Explain How Continuous Process Improvement Can Enrich and Expand a Metrics Driven Security Programs Efficacy. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team tracks the percentage of phishing simulation clicks over the past six months. The metric has been steadily declining, but the team is unsure whether the decline is due to improved user awareness or to a change in the simulation tool that made the emails easier to spot. Using CPI principles, what should the team do first?

   • ARoll back the simulation tool change to isolate its effect on the metric.
   • BIncrease the frequency of phishing simulations to accelerate the improvement.
   • CInvestigate the root cause of the trend by correlating the metric with other data, such as training completion rates and simulation tool changes.
   • DCelebrate the improvement and set a new, more aggressive target for the next quarter.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is adopting the Plan-Do-Check-Act (PDCA) cycle to improve its vulnerability management program. They have completed the 'Plan' phase by defining objectives and metrics. What is the most appropriate next step in the cycle?

   • AImplement the planned changes on a small scale and collect data on the selected metrics.
   • BReview the metrics to ensure they are still aligned with business objectives before proceeding.
   • CStandardize the changes across the entire organization because the plan has been approved.
   • DAnalyze the collected data against the objectives to identify whether the changes achieved the desired effect.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team has been using PDCA to improve its vulnerability management program. After several cycles, the number of critical vulnerabilities has decreased, but the time to remediate has increased. The team is considering two options: (1) focus on reducing remediation time by adding more staff, or (2) investigate whether the decrease in critical vulnerabilities is due to a change in the scanning tool. Using CPI principles, what should the team do?

   • AFirst analyze the data to determine if the increase in remediation time is correlated with the decrease in critical vulnerabilities, and whether the scanning tool change affected the metrics.
   • BRoll back the scanning tool change to see if the metrics return to previous levels.
   • CSet a new target for remediation time that is more aggressive to motivate the team.
   • DImmediately add more staff to reduce remediation time, as this is a direct action to address the metric.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the PDCA cycle, what is the primary purpose of the 'Check' phase when applied to security metrics?

   • ATo implement the planned security improvements.
   • BTo standardize successful improvements across the organization.
   • CTo define the security objectives and processes.
   • DTo monitor and evaluate the results of the implemented changes against expected outcomes.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key way CPI aligns security metrics with organizational goals?

   • ABy focusing exclusively on technical metrics and ignoring business impact.
   • BBy using metrics only to report to senior management.
   • CBy keeping metrics static to ensure consistent reporting.
   • DBy ensuring metrics are reviewed and adjusted to reflect evolving business priorities.
   Reveal Solution Discussion Select an answer first