Explain How to Define, Measure, and Report on Metrics to Assess and Monitor a Security Programs Effectiveness. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services company wants to measure the effectiveness of its new endpoint detection and response (EDR) deployment. The security team has proposed several metrics. Which metric best aligns with the organization's goal of reducing the impact of successful endpoint compromises?

   • AMean time to respond (MTTR) to endpoint alerts
   • BTotal number of malware signatures updated weekly
   • CNumber of EDR alerts generated per day
   • DPercentage of endpoints with the EDR agent installed
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team wants to measure the effectiveness of their intrusion detection system (IDS). They have access to IDS alerts and network flow logs. The IDS alerts show a high number of false positives. Which data source is most appropriate for measuring the true positive rate?

   • ANetwork flow logs alone
   • BCorrelating IDS alerts with network flow logs and incident records
   • CIDS alerts alone
   • DVendor documentation for the IDS
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which activity is part of monitoring security program effectiveness over time?

   • APerforming a one-time penetration test to identify current weaknesses.
   • BConducting a single employee security awareness training session.
   • CReviewing the security policy document once a year.
   • DTracking the trend of a metric, such as the number of unpatched critical vulnerabilities, on a monthly basis.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is defining metrics for a new security program. The organization has a high tolerance for risk in some areas but is very risk-averse in others. Which approach to defining metrics is most appropriate?

   • ADefine metrics that align with the risk tolerance of each business area
   • BUse industry-standard metrics regardless of risk tolerance
   • CDefine a single set of metrics for the entire organization
   • DDefine metrics based on the easiest data to collect
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When measuring a security metric, which practice best ensures the data is reliable?

   • ACollect data from a single source to maintain consistency.
   • BCollect data only during high-activity periods to capture the most relevant information.
   • CUse automated collection methods with defined validation checks.
   • DManually compile data from various reports to ensure human oversight.
   Reveal Solution Discussion Select an answer first