Develop and Optimize Security Metrics. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst needs to present a monthly report to non-technical executives. The report should show whether the security program is improving. Which visualization approach is most effective?

   • AA heat map of alerts by hour of day
   • BA line chart showing the trend of key metrics over the past 12 months with target lines
   • CA table with the raw values of all metrics for the current month
   • DA pie chart showing the distribution of alert severities for the month
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   To develop a metric on the number of malware infections blocked per month, which data source would you use?

   • ADNS query logs
   • BEndpoint protection logs showing blocked threats
   • CActive Directory user login logs
   • DAsset inventory database
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security team sets a target that 95% of critical alerts must be triaged within 15 minutes. What is this an example of?

   • AA target threshold
   • BA data source
   • CA baseline value
   • DA visualization type
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   During a quarterly review, a security team finds that a metric is no longer used by any stakeholder. What should they do?

   • AReplace it with a metric that addresses current security priorities
   • BAutomate its generation to reduce effort
   • CMake it more complex to attract attention
   • DKeep it because it has always been reported
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A Splunk analyst is asked to develop a metric for 'time to patch' critical vulnerabilities. The available data sources are vulnerability scanner results and configuration management database (CMDB) records. Which approach would provide the most accurate metric?

   • AUse the scanner's last scan date as the patch date
   • BAverage the time between all scans that detected the vulnerability
   • CCalculate the time between the first detection of a vulnerability by the scanner and the date the asset's configuration shows the patch installed
   • DUse the CMDB asset creation date as the start and the scanner detection date as the end
   Reveal Solution Discussion Select an answer first