Define Security Metrics (e.g., Criticality Level, Average Remediation Time, Complexity, Key Performance Indicators (KPI), Objectives and Key Results) CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team wants to set a goal to improve the security of the software development lifecycle. They decide to use OKRs. Which of the following is a well-formed key result for the objective 'Improve the security of the software development lifecycle'?

   • AIncrease the percentage of code reviewed by security tools from 60% to 90% by the end of the year
   • BImplement security tools in the CI/CD pipeline
   • CReduce the number of security vulnerabilities
   • DEnsure all developers are trained on secure coding
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of using Objectives and Key Results (OKRs) in a secure software lifecycle?

   • ATo replace all other security metrics with a single score
   • BTo document every security decision made during development
   • CTo set clear security goals and track progress toward them with measurable results
   • DTo automate the deployment of security patches
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which scenario best demonstrates the use of complexity as a security metric?

   • AA vulnerability that affects more than 10,000 users is rated as more complex
   • BA vulnerability that has been open for 30 days is rated as more complex
   • CA vulnerability that requires an attacker to have physical access to the server is rated as higher complexity than one exploitable remotely
   • DA vulnerability that is in a module with 500 lines of code is rated as more complex
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is evaluating two vulnerabilities. Vulnerability A can be exploited with a simple script that is publicly available, while Vulnerability B requires a custom exploit that has not been published. Which vulnerability has higher complexity?

   • AVulnerability A
   • BBoth have the same complexity
   • CComplexity cannot be determined from this information
   • DVulnerability B
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does the criticality level of a vulnerability indicate?

   • AThe date when the vulnerability was first discovered
   • BThe exact number of lines of code affected by the vulnerability
   • CThe name of the team responsible for fixing the vulnerability
   • DThe severity or importance of the vulnerability in terms of potential impact
   Reveal Solution Discussion Select an answer first