Define Security Metrics (e.g., Criticality Level, Average Remediation Time, Complexity, Key Performance Indicators (KPI), Objectives and Key Results) CSSLP Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A security team tracks the time taken to fix vulnerabilities. In the last month, they fixed 10 vulnerabilities with the following remediation times in days: 2, 3, 3, 4, 5, 5, 6, 7, 8, 30. The 30-day fix was for a complex legacy system. Which metric would be most misleading if used to report the team's typical remediation performance?

   • AAverage remediation time
   • BMedian remediation time
   • CMode of remediation times
   • DPercentage of fixes within 7 days
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is trying to demonstrate the effectiveness of its secure software lifecycle to management. They have data on the number of vulnerabilities found in each phase (design, coding, testing, production) and the average remediation time for each phase. Which metric would best demonstrate the value of shifting security left?

   • AThe total number of vulnerabilities found across all phases
   • BThe number of vulnerabilities found in the design phase
   • CThe percentage of vulnerabilities found in production
   • DThe average remediation time for vulnerabilities found in each phase
   Reveal Solution Discussion Select an answer first
3. 23expert · hard

   A security team is prioritizing vulnerabilities for remediation. They have two vulnerabilities: one in a critical business application that is not internet-facing, and one in a non-critical internal tool that is internet-facing. The vulnerability in the critical application has a CVSS score of 6.0, while the vulnerability in the internal tool has a CVSS score of 8.0. Which vulnerability should be prioritized?

   • AThe critical application vulnerability because the asset is critical
   • BPrioritize based on the average remediation time for each vulnerability
   • CPrioritize based on the complexity of the fix
   • DThe internal tool vulnerability because it has a higher CVSS score and is internet-facing
   Reveal Solution Discussion Select an answer first