CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Number of antivirus alerts

  Why it's wrong here

  Antivirus alert volume reflects detection of malware or malicious activity events, an entirely separate control domain from patch management. A spike or drop in antivirus alerts says nothing about whether known vulnerabilities have been remediated within their required timeframe, so it would not belong on a patch-management-focused dashboard section.

• ✗

  Phishing simulation click rate

  Why it's wrong here

  Phishing simulation click rate is a security-awareness training metric that measures how susceptible employees are to social engineering, not a technical control metric. It has no connection to whether systems are being patched against known vulnerabilities, so including it under patch management would confuse two unrelated program areas.

• ✗

  Mean time to detect incidents

  Why it's wrong here

  Mean time to detect measures how quickly the organization identifies that an incident or intrusion is occurring, which belongs to the detection and incident-response domain. Patch management is a preventive control focused on closing known vulnerabilities before they can be exploited, so detection speed for active incidents doesn't reflect whether patching itself is on track.

• ✓

  Patch SLA compliance %

  Why this is correct

  Patch SLA compliance percentage directly measures whether systems are being patched within the timeframes the organization has committed to, for example critical patches within 14 days, which is precisely what a management-facing compliance dashboard needs to show for the patch management program. It ties directly to the process being audited rather than to an adjacent security function.

Go deeper

Related to this question