysis?
Select an answer first
32expert · hard
A CISO is selecting KPIs for a security program that must satisfy both internal management and external regulators. Regulators require evidence of compliance with specific controls, while management wants to see business impact. Which KPI set would best balance these needs?
Select an answer first
33application · medium
A multinational corporation wants to track the percentage of employees who complete security awareness training each quarter. The training is delivered through different platforms in different regions, and some employees are remote. The CISO needs a reliable measurement method. Which approach best ensures data reliability for this KPI?
Select an answer first
34foundation · easy
In the KPI development process, what is the purpose of setting targets and thresholds?
Select an answer first
35foundation · easy
What is the first step in the KPI development process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.