Resource Analysis (e.g., Cost Estimation, Personnel Costs, Probabilities and Statistics (Monte Carlo)) ISSEP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security engineering team is estimating the cost of a new intrusion detection system by breaking the project into individual work packages (e.g., hardware, software, installation, testing) and estimating each package separately. Which cost estimation method are they using?

   • AParametric estimation
   • BBottom-up estimation
   • CAnalogous estimation
   • DTop-down estimation
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of using Monte Carlo simulation in project cost estimation?

   • ATo determine the single most likely cost outcome
   • BTo model the range of possible outcomes and their probabilities by running many random trials
   • CTo calculate the exact cost of the project with certainty
   • DTo replace the need for any cost estimation methods
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security engineering team is estimating the cost to implement a new SIEM platform. They have detailed requirements and a work breakdown structure with specific tasks, each with labor hours and material costs. The project sponsor wants an estimate that reflects the team's detailed planning and can be used as a baseline for tracking. Which cost estimation approach should the team use?

   • ABottom-up estimation by summing costs of individual tasks in the WBS
   • BAnalogous estimation based on a single past project's total cost
   • CTop-down estimation using historical data from similar SIEM deployments
   • DParametric estimation using a cost per user based on industry averages
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security engineer is modeling the likelihood of a data breach. Historical data shows that the probability of a phishing attack in a given month is 0.2, and the probability of a ransomware attack is 0.1. The engineer assumes these events are independent. What is the probability that at least one of these attacks occurs in a given month?

   • A0.30
   • B0.28
   • C0.02
   • D0.72
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does Maximum Tolerable Downtime (MTD) represent for a business system?

   • AThe maximum time between system failures
   • BThe average time the system is down over a year
   • CThe maximum amount of time a system can be unavailable before causing unacceptable business impact
   • DThe time required to restore the system after a disaster
   Reveal Solution Discussion Select an answer first