Explain How to Define, Measure, and Report on Metrics to Assess and Monitor a Security Programs Effectiveness. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which characteristic is most important when defining a security metric?

   • AIt is approved by the security team only.
   • BIt is identical to metrics used by peer organizations.
   • CIt is measurable and relevant to the security objectives.
   • DIt is based on a large volume of data.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team wants to measure the effectiveness of their incident response process. They have two data sources: SIEM alerts and post-incident review reports. The SIEM alerts show a detection time of 10 minutes, but the review reports show a detection time of 2 hours. What is the most appropriate action to ensure metric accuracy?

   • AUse the SIEM alert time because it is automated and objective
   • BInvestigate the discrepancy and define a consistent measurement method
   • CAverage the two times to get a balanced metric
   • DUse the review report time because it reflects the actual incident detection
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team has been tracking the percentage of critical vulnerabilities remediated within 30 days. The current value is 85%, and the target is 90%. The team wants to assess the effectiveness of their vulnerability management program. What is the most appropriate conclusion from this metric?

   • AThe program is not meeting its target and needs improvement
   • BThe program is ineffective because it did not reach 100%
   • CThe program's effectiveness cannot be determined from this metric alone
   • DThe program is effective because 85% is a high percentage
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team must report on the effectiveness of their security program to the board of directors. The board is concerned about the return on investment (ROI) of security spending. Which metric is most appropriate to include in the report?

   • ACost per incident avoided
   • BPercentage of security alerts investigated
   • CNumber of security tools deployed
   • DTotal number of security incidents
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team must report on the effectiveness of their security awareness program to two audiences: the board of directors and the IT department. The board wants a high-level view of risk reduction, while the IT department wants to identify specific areas for improvement. What is the most effective reporting strategy?

   • AReport only the overall click rate to both audiences
   • BPresent the same report but with more charts for the board
   • CSend the same detailed report to both audiences
   • DCreate two reports: a summary for the board and a detailed report for IT
   Reveal Solution Discussion Select an answer first