Explain How Continuous Process Improvement Can Enrich and Expand a Metrics Driven Security Programs Efficacy. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team has a mature metrics program, but the CISO is concerned that the team is 'improving the metrics' rather than 'improving security'. The team has been optimizing for metrics like low false positive rates and fast response times, but security incidents have not decreased. How can CPI help refocus the program on actual security outcomes?

   • AUse CPI to periodically review the metrics themselves to ensure they are leading indicators of security outcomes, and adjust them if they are not.
   • BIncrease the frequency of metric reviews to catch issues sooner.
   • CReplace the current metrics with a single composite security score that is easier to track.
   • DContinue with the current metrics because they are well-defined and easy to measure.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team has been using the PDCA cycle to improve its incident response process. After several cycles, the mean time to respond (MTTR) has plateaued. The team is considering whether to continue with the current approach or try something new. What is the most CPI-aligned action?

   • AReplace the MTTR metric with a different metric that is easier to improve.
   • BConduct a root-cause analysis to identify why the metric has plateaued and then design a new experiment to address the underlying cause.
   • CIncrease the target for MTTR to make the metric more challenging and motivate the team.
   • DAccept the plateau as the natural limit of the current process and shift focus to other metrics.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security team notices that the mean time to detect (MTTD) incidents has been steadily increasing over the past three months. According to CPI principles, what is the most appropriate next step?

   • AWait for the next annual review before taking any action.
   • BIgnore the trend because MTTD is not a meaningful security metric.
   • CAnalyze the trend to identify root causes and implement targeted corrective actions.
   • DImmediately replace the entire security monitoring stack.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is using PDCA to improve its detection capabilities. In the 'Check' phase, they find that the number of alerts has increased, but the false positive rate has also increased. The team is considering whether to tune the detection rules or to add more analysts. What should the team do first, according to CPI?

   • ADisable the detection rules that are generating the most false positives.
   • BIncrease the alert threshold to reduce the number of alerts overall.
   • CAnalyze the types of false positives to identify patterns that could be addressed by tuning specific rules.
   • DAdd more analysts to handle the increased alert volume and reduce the backlog.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to align its metrics with the organization's strategic goal of reducing cyber risk. Currently, the team tracks operational metrics like firewall rule changes and antivirus update success rates. How can CPI help the team better align its metrics with the strategic goal?

   • AReplace all operational metrics with a single risk score that directly measures the strategic goal.
   • BUse the operational metrics as leading indicators and periodically review them to identify how they correlate with risk reduction outcomes.
   • CStop tracking operational metrics and focus only on metrics that are directly tied to business outcomes.
   • DContinue tracking the same metrics but present them to leadership in a more visual dashboard.
   Reveal Solution Discussion Select an answer first