A security awareness program has a low completion rate for the annual training. The CISO wants to improve completion rates, but the training team is concerned that forcing completion will reduce the quality of learning. Which metric would BEST help balance these concerns?

Both completion rate and assessment scores

Number of training sessions offered

What type of data is collected to measure the effectiveness of security training and awareness programs?

Training completion rates and assessment scores

A company's backup administrator runs daily backups of a critical database. The security team wants to verify that these backups are actually recoverable. Which action provides the MOST direct evidence of recoverability?

Performing a test restore of the database to a separate environment and validating the data

Checking that the backup storage has sufficient free space

Comparing the backup file size to the previous day's backup size

Reviewing backup logs to confirm the job completed with a 'success' status

A security manager wants to implement an early warning system for potential insider threats. The system should flag when users accumulate excessive privileges or when dormant accounts become active. Which metric would BEST serve as a key risk indicator (KRI) for this purpose?

Number of security incidents reported in the last quarter

Average time to patch critical vulnerabilities

Percentage of users who completed security awareness training

Count of users with more than five privileged access grants and the number of dormant accounts reactivated in the last 30 days

A business continuity (BC) exercise revealed that the call center could not operate from the alternate site because the phone system was not configured. The BC team wants to prevent this issue in the future. Which data from the exercise should be captured and analyzed to drive this improvement?

The time it took to set up the alternate site

The number of calls the call center received during the exercise

The specific configuration steps that were missed and the personnel responsible for them

Certified Information Systems Security Professional

Domain 6Objective 3

6.3 - Collect Security Process Data (e.g., Technical and Administrative) CISSP Practice Questions (Page 1)

Part of the Security Assessment and Testing domain, which accounts for 12% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–3 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

8concepts

12%of the exam

8 Concepts in This Objective

Account Management Data Collection
Management Review and Approval Processes
Key Performance Indicators (KPIs) for Security
Key Risk Indicators (KRIs) for Security
Backup Verification Data
Security Training and Awareness Metrics
Disaster Recovery (DR) Test Data
Business Continuity (BC) Exercise Data

Questions 1–5

1expert · medium
A security awareness program has a low completion rate for the annual training. The CISO wants to improve completion rates, but the training team is concerned that forcing completion will reduce the quality of learning. Which metric would BEST help balance these concerns?
Select an answer first
2foundation · easy
What type of data is collected to measure the effectiveness of security training and awareness programs?
Select an answer first
3application · medium
A company's backup administrator runs daily backups of a critical database. The security team wants to verify that these backups are actually recoverable. Which action provides the MOST direct evidence of recoverability?
Select an answer first
4application · medium
A security manager wants to implement an early warning system for potential insider threats. The system should flag when users accumulate excessive privileges or when dormant accounts become active. Which metric would BEST serve as a key risk indicator (KRI) for this purpose?
Select an answer first
5expert · medium
A business continuity (BC) exercise revealed that the call center could not operate from the alternate site because the phone system was not configured. The BC team wants to prevent this issue in the future. Which data from the exercise should be captured and analyzed to drive this improvement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.