Define Security Metrics (e.g., Criticality Level, Average Remediation Time, Complexity, Key Performance Indicators (KPI), Objectives and Key Results) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What does the average remediation time metric primarily measure?

   • AThe severity of the most critical vulnerability
   • BThe total number of security fixes deployed in a release
   • CThe average number of days taken to resolve security issues
   • DThe number of security issues open at any given time
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A team fixed 10 security issues in a month. The time to fix each issue (in days) was: 2, 3, 5, 7, 1, 4, 6, 8, 2, 3. What is the average remediation time?

   • A3.9 days
   • B4.1 days
   • C4.5 days
   • D5.0 days
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team wants to measure the effectiveness of its vulnerability remediation process. They have data showing that critical vulnerabilities are fixed in an average of 5 days, high in 10 days, and medium in 20 days. They also track the percentage of critical vulnerabilities fixed within the SLA of 7 days, which is currently 85%. Which metric best indicates whether the team is meeting its remediation SLAs for the most important vulnerabilities?

   • AAverage remediation time across all severities
   • BAverage remediation time for critical vulnerabilities
   • CTotal number of vulnerabilities remediated per month
   • DPercentage of critical vulnerabilities fixed within 7 days
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How is 'complexity' used as a security metric?

   • ATo measure the number of users affected by a vulnerability
   • BTo evaluate the difficulty of exploiting or fixing a vulnerability
   • CTo determine the financial cost of a security breach
   • DTo count the number of lines of code in the application
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the context of security metrics, what does 'criticality level' help an organization determine?

   • AThe cost of the software license
   • BThe total number of vulnerabilities in the system
   • CThe programming language used to develop the software
   • DWhich vulnerabilities to address first based on their potential impact
   Reveal Solution Discussion Select an answer first