1.7 Define, Measure, and Report Security Metrics ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security metric shows a consistent upward trend in the number of phishing emails reported by employees. What is the most appropriate use of this metric?

   • ATo identify a potential weakness in email security controls and prioritize improvements
   • BTo use the trend as a KRI to signal increasing risk
   • CTo conclude that the security program is performing well
   • DTo ignore the trend because it is only a reporting metric
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security manager is establishing a baseline for the metric 'percentage of endpoints with a compliant security agent version'. The organization has just completed a major endpoint refresh, and the current compliance rate is 99%. Historical data from the previous year shows an average compliance rate of 92% with a standard deviation of 3%. What is the most appropriate baseline to use for this metric?

   • AUse the current rate of 99% as the baseline, as it reflects the new environment
   • BCollect data for a new period to establish a new baseline for the refreshed environment
   • CUse the historical average of 92% as the baseline, as it reflects the long-term performance
   • DSet the baseline at 95%, the midpoint between the historical average and the current rate
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security manager is reviewing the quarterly risk report. The KRI 'percentage of third-party vendors with an active, non-expired security assessment' has decreased from 90% to 70%. The threshold for this KRI is 80%. What is the most appropriate action for the security manager to take?

   • ADocument the trend and report it in the next quarterly risk report
   • BAccept the trend as a normal fluctuation and continue to monitor the KRI
   • CInitiate an investigation to identify which vendors have expired assessments and prioritize remediation
   • DAdjust the threshold to 65% to reflect the current state of the vendor assessment program
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In security metrics, what is the role of a threshold?

   • ATo trigger an action when a metric value crosses a predefined level
   • BTo define the baseline value for the metric
   • CTo measure the performance of security controls
   • DTo provide a historical record of metric values
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the key difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI)?

   • AKPIs are quantitative, while KRIs are qualitative
   • BKPIs are lagging indicators, while KRIs are always leading indicators
   • CKPIs measure performance against goals, while KRIs provide early warning of risk exposure
   • DKPIs are used by executives, while KRIs are used by operational staff
   Reveal Solution Discussion Select an answer first