CS0-003 Incident Response and Management Practice Question
During post-incident activities, the security team reviews metrics. Which metric measures the average time taken to detect an incident?
⚠ Common exam trap
CS0-004 often tests the family of incident metrics (MTTD, MTTA, MTTR, RTO, RPO) — the trap is confusing 'detect' with 'respond' or 'recover', so candidates pick MTTR when the question explicitly says detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MTTD
MTTD (Mean Time to Detect) is the metric that measures the average time between when an incident actually occurs and when it is detected by the security team. It is a core SOC effectiveness metric used in post-incident reviews to evaluate detection capability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MTTR
Why it's wrong here
Mean Time to Respond (or Recover) measures the average duration required for a security team to contain, mitigate, or fully remediate a security incident once it has been identified. While this is a critical post-incident metric for assessing operational efficiency, it does not measure the initial detection phase of the incident lifecycle.
- ✗
SLA
Why it's wrong here
A Service Level Agreement is a formal, contractually binding commitment between a service provider and a client that defines expected performance standards and uptime. It is an overall framework or policy document rather than an individual, granular technical metric used to calculate the speed of threat detection during post-incident analysis.
- ✗
RTO
Why it's wrong here
Recovery Time Objective is a business continuity metric that defines the maximum acceptable duration of downtime for systems or applications before significant damage occurs. It serves as a target threshold for disaster recovery planning rather than a retrospective performance metric that measures how quickly security analysts identified an active threat.
- ✓
MTTD
Why this is correct
Mean Time to Detect is the primary security metric used to calculate the average elapsed time between the initial occurrence of a security compromise and its formal identification by security tools or analysts. Reviewing MTTD during post-incident activities helps organizations evaluate the effectiveness of their monitoring controls, SIEM correlation rules, and threat hunting capabilities.
Go deeper
Related to this question
Learn chapter
Critical Windows Event IDs for Security
Key term
SOC
A Security Operations Center (SOC) is a centralized team that monitors, detects, analyzes, and responds to cybersecurity incidents to protect an organization's information systems.
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.