Key Performance Indicators (KPI) CCISO Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which characteristic is essential for a KPI to be considered measurable?

   • AIt is approved by senior management
   • BIt is derived from a single data source
   • CIt can be expressed as a number or a rate
   • DIt is based on qualitative expert opinions
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A CISO must present the quarterly KPI report to two different audiences: the board of directors and the IT operations team. The board wants a high-level overview of risk, while the IT team wants detailed operational metrics. What is the best communication strategy?

   • APresent the same detailed report to both audiences to ensure consistency
   • BCreate two separate reports: a high-level risk dashboard for the board and a detailed operational report for the IT team
   • CPresent only the high-level risk dashboard to both audiences
   • DSend the detailed report only to the board and the high-level dashboard only to the IT team
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A CISO is designing a KPI dashboard for the board. The board wants to see the financial impact of security incidents, the operational efficiency of the SOC, and the strategic progress of the security program. Which set of KPIs best meets this requirement?

   • ANumber of incidents, number of alerts, and number of security tools
   • BMean time to respond (MTTR), number of patches applied, and number of security staff
   • CTotal security budget, number of training sessions, and number of vulnerabilities
   • DCost per incident, mean time to detect (MTTD), and percentage of critical assets covered by risk assessments
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A hospital's CISO is selecting KPIs for the security program. The hospital's strategic goals include protecting patient data, ensuring system availability, and optimizing security spending. Which KPI set would best align with these goals?

   • AMean time to detect (MTTD), mean time to respond (MTTR), and number of incidents
   • BPercentage of employees trained, number of security tools deployed, and cost of tools
   • CPercentage of systems with encryption enabled, uptime of critical systems, and cost per incident
   • DNumber of security audits passed, number of firewall rules, and total security budget
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is the most important criterion when selecting a KPI for a cybersecurity program?

   • AThe KPI is easy to calculate from existing data
   • BThe KPI is commonly used by other organizations in the industry
   • CThe KPI is aligned with the organization's strategic objectives
   • DThe KPI is based on a complex algorithm
   Reveal Solution Discussion Select an answer first