Define Security Metrics (e.g., Criticality Level, Average Remediation Time, Complexity, Key Performance Indicators (KPI), Objectives and Key Results) CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to improve its remediation process. They have been tracking the average remediation time for critical vulnerabilities, which is currently 10 days. They want to reduce it to 5 days. Which KPI would best track progress toward this goal?

   • AAverage remediation time for critical vulnerabilities
   • BTotal number of vulnerabilities fixed per month
   • CPercentage of critical vulnerabilities fixed within 5 days
   • DNumber of critical vulnerabilities open
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security manager wants to communicate the value of the security program to executives. They have data on the number of vulnerabilities found, the average remediation time, and the percentage of code reviewed. Which approach best demonstrates the effectiveness of the security program?

   • AReport the average remediation time and percentage of code reviewed as KPIs
   • BReport only the number of vulnerabilities fixed
   • CReport the number of vulnerabilities found as a raw count
   • DReport the number of security tools used
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following best illustrates the role of security metrics in the software lifecycle?

   • AEnsuring that every code change is automatically approved if metrics are positive
   • BTracking the number of security defects found per phase to identify where the process needs improvement
   • CReplacing the security team's judgment with automated scoring for all decisions
   • DProviding a qualitative narrative of security activities for stakeholder reports
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a KPI for a secure software lifecycle?

   • AThe name of the security lead for the project
   • BThe color scheme of the security dashboard
   • CPercentage of security defects closed within the target remediation time
   • DThe total number of employees in the company
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following correctly pairs an objective with a key result in an OKR for security?

   • AObjective: 'Fix all vulnerabilities' — Key Result: 'Have a security team'
   • BObjective: 'Improve vulnerability remediation speed' — Key Result: 'Reduce average remediation time from 10 days to 5 days'
   • CObjective: 'Use a firewall' — Key Result: 'Install a firewall'
   • DObjective: 'Increase security awareness' — Key Result: 'Send an email about security'
   Reveal Solution Discussion Select an answer first