Define Security Metrics (e.g., Criticality Level, Average Remediation Time, Complexity, Key Performance Indicators (KPI), Objectives and Key Results) CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A development organization wants to improve its secure coding practices. They set a goal to 'Reduce the number of security defects introduced during development.' They define a key result as 'Decrease the number of security defects found in code review per 1,000 lines of code by 20% within the next two quarters.' Which aspect of this OKR is the key result?

   • ADecrease the number of security defects found in code review per 1,000 lines of code by 20% within the next two quarters
   • BImprove secure coding practices
   • CTrack the number of security defects found in code review
   • DReduce the number of security defects introduced during development
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is prioritizing vulnerabilities for remediation. They have two vulnerabilities: one in a customer-facing web application with a known exploit and a CVSS score of 9.0, and one in an internal tool with no known exploit and a CVSS score of 7.5. The team has limited resources and can only fix one this week. Which vulnerability should be prioritized?

   • APrioritize based on the average remediation time for each vulnerability
   • BThe internal tool vulnerability because it has a lower CVSS score and is less likely to be exploited
   • CThe web application vulnerability because it has a higher CVSS score and is customer-facing
   • DPrioritize based on the complexity of the fix
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of security metrics in a secure software lifecycle?

   • ATo guarantee that all vulnerabilities are eliminated before release
   • BTo replace the need for manual security reviews with automated tools
   • CTo document compliance requirements for external auditors only
   • DTo provide a quantitative basis for evaluating the effectiveness of security processes and controls
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a Key Performance Indicator (KPI) in the context of secure software development?

   • AA qualitative description of the security team's morale
   • BA list of all security vulnerabilities found in the last audit
   • CA tool that automatically fixes security defects
   • DA measurable value that indicates how effectively security activities are achieving their objectives
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security manager wants to track the effectiveness of the security awareness training program for developers. Which KPI would best measure the reduction in security mistakes in code?

   • ANumber of security defects found in code review per 1,000 lines of code
   • BNumber of training sessions completed per developer
   • CPercentage of developers who passed the training quiz
   • DAverage time spent on training per developer
   Reveal Solution Discussion Select an answer first