Develop and Optimize Security Metrics. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is evaluating two metrics for the SOC: 'number of alerts per day' and 'percentage of alerts that are true positives'. The SOC manager wants a metric that reflects the team's effectiveness in detecting real threats, not just their workload. Which metric should the team use, and why?

   • ABoth metrics, because they are equally important
   • BNumber of alerts per day, because it shows the volume of work the team handles
   • CPercentage of alerts that are true positives, because it measures the accuracy of detection
   • DNeither metric, because they don't measure the team's response time
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is asked to report on the performance of the incident response team. The current metric is 'number of incidents handled per month'. The team manager says this metric is misleading because it doesn't account for the complexity of incidents. Which alternative metric would be more meaningful?

   • AAverage time to resolve incidents, broken down by severity
   • BNumber of incidents escalated to a higher tier
   • CTotal number of incidents handled per month, with a footnote about complexity
   • DPercentage of incidents that were false positives
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security manager is asked to provide a metric that demonstrates the value of the security team to the board of directors. The board is interested in how security contributes to business objectives. Which metric would best demonstrate this value?

   • AAverage time to patch critical vulnerabilities
   • BPercentage of critical business applications that have not experienced a security-related outage
   • CNumber of security alerts processed per month
   • DNumber of security tools deployed in the environment
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is it important to regularly review and update security metrics?

   • ATo ensure they remain aligned with evolving security priorities and organizational goals
   • BTo increase the number of metrics reported
   • CTo make metrics more complex
   • DTo satisfy regulatory requirements only
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security manager is defining a metric to measure the effectiveness of the vulnerability management program. The metric will be reported to the IT operations team, which is responsible for patching. Which metric would be most meaningful to this audience?

   • AAverage CVSS score of all open vulnerabilities
   • BTotal number of vulnerabilities discovered in the environment
   • CPercentage of critical vulnerabilities patched within the SLA timeframe
   • DNumber of vulnerability scans completed per month
   Reveal Solution Discussion Select an answer first