Key Performance Indicators (KPI) CCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A retail company's CISO is tracking the mean time to respond (MTTR) to security incidents. The data is collected from the ticketing system and reported monthly. The CISO notices that the MTTR has been decreasing, but the number of incidents that recur has increased. What is the most likely explanation?

   • AThe KPI is not aligned with the board's strategic objectives
   • BThe ticketing system is not accurately recording response times
   • CThe security team has become more efficient at responding to incidents
   • DThe MTTR KPI is being optimized at the expense of thorough root-cause analysis, leading to recurring incidents
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of establishing a baseline when developing a KPI?

   • ATo ensure that the KPI is aligned with industry standards
   • BTo provide a starting point for measuring future performance
   • CTo replace the need for ongoing data collection
   • DTo set the final target that the organization aims to achieve
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A CISO is tracking the KPI 'time to patch critical vulnerabilities'. The data is collected from the vulnerability management tool. The CISO notices that the metric is consistently below target, but the tool only tracks patches applied to servers, not endpoints. What is the most appropriate action?

   • AContinue reporting the current metric because it is still useful
   • BChange the KPI to only measure server patching
   • CStop tracking the KPI because it is not accurate
   • DExpand the data collection to include endpoints to get a complete picture
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A manufacturing company's CISO must present the quarterly security KPI report to the board. The report includes a mix of financial, operational, and strategic KPIs. The board is particularly interested in the return on security investment (ROSI). The CISO has data on cost per incident, number of incidents, and total security spending. What is the most effective way to communicate the ROSI to the board?

   • APresent the cost per incident and the total number of incidents as separate metrics
   • BPresent the number of incidents avoided by the security program
   • CPresent a trend analysis showing how the cost of incidents has changed relative to security spending over time
   • DPresent the total security spending as a percentage of revenue
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A CISO is tracking the KPI 'mean time to respond (MTTR) to security incidents'. The SOC team manually logs response times in a ticketing system, but the logs are often incomplete. The CISO needs to improve the accuracy of this KPI. What is the best approach?

   • AUse an estimated average based on past incidents
   • BRemove the KPI from the dashboard because the data is unreliable
   • CAutomate the timestamp capture from the ticketing system and integrate it with the SOC tools
   • DAsk the SOC team to be more diligent in logging their response times
   Reveal Solution Discussion Select an answer first