1.7 Define, Measure, and Report Security Metrics ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A CISO is preparing a monthly security report for the executive team. The executives want to understand if the security team is meeting its service-level agreements (SLAs) for patching and incident response. Which reporting approach is most effective?

   • AReport a narrative summary of the security team's activities for the month
   • BReport the total number of patches applied and the total number of incidents handled
   • CReport the number of security incidents that caused downtime
   • DReport the percentage of patches applied within the SLA and the percentage of incidents responded to within the SLA
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's risk appetite statement says it is willing to accept a moderate level of risk for its internal corporate systems, but has a very low tolerance for risk to its customer-facing payment processing environment. The security team is selecting metrics for the monthly risk report. Which metric selection best reflects this risk appetite?

   • ATrack a comprehensive set of metrics for the payment environment and a smaller set of high-level metrics for internal systems
   • BTrack only the metrics for the payment environment and rely on audits for internal systems
   • CTrack the same set of metrics for both environments to ensure consistency of reporting
   • DTrack the same metrics but set higher thresholds for the payment environment
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team tracks the metric 'time to patch critical vulnerabilities' and observes that the average has increased from 7 days to 21 days over the last six months. The team also notices that the number of incidents exploiting known vulnerabilities has increased. What is the most appropriate action for the team to take?

   • AChange the metric to measure only critical patches for internet-facing systems
   • BInvestigate the root cause of the patching delay and implement process improvements to reduce the time to patch
   • CReport the trend to management and request a budget increase for more security staff
   • DAccept the trend as a normal fluctuation and continue to monitor the metric
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is reviewing the monthly metrics dashboard. The metric 'percentage of privileged users with MFA enabled' has dropped from 98% to 85% over the last two weeks. The threshold for this metric is 95%. What is the most appropriate immediate action for the analyst to take?

   • AReport the metric to the board in the next quarterly meeting
   • BInvestigate which accounts have lost MFA and remediate them immediately
   • CAdjust the threshold to 80% to reflect the new normal
   • DWait until the end of the month to see if the metric recovers before taking action
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an example of a Key Risk Indicator (KRI)?

   • APercentage of employees who completed security awareness training
   • BAverage time to patch critical vulnerabilities
   • CNumber of security incidents resolved within SLA
   • DNumber of open high-risk findings from external penetration tests
   Reveal Solution Discussion Select an answer first