Key Performance Indicators (KPI) ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A CISO is developing a KPI to measure the effectiveness of the incident response process. The team can capture the time from detection to containment. What is the most appropriate next step in the KPI development process?

   • ADefine a target threshold, such as containing 90% of incidents within 2 hours
   • BReplace the metric with the number of incidents detected
   • CAsk the security team to estimate the metric without data collection
   • DImmediately report the raw metric to the board
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   How do KPIs support decision-making in an organization?

   • ABy providing subjective opinions from senior managers
   • BBy offering quantitative evidence of performance that can guide strategic choices
   • CBy eliminating the need for regular performance reviews
   • DBy automating all decision-making processes
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A logistics company's strategic goal is to expand into new international markets. The CISO wants to ensure the security program supports this goal. Which KPI would best align with the expansion strategy?

   • AAverage age of security vulnerabilities in the IT environment
   • BPercentage of security controls that comply with international data protection regulations in target markets
   • CNumber of security incidents per month
   • DPercentage of security budget spent on training
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A CISO wants to track the 'percentage of security alerts investigated within 24 hours'. The SOC uses a ticketing system that automatically timestamps alert creation and closure. However, some alerts are closed manually without investigation. What is the most critical issue with this KPI?

   • AThe KPI is not aligned with the SOC's strategic goals
   • BThe KPI is too difficult to measure
   • CThe KPI may overstate performance because alerts closed without investigation are counted as investigated
   • DThe KPI is not relevant to the SOC's performance
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A healthcare organization is developing a KPI to track the effectiveness of its patch management process. The CISO wants a KPI that is meaningful, measurable, and aligned with the organization's risk appetite. The IT team currently tracks the number of patches deployed, the time from patch release to deployment, and the number of systems that fail patching. Which KPI best meets the CISO's criteria?

   • APercentage of critical patches deployed within the organization's defined SLA
   • BTotal number of patches deployed per month
   • CAverage time to deploy all patches regardless of severity
   • DNumber of systems that failed patching last month
   Reveal Solution Discussion Select an answer first