CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Number of employees

  Why it's wrong here

  This metric simply counts the size of the workforce. It does not measure any aspect of security operations, such as incident detection, response, or remediation. While headcount may inform staffing decisions for a security team, it is not an outcome-based KPI and provides no insight into how quickly threats are identified or resolved.

• ✓

  Mean time to detect (MTTD)

  Why this is correct

  Mean time to detect measures the average duration between when an incident or attack first occurs and when the security team actually becomes aware of it. A lower MTTD indicates stronger monitoring, alerting, and threat-hunting capabilities, allowing the organization to minimize the window in which attackers can operate undetected. It is specifically focused on the detection phase of the incident response lifecycle.

• ✓

  Mean time to remediate (MTTRem)

  Why this is correct

  Mean time to remediate tracks the elapsed time from the point of detection through containment, eradication, and full recovery, reflecting how effectively the organization can eliminate the threat and restore normal operations. This metric is distinct from response time because it encompasses the entire fix cycle, including patching, re-imaging, and validating that the root cause has been removed. A shorter remediation time reduces business disruption and limits the potential for reinfection.

• ✗

  Revenue growth

  Why it's wrong here

  Revenue growth is a financial performance indicator that measures the increase in a company's earnings over a period. While a cyber incident can indirectly harm revenue through downtime or reputational damage, this metric does not quantify the efficiency of security operations, such as detection speed or containment. It is therefore not a relevant KPI for a security analyst tracking incident response performance.

• ✓

  Mean time to respond (MTTR)

  Why this is correct

  Mean time to respond measures the average duration between when an incident is detected and when the security team begins active response actions, such as triage, initial containment, or launching the incident response plan. This KPI focuses on the readiness and agility of the response team rather than the complete eradication of the threat, which falls under remediation. A lower MTTR indicates that analysts are quick to initiate countermeasures after an alert is verified.

Go deeper

Related to this question