A security dashboard currently shows the total number of firewall alerts per day. The SOC manager says this metric is not actionable because it doesn't tell the team what to do. Which refinement would make the metric more actionable?

Display the same total but as a 7-day moving average

Break down the alerts by severity and show the percentage that were escalated to incidents

Add a comparison to the same day last year

Show the total number of alerts per firewall vendor

A security team wants to establish a baseline for the metric 'mean time to respond (MTTR) to critical alerts'. They have six months of historical data. What is the most appropriate way to set the baseline?

Use the MTTR from the most recent month only

Use the median MTTR from the last six months as the baseline

Use the average MTTR from the last six months, excluding all incidents with a response time over 60 minutes

Use the fastest MTTR recorded in the last six months as the baseline

A security metric shows that the number of phishing emails reported by users has increased by 20% over the last month. What makes this metric actionable?

It triggers a review of user awareness training and email filtering rules

It is stored in a historical database

It is compared to the industry average

A security team is creating a report for two audiences: the SOC analysts and the executive team. The analysts need detailed operational data, while the executives need a high-level summary. What is the most effective way to present the metrics?

Create a dashboard with drill-down capabilities and give both audiences the same link

Create one detailed report and send it to both audiences

Create one summarized report and send it to both audiences

Create two separate reports: one detailed for analysts and one summarized for executives

A security operations manager wants to report on the effectiveness of the phishing awareness program. The executive team cares about reducing business risk, while the training team wants to see if the curriculum is working. Which metric would best satisfy both stakeholders?

Reduction in the rate of successful phishing-based compromises over time

Number of phishing simulations sent per quarter

Percentage of employees who completed the annual training

Percentage of employees who clicked a link in a phishing simulation

SplunkCertified Cybersecurity Defense Engineer

Domain 5Objective 1

Develop and Optimize Security Metrics. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Part of the Auditing and Reporting on Security Programs domain, which accounts for 10% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

10%of the exam

Questions 21–25

21application · medium
A security dashboard currently shows the total number of firewall alerts per day. The SOC manager says this metric is not actionable because it doesn't tell the team what to do. Which refinement would make the metric more actionable?
Select an answer first
22application · medium
A security team wants to establish a baseline for the metric 'mean time to respond (MTTR) to critical alerts'. They have six months of historical data. What is the most appropriate way to set the baseline?
Select an answer first
23foundation · easy
A security metric shows that the number of phishing emails reported by users has increased by 20% over the last month. What makes this metric actionable?
Select an answer first
24expert · hard
A security team is creating a report for two audiences: the SOC analysts and the executive team. The analysts need detailed operational data, while the executives need a high-level summary. What is the most effective way to present the metrics?
Select an answer first
25application · medium
A security operations manager wants to report on the effectiveness of the phishing awareness program. The executive team cares about reducing business risk, while the training team wants to see if the curriculum is working. Which metric would best satisfy both stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.