SSCP Security Operations and Administration Practice Question
A security administrator is selecting security metrics for the organization. Which TWO metrics are most useful for measuring the effectiveness of patching? (Select TWO)
⚠ Common exam trap
Test-takers frequently confuse 'number of security incidents' (a reactive, outcome-based metric) with a proactive patching metric, or they mistakenly think 'help desk ticket volume' reflects patching problems rather than user support load.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Average time to patch critical vulnerabilities
Option C, average time to patch critical vulnerabilities, is correct because it directly measures the speed of the remediation process, showing how quickly the organization closes exposure windows for high-risk flaws. Option E, patch compliance rate, is correct because it quantifies the percentage of systems that have the required patches applied, directly reflecting how thoroughly patching is executed across the estate. Together these two metrics capture both timeliness and coverage, which are the core dimensions of patching effectiveness. The unmarked options do not belong: help desk ticket volume (A) is a workload indicator that may be unrelated to patching, number of security incidents (B) is an outcome measure influenced by many controls beyond patching, and number of users trained (D) measures awareness activity rather than patch deployment performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Help desk ticket volume
Why it's wrong here
Help desk ticket volume reflects overall support demand and user-reported problems, not patch deployment coverage or speed. It is tempting as a proxy for disruption caused by patching, but it cannot show whether vulnerabilities were actually remediated, which is what the metric must evidence.
- ✗
Number of security incidents
Why it's wrong here
Incident counts measure overall security outcomes influenced by many controls, so they cannot isolate patching effectiveness. It is tempting because unpatched systems cause breaches, but the metric must directly evidence remediation coverage and elapsed time, which incident volume does not attribute to patching.
- ✓
Average time to patch critical vulnerabilities
Why this is correct
Average time to patch critical vulnerabilities directly quantifies remediation speed, the core objective of a patching programme. It satisfies the stem's effectiveness requirement by measuring elapsed duration from vulnerability disclosure to deployed fix, exposing process delays that raw patch counts conceal. Shorter averages indicate a responsive, well-functioning patch management capability.
- ✗
Number of users trained
Why it's wrong here
Users trained counts awareness programme coverage, which has no causal link to how quickly or completely patches are deployed across systems. It is tempting because training reduces human-triggered incidents, but patching effectiveness is measured by remediation coverage and elapsed time, not headcount reached.
- ✓
Patch compliance rate
Why this is correct
Patch compliance rate directly quantifies the proportion of systems carrying approved updates, giving a measurable percentage that reveals whether patching actually reached every endpoint. It satisfies the stem's demand for effectiveness measurement by exposing unpatched assets rather than merely counting deployed patches.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.