CySA+ Security Metrics and KPI Reporting Quiz

1. Mean Time To Detect (MTTD) is measured from which point?

When the incident occurs to when it is reported

When the incident occurs to when it is detected

When detected to when it is resolved

When reported to when containment begins

2. Which communication principle is most critical when reporting a major security breach to stakeholders?

Minimize details to avoid panic

Transparency, accuracy, and timely updates

Wait until all details are confirmed

Only communicate through IT channels

3. What does a lagging indicator measure in security metrics?

Future security risks and threats

Past security events and their outcomes

Current vulnerability scanning activity

Planned security improvements

4. When reporting security metrics, which approach best aligns with business objectives?

Focus only on technical metrics

Connect security metrics to business impact and risk

Report all possible metrics regardless of relevance

Avoid discussing financial implications

5. What is the primary purpose of a security dashboard?

To replace incident response procedures

To provide real-time visibility of security posture

To eliminate the need for security audits

To reduce security staffing needs

6. Which metric is most useful for demonstrating ROI of security investments?

Number of phishing simulations conducted

Reduction in incident frequency and severity

Total amount spent on security tools

Number of security policies created

7. How frequently should security KPIs be reviewed with executive leadership?

Only when incidents occur

Quarterly or according to organizational policy

Once per year at annual meetings

Never, only technical staff need to review

8. What does a heat map in security reporting typically display?

Server processing temperatures

Risk concentration across systems or departments

Employee performance ratings

Network bandwidth usage

9. Which stakeholder group primarily focuses on compliance and regulatory reporting?

Development teams

Legal and compliance departments

Help desk support

Network administrators

10. What is the primary benefit of using risk scoring in security reporting?

Eliminates the need for vulnerability management

Prioritizes remediation efforts based on business impact

Reduces the number of security incidents

Eliminates all compliance requirements

11. Which metric best measures the effectiveness of a security awareness training program?

Number of phishing emails received

Percentage of employees who clicked malicious links

Total training hours completed

Number of security policies updated

12. Which visualization method is best for showing security metrics trends to non-technical stakeholders?

Raw data tables with thousands of rows

Line graphs and pie charts showing key trends

Command-line output and logs

Detailed network topology diagrams

13. What should be included in an incident report to management?

Only technical details of the attack

Impact, timeline, response actions, and lessons learned

List of all security tools used in detection

Names of all employees involved

14. Which metric helps measure the efficiency of the security operations center (SOC)?

False positive rate of alerts

Number of employees trained annually

Total number of firewalls deployed

Annual security budget spending

15. How should a security analyst report a critical zero-day vulnerability to stakeholders?

Wait for full analysis before communicating

Provide immediate notification with severity and initial mitigation steps

Send detailed technical documentation only

Report only to the IT department first

16. Which of the following is a leading indicator for security posture?

Number of incidents that occurred last month

Percentage of systems with patches applied

Total cost of a data breach

Number of compliance audits completed

17. What is the primary purpose of establishing a baseline for security metrics?

To determine the budget for security tools

To measure progress and identify trends over time

To comply with regulatory requirements

To eliminate all security risks

18. When communicating security metrics to executive leadership, which format is most effective?

Detailed technical reports with raw data

High-level dashboards showing trend and business impact

Comprehensive logs of all security events

List of all security tools and their features

19. Which key performance indicator directly reflects the organization's vulnerability management program effectiveness?

Average time to patch critical vulnerabilities

Total number of vulnerability scans performed

Number of security tools deployed

Annual security training completion rate

20. What does MTTR represent in security incident management?

Maximum Time To Report

Mean Time To Respond

Minimum Threat Tolerance Rate

Monthly Technical Trend Review