Key Performance Indicators (KPI) CCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the most effective way to communicate KPI results to a non-technical executive audience?

   • ADiscuss the KPI only in one-on-one meetings without written documentation
   • BSend an email with all the underlying data files
   • CProvide a detailed technical report with raw data tables
   • DUse visual dashboards with clear trends and comparisons to targets
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A CISO wants to track the effectiveness of the security awareness program by measuring the percentage of employees who fall for a simulated phishing campaign. The data is collected from the phishing simulation tool. What is the most important consideration when tracking this KPI over time?

   • AIncrease the frequency of simulations to gather more data points
   • BCompare the metric to industry benchmarks without adjusting for organizational context
   • CReport the metric to the board only when it shows improvement
   • DEnsure the simulation scenarios are consistent in difficulty across campaigns
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A technology company's CISO has been using the number of security incidents as a KPI for two years. The KPI has been declining, but the CISO is concerned that the KPI is not providing a complete picture of security performance. The company has also been investing heavily in new security tools. What is the most appropriate action to improve the KPI set?

   • AReduce the target for incident count to make the KPI more challenging
   • BAdd KPIs that measure the effectiveness of the new tools, such as coverage and false positive rates
   • CKeep the incident count KPI as the sole measure because it is trending in the right direction
   • DReplace the incident count KPI with a KPI measuring the number of security tools deployed
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which step is typically the FIRST in the KPI development process?

   • ASet a target value for the KPI
   • BCollect historical data for the KPI
   • CCommunicate the KPI to stakeholders
   • DDefine the strategic objective that the KPI will support
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A CISO is explaining to a new security analyst why the organization tracks 'percentage of critical assets with an up-to-date asset inventory' as a KPI. Which explanation best describes the role of this KPI?

   • AIt provides a measurable indicator of how well the organization knows its attack surface
   • BIt is a financial KPI that measures the cost of asset management
   • CIt tracks the number of assets purchased each quarter
   • DIt measures the operational activity of the asset management team
   Reveal Solution Discussion Select an answer first