easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst is preparing a monthly…
A security analyst is preparing a monthly dashboard for the board of directors. Which metric would best demonstrate the effectiveness of the security program in reducing risk?
⚠ Common exam trap
CompTIA often tests the misconception that volume or compliance metrics (like incident count or training completion) directly indicate risk reduction, when in fact operational efficiency metrics (MTTD/MTTR) are the true measure of a security program's effectiveness in minimizing impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mean time to detect (MTTD) and mean time to respond (MTTR).
Mean time to detect (MTTD) and mean time to respond (MTTR) directly quantify the security program's operational efficiency in identifying and containing threats, which reduces the window of exposure and potential damage. A lower MTTD/MTTR indicates faster detection and response, directly correlating with reduced risk from incidents. This makes it the best metric for demonstrating risk reduction effectiveness to the board.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Number of security incidents detected.
Why it's wrong here
The 'Number of security incidents detected' is an ambiguous metric when evaluated in isolation. An increase could signify a more effective security program with enhanced detection capabilities, rather than a decline in overall security posture. Without context regarding the severity, impact, or the speed at which these incidents were resolved, this count alone does not directly reflect the efficiency or effectiveness of the security program's ability to prevent or mitigate threats.
- ✓
Mean time to detect (MTTD) and mean time to respond (MTTR).
Why this is correct
Mean Time To Detect (MTTD) and Mean Time To Respond (MTTR) are crucial operational metrics that directly quantify the efficiency and effectiveness of a security program's incident management lifecycle. MTTD measures the speed at which threats are identified, reflecting the efficacy of monitoring and alerting systems. MTTR assesses the swiftness of containment, eradication, and recovery efforts, indicating the incident response team's proficiency in neutralizing threats and minimizing their impact.
- ✗
Percentage of employees who completed security awareness training.
Why it's wrong here
While 'Percentage of employees who completed security awareness training' is an important compliance and activity metric, it does not directly measure the overall effectiveness of the security program in reducing actual security incidents. High completion rates do not automatically translate into improved employee behavior or a reduction in human-related security breaches. The true measure of training effectiveness lies in the observable reduction of phishing click-through rates or social engineering success, rather than mere attendance.
- ✗
Number of firewall rules configured.
Why it's wrong here
The 'Number of firewall rules configured' is a configuration metric, not a performance indicator of a security program's effectiveness. A high count of rules does not inherently equate to better security; it could instead indicate unnecessary complexity, potential misconfigurations, or a lack of rule optimization, which can introduce vulnerabilities. The efficacy of a firewall is determined by how well its ruleset prevents unauthorized access and filters malicious traffic, not by the sheer quantity of rules.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response
Key term
MTTR
MTTR stands for Mean Time to Repair, a metric that measures the average time it takes to restore a failed system or component to full working order after a failure occurs.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.