6.3 - Collect Security Process Data (e.g., Technical and Administrative) CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is monitoring key risk indicators (KRIs) and notices that the number of failed backup jobs has increased by 50% over the past week. What is the MOST appropriate immediate action?

   • AInvestigate the cause of the failed backups and assess the potential impact on data recoverability
   • BReport the increase to senior management and take no further action
   • CDisable the backup jobs to prevent further failures
   • DWait to see if the trend continues for another week
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After a disaster recovery (DR) test, the recovery team reports that the critical application was restored in 6 hours, but the business had set a recovery time objective (RTO) of 4 hours. The data loss was within the recovery point objective (RPO). What should the security team do with this data?

   • AReport the test as successful because the application was recovered
   • BChange the RTO to 6 hours to match the test result
   • CIgnore the RTO miss because the RPO was met
   • DRecord the test results and note that the RTO was not met, then investigate the cause of the delay
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a security KRI?

   • ANumber of unpatched critical vulnerabilities in the environment
   • BUptime percentage of critical systems
   • CNumber of employees who passed security training
   • DPercentage of security incidents resolved within target time
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team wants to measure the effectiveness of its access control process. Which metric would be the BEST key performance indicator (KPI) for this purpose?

   • APercentage of access requests processed within the agreed service level agreement (SLA)
   • BNumber of access control policy exceptions granted in the last quarter
   • CNumber of security incidents involving unauthorized access
   • DNumber of users with administrative privileges
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of an access privilege change that should be collected as part of Account Management Data Collection?

   • AA server's operating system being patched
   • BA network switch being replaced
   • CAn application being updated to a new version
   • DA user's account being granted administrative rights
   Reveal Solution Discussion Select an answer first