Explain How Continuous Process Improvement Can Enrich and Expand a Metrics Driven Security Programs Efficacy. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is implementing CPI for the first time. They have defined a set of metrics and collected baseline data. According to the PDCA cycle, what should they do next?

   • AShare the baseline data with stakeholders to get their input on what to improve.
   • BImplement the improvement immediately and then measure the metrics to see if they improve.
   • CReview the baseline data to ensure the metrics are accurate and reliable.
   • DIdentify a specific improvement to test and plan the implementation, including what data to collect to evaluate its impact.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team has been using CPI to improve its incident response process. They have seen improvements in MTTD and MTTR, but the CISO is concerned that the team is not learning from incidents because the same types of incidents keep recurring. How can CPI help address this?

   • AIncorporate a formal post-incident review into the CPI cycle that feeds lessons learned back into the 'Plan' phase.
   • BFocus on improving the speed of response, as faster response times will reduce the impact of recurring incidents.
   • CIncrease the number of metrics tracked to capture more details about each incident.
   • DShare incident reports with the team to increase awareness, but do not change processes.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team has been using CPI for several years and has achieved significant improvements in many metrics. However, the team is now facing diminishing returns—each cycle yields smaller improvements. The CISO wants to know if CPI is still worth the effort. What is the most CPI-aligned response?

   • AConduct a review to determine if the current metrics are still aligned with the evolving threat landscape and business goals, and consider shifting focus to new metrics or areas.
   • BIncrease the frequency of CPI cycles to try to squeeze out more improvement.
   • CStop CPI because the program has reached its peak and further improvement is not possible.
   • DContinue with the same metrics because they have been successful and changing them would lose historical context.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security manager wants to implement CPI in the team, but the team is used to making one-time improvements after each quarterly review. What is the key difference the manager should communicate to the team?

   • ACPI is a methodology that requires specialized software to implement.
   • BCPI requires more frequent data collection than the current quarterly reviews.
   • CCPI focuses on improving the metrics themselves, not the underlying processes.
   • DCPI involves a continuous cycle of planning, doing, checking, and acting, rather than a single change after each review.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following correctly lists the phases of the Plan-Do-Check-Act (PDCA) cycle as applied to security metrics?

   • APlan, Execute, Review, Adjust
   • BAssess, Design, Implement, Monitor
   • CIdentify, Analyze, Improve, Control
   • DPlan, Do, Check, Act
   Reveal Solution Discussion Select an answer first