Explain How to Define, Measure, and Report on Metrics to Assess and Monitor a Security Programs Effectiveness. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is assessing the effectiveness of their vulnerability management program. They have two metrics: percentage of critical vulnerabilities remediated within 30 days (currently 85%) and percentage of critical vulnerabilities remediated within 60 days (currently 95%). The target for both is 90%. Which conclusion is most appropriate?

   • AThe program is ineffective because the 30-day metric is below target
   • BThe program's effectiveness cannot be determined from these metrics
   • CThe program is partially effective: timely remediation is a concern, but overall remediation is on track
   • DThe program is effective because the 60-day metric meets the target
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of reporting security metrics to stakeholders?

   • ATo communicate the effectiveness of the security program in a way that supports decision-making.
   • BTo provide a technical deep-dive into every security log for the IT team.
   • CTo justify the security budget by listing all security tools in use.
   • DTo demonstrate that the security team is busy with daily tasks.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team monitors the mean time to respond (MTTR) to incidents. Over the last six months, MTTR has decreased from 4 hours to 2 hours, but the number of incidents has increased. What is the most appropriate interpretation of these trends?

   • AThe security program is becoming less effective because incidents are increasing
   • BThe security program is improving because MTTR is decreasing
   • CThe security program is stable because the metrics are within acceptable ranges
   • DThe security program's effectiveness cannot be determined without additional context
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security architect is defining metrics for a new security program. Which action best ensures the metrics align with the organization's security goals?

   • ASelect metrics that are commonly used across the industry regardless of the organization's specific context.
   • BDefine metrics that directly measure progress toward the organization's stated security objectives and risk priorities.
   • CUse only metrics that are mandated by regulatory compliance, ignoring other organizational objectives.
   • DChoose metrics that are easiest to calculate from available log data, even if they do not map to strategic objectives.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations center (SOC) wants to measure the average time to detect (MTTD) security incidents. They have access to multiple data sources. Which data source provides the most reliable and accurate basis for this metric?

   • AFirewall logs showing blocked connections
   • BSIEM correlation alerts with first-seen timestamps
   • CIncident tickets created by analysts
   • DVulnerability scan reports
   Reveal Solution Discussion Select an answer first