CISSP Security Assessment and Testing Practice Question
An organization is selecting security metrics to report to the board. Which THREE metrics would best demonstrate the effectiveness of the vulnerability management program?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Open vulnerability count by severity
These three metrics cover remediation speed, current risk posture, and compliance with patching policies, which are key indicators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Open vulnerability count by severity
Why this is correct
Tracking open vulnerabilities segmented by severity (critical, high, medium, low) gives the board a direct, current-state view of unremediated risk exposure. Because it's broken out by severity rather than a single aggregate number, it lets leadership see whether the highest-risk items are being prioritized correctly, and trends over time reveal whether the program is keeping pace with new findings or falling behind.
- ✗
Number of employees in IT security
Why it's wrong here
Headcount describes program capacity or investment, not program effectiveness — a team of ten people running a mature, well-tuned vulnerability management process can outperform a team of thirty using ad hoc, unmeasured processes. The board is asking whether the program is working, and staffing levels say nothing about outcomes like remediation speed or residual risk.
- ✗
Budget for security tools
Why it's wrong here
Dollar spend on tooling reflects investment, not results — an organization can license expensive scanning and patching platforms and still leave critical vulnerabilities unremediated for months if the underlying process is broken. Effectiveness metrics need to measure what the program actually achieves, such as detection coverage, remediation speed, and residual exposure, not how much was spent trying to achieve it.
- ✓
Mean time to remediate critical vulnerabilities
Why this is correct
Mean time to remediate for critical findings is one of the clearest effectiveness signals available because it directly measures the program's ability to close the highest-risk exposure windows before they're exploited. A program that finds vulnerabilities quickly but takes months to fix critical ones is still leaving the organization exposed, so remediation speed on the highest-severity findings is exactly what a board needs to see.
- ✓
Patch compliance percentage
Why this is correct
Patch compliance shows what proportion of the estate is actually up to date against known fixes, which is a direct proxy for how well the remediation half of the vulnerability management lifecycle is functioning across the whole environment, not just for individually tracked critical items. Low compliance percentages typically correlate with a growing backlog of exploitable, patchable vulnerabilities that scanning alone won't fix.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.