CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Mean time to remediate critical vulnerabilities

  Why this is correct

  This is a crucial Key Performance Indicator (KPI) because it directly measures the efficiency and effectiveness of an organization's vulnerability management program. A shorter mean time indicates a robust process for identifying, prioritizing, and mitigating the most severe security flaws, thereby reducing the window of opportunity for potential exploitation. This metric reflects the operational responsiveness to high-risk findings.

• ✓

  Patch compliance percentage

  Why this is correct

  This is a fundamental security KPI that quantifies the extent to which systems and applications adhere to required security updates and patches. A high patch compliance percentage demonstrates effective patch management processes and significantly reduces the attack surface by mitigating known vulnerabilities. It directly reflects the organization's proactive stance in maintaining a secure baseline against common exploits.

• ✗

  Number of employees trained on security awareness

  Why it's wrong here

  While security awareness training is vital for fostering a strong security culture, the *number* of employees trained is an activity metric, not a direct security performance indicator. This metric measures the *delivery* of training rather than the *effectiveness* of security controls, the reduction of human-related risk, or the overall security posture. True KPIs would measure the *impact* of training, such as a reduction in phishing click rates or reported incidents.

• ✓

  Open vulnerability count by severity

  Why this is correct

  This KPI provides a critical snapshot of an organization's current risk exposure by categorizing unaddressed security weaknesses based on their potential impact. Tracking this metric allows security teams to prioritize remediation efforts, allocate resources effectively, and communicate the residual risk to stakeholders. It is essential for understanding the ongoing security posture and identifying trends in vulnerability management.

• ✗

  Number of help desk tickets

  Why it's wrong here

  The total number of help desk tickets is primarily an operational metric for IT support, reflecting user issues and system incidents across all categories. While some tickets may be security-related, this aggregate number does not specifically measure the performance of security controls, the effectiveness of vulnerability management, or the outcomes of security testing. It lacks the specificity required to be a meaningful security KPI.

Go deeper

Related to this question