Create Security Reporting Mechanisms (e.g., Reports, Dashboards, Feedback Loops) CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is designing a dashboard for engineering managers to track the effectiveness of their secure coding training program. The dashboard should help managers quickly identify whether training is reducing the number of security defects in code. Which set of metrics and visualizations would be most effective?

   • AA line chart showing the number of security defects found in code reviews over time, alongside a bar chart comparing defect rates before and after training completion.
   • BA gauge chart showing the current number of open security defects, with a red/yellow/green threshold.
   • CA table listing all security defects with severity levels, sorted by the developer who introduced them.
   • DA pie chart displaying the percentage of developers who completed the training, updated in real time.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's security team is setting up reporting for its software development lifecycle. They want to provide timely information to different stakeholders without overwhelming them. Which combination of reporting frequency and triggers is most appropriate?

   • AWeekly dashboard updates for executives, real-time alerts to developers for critical vulnerabilities, and monthly compliance reports for auditors.
   • BDaily automated reports to executives, real-time alerts to developers for every code commit, and a weekly summary to auditors.
   • CMonthly reports to all stakeholders, with no real-time alerts, to avoid interrupting anyone.
   • DReal-time dashboards for everyone, updated continuously, with no scheduled reports.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team has implemented a dashboard that tracks the number of open vulnerabilities and the time to remediate them. The dashboard shows that the number of open vulnerabilities is decreasing, but the average time to remediate is increasing. The team wants to use this data to improve the process. What is the most effective way to use this feedback?

   • ASet a target for the number of open vulnerabilities and stop tracking remediation time once the target is met.
   • BChange the dashboard to hide the remediation time metric to avoid confusion.
   • CCelebrate the decrease in open vulnerabilities and ignore the increasing remediation time.
   • DInvestigate the root cause of the increasing remediation time, such as lack of resources or complex vulnerabilities, and adjust the remediation process accordingly.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a benefit of automating the distribution of security reports?

   • AIt ensures reports are delivered consistently and on time to the right stakeholders.
   • BIt removes the need for security metrics.
   • CIt eliminates the need for human review of security data.
   • DIt guarantees that all reports are free of errors.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a common trigger for generating an event-driven security report?

   • AThe end of the fiscal quarter.
   • BA new employee joining the security team.
   • CA successful intrusion detection system alert.
   • DThe completion of a routine code review.
   Reveal Solution Discussion Select an answer first