Explain How to Define, Measure, and Report on Metrics to Assess and Monitor a Security Programs Effectiveness. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team monitors the percentage of endpoints with the latest antivirus signatures. The metric has been stable at 98% for six months. The team wants to identify areas for improvement. What is the most appropriate next step?

   • AConclude that the program is effective and stop monitoring
   • BCompare the metric to industry benchmarks
   • CIncrease the target to 100%
   • DInvestigate the 2% of endpoints that are not up to date
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to measure the percentage of phishing emails reported by users. They have access to email gateway logs and user-reported phishing simulations. Which data source is most appropriate for this metric?

   • AUser-reported phishing simulation results
   • BSIEM alerts for malware detections
   • CEmail gateway logs showing blocked phishing emails
   • DHelp desk tickets related to email issues
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the role of benchmarks and targets in assessing security program effectiveness?

   • AThey are only useful for compliance reporting, not for internal improvement.
   • BThey are static and should never be updated once defined.
   • CThey provide a baseline against which current performance can be measured.
   • DThey replace the need for continuous monitoring of security metrics.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which data source is most appropriate for measuring the metric 'mean time to detect (MTTD) a security incident'?

   • ASIEM alert logs and incident response records.
   • BAsset inventory database.
   • CVulnerability scan reports.
   • DEmployee training completion logs.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst must report on the effectiveness of the patch management program to the IT operations manager, who is responsible for system availability. Which metric is most relevant to this stakeholder?

   • APercentage of critical patches applied within the SLA
   • BNumber of vulnerabilities discovered in the last scan
   • CTotal number of security incidents reported
   • DMean time to detect (MTTD) security incidents
   Reveal Solution Discussion Select an answer first