Create Security Reporting Mechanisms (e.g., Reports, Dashboards, Feedback Loops) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of defining security metrics and KPIs for a reporting dashboard?

   • ATo replace the need for security audits.
   • BTo provide a way to measure and track the security program's performance over time.
   • CTo increase the complexity of the dashboard for technical audiences.
   • DTo satisfy regulatory requirements only.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which scenario is best suited for an event-driven security report rather than a scheduled report?

   • AAn immediate notification when a critical vulnerability is discovered in production.
   • BA weekly status update for the development team.
   • CA quarterly compliance report for auditors.
   • DA monthly summary of security metrics for management.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team is discussing the difference between a security report, a dashboard, and a feedback loop. They want to implement all three. Which statement correctly describes how these mechanisms differ?

   • AA report is a static document, a dashboard is an interactive visual display, and a feedback loop is a process that uses the information to drive improvements.
   • BA report is interactive, a dashboard is static, and a feedback loop is a type of report.
   • CA report and a dashboard are the same thing, and a feedback loop is a tool used to create them.
   • DA report is for executives, a dashboard is for developers, and a feedback loop is for auditors.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A development team is adopting a DevSecOps approach. They want to ensure that security reporting is integrated into each phase of their CI/CD pipeline. Which practice best aligns security reporting with the lifecycle phases?

   • ACreate a single dashboard that shows the final security status of the last release, updated monthly.
   • BHave security analysts manually review code and send emails to developers when they find issues.
   • CRun a security report only at the end of the release cycle, summarizing all vulnerabilities found during development.
   • DGenerate automated security reports at each pipeline stage, with alerts for critical issues, and feed the results back into the development process.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In secure software lifecycle management, which statement correctly distinguishes a security dashboard from a security report?

   • AA dashboard is a static document distributed periodically, while a report is a real-time interactive view.
   • BA dashboard provides an at-a-glance, often real-time visual summary of key metrics, while a report provides a more detailed, structured narrative or data set for a specific audience.
   • CA dashboard is used exclusively by executives, while a report is used exclusively by developers.
   • DA dashboard is a type of feedback loop, while a report is a type of metric.
   Reveal Solution Discussion Select an answer first