Develop and Optimize Security Metrics. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to set a target for the metric 'percentage of endpoints with the latest antivirus signatures'. The current baseline is 95%. The team wants to improve but also wants a realistic target. What is the most appropriate target?

   • A100% within the next month
   • B90% (allow for some degradation)
   • C99% within the next quarter
   • D95% (maintain the current level)
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When selecting security metrics, what should be the primary consideration?

   • AThe metric aligns with organizational security goals and stakeholder needs
   • BThe metric is identical to industry-standard metrics
   • CThe metric produces a high number that looks impressive in reports
   • DThe metric is easy to calculate from available logs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Splunk engineer is asked to create a metric for 'dwell time' (time from compromise to detection). The available data sources are authentication logs, endpoint detection and response (EDR) alerts, and incident tickets. Which data source combination would provide the most accurate dwell time metric?

   • AUse the EDR alert time as the start and the ticket creation time as the end
   • BUse the first authentication event and the last authentication event before the alert
   • CUse the first suspicious authentication event in the authentication logs as the start and the EDR alert as the end
   • DUse the ticket creation time as the start and the EDR alert time as the end
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Splunk analyst is asked to create a metric for 'time to detect' security incidents. The available data sources are firewall logs, endpoint detection and response (EDR) alerts, and ticketing system records. Which approach best derives this metric from the available data?

   • AAverage the time between the first firewall log and the last firewall log for each incident
   • BUse the timestamp of the EDR alert as the start time and the ticket closure time as the end time
   • CUse the ticket creation time as the start and the EDR alert time as the end
   • DCalculate the average time between the first suspicious event in firewall logs and the creation of the corresponding ticket in the ticketing system
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Splunk analyst is asked to develop a metric for 'time to contain' a security incident. The available data sources are EDR alerts, firewall logs, and incident tickets. The analyst notices that the EDR alert timestamps are often delayed by several minutes due to data ingestion. How should the analyst handle this to ensure the metric is accurate?

   • AUse the firewall logs as the start time and the ticket's 'contained' timestamp as the end time
   • BUse the earliest event in the firewall logs as the start time and the ticket's 'contained' timestamp as the end time, and validate against EDR data
   • CUse the EDR alert timestamp as the start time and the ticket's 'contained' timestamp as the end time, but subtract the average ingestion delay
   • DUse the EDR alert timestamp as the start time and the ticket's 'contained' timestamp as the end time, and note the potential delay
   Reveal Solution Discussion Select an answer first