Courseiva
easyMultiple ChoiceObjective-mapped

CS0-003 Practice Question: A security analyst is preparing a monthly…

A security analyst is preparing a monthly dashboard for the board of directors. Which metric would best demonstrate the effectiveness of the security program in reducing risk?

⚠ Common exam trap

CompTIA often tests the misconception that volume or compliance metrics (like incident count or training completion) directly indicate risk reduction, when in fact operational efficiency metrics (MTTD/MTTR) are the true measure of a security program's effectiveness in minimizing impact.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Mean time to detect (MTTD) and mean time to respond (MTTR).

Mean time to detect (MTTD) and mean time to respond (MTTR) directly quantify the security program's operational efficiency in identifying and containing threats, which reduces the window of exposure and potential damage. A lower MTTD/MTTR indicates faster detection and response, directly correlating with reduced risk from incidents. This makes it the best metric for demonstrating risk reduction effectiveness to the board.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Number of security incidents detected.

    Why it's wrong here

    The 'Number of security incidents detected' is an ambiguous metric when evaluated in isolation. An increase could signify a more effective security program with enhanced detection capabilities, rather than a decline in overall security posture. Without context regarding the severity, impact, or the speed at which these incidents were resolved, this count alone does not directly reflect the efficiency or effectiveness of the security program's ability to prevent or mitigate threats.

  • Mean time to detect (MTTD) and mean time to respond (MTTR).

    Why this is correct

    Mean Time To Detect (MTTD) and Mean Time To Respond (MTTR) are crucial operational metrics that directly quantify the efficiency and effectiveness of a security program's incident management lifecycle. MTTD measures the speed at which threats are identified, reflecting the efficacy of monitoring and alerting systems. MTTR assesses the swiftness of containment, eradication, and recovery efforts, indicating the incident response team's proficiency in neutralizing threats and minimizing their impact.

  • Percentage of employees who completed security awareness training.

    Why it's wrong here

    While 'Percentage of employees who completed security awareness training' is an important compliance and activity metric, it does not directly measure the overall effectiveness of the security program in reducing actual security incidents. High completion rates do not automatically translate into improved employee behavior or a reduction in human-related security breaches. The true measure of training effectiveness lies in the observable reduction of phishing click-through rates or social engineering success, rather than mere attendance.

  • Number of firewall rules configured.

    Why it's wrong here

    The 'Number of firewall rules configured' is a configuration metric, not a performance indicator of a security program's effectiveness. A high count of rules does not inherently equate to better security; it could instead indicate unnecessary complexity, potential misconfigurations, or a lack of rule optimization, which can introduce vulnerabilities. The efficacy of a firewall is determined by how well its ruleset prevents unauthorized access and filters malicious traffic, not by the sheer quantity of rules.

About these practice questions

This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.