Courseiva

CCNA Operationalizing Security Metrics Questions

19 of 94 questions · Page 2/2 · Operationalizing Security Metrics topic · Answers revealed

Practice these questionsExam hubAll questions
76
MCQmedium

A security operations team is using Cortex XSIAM to track the 'Mean Time to Detect' (MTTD) metric for endpoint alerts. The team defines MTTD as the time between the initial malicious activity on an endpoint and the creation of an alert in Cortex XSIAM. The architect needs to ensure that the metric is calculated consistently across all endpoint alerts. Which Cortex XSIAM data source should the architect use to obtain the timestamp of the initial malicious activity?

A.The 'Incident Start Time' field in the Cortex XSIAM incidents table.
B.The 'First Seen' timestamp of the endpoint in the asset inventory.
C.The 'Event Timestamp' from the Cortex XSIAM endpoint data sources, such as the EDR telemetry or the endpoint agent logs.
D.The 'Alert Creation Time' field in the Cortex XSIAM alerts table.
AnswerC

Cortex XSIAM ingests endpoint telemetry that includes event timestamps reflecting when activities occurred on the endpoint. The earliest relevant event timestamp for the malicious activity provides the starting point for MTTD. This data is available in the endpoint data sources and can be correlated with alert creation time to compute the true detection latency.

Why this answer

Accurate MTTD calculation requires the timestamp of the initial malicious activity, which is captured in endpoint telemetry events ingested by Cortex XSIAM. The 'Event Timestamp' from EDR or endpoint logs provides this ground truth. Correlating it with the alert creation time yields the true detection latency, ensuring consistent measurement across all endpoint alerts.

Exam trap

The trap here is using the alert creation time as the start of the detection window, which measures the wrong interval and ignores when the malicious activity actually began.

Practice this question →
77
MCQeasy

An architect is setting up a dashboard in Cortex XSIAM to monitor the overall health of the security operations program. The CISO wants a single metric that reflects the proportion of security incidents that were resolved within the agreed service level agreement (SLA). Which metric should be displayed?

A.Analyst Utilization
B.Mean Time to Resolve (MTTR)
C.SLA Compliance Rate
D.Incident Backlog
AnswerC

SLA Compliance Rate measures the percentage of incidents resolved within the defined SLA timeframe. It is a direct indicator of whether the SOC is meeting its service commitments. In Cortex XSIAM, this metric is calculated by comparing incident resolution times against SLA thresholds, providing a clear, single view of operational performance against contractual obligations.

Why this answer

SLA Compliance Rate is the only metric that directly reports the percentage of incidents resolved within the agreed SLA. It provides a clear, quantitative measure of adherence to service levels, which is exactly what the CISO needs to assess operational health against commitments. Other metrics like MTTR or backlog do not express compliance as a proportion.

Exam trap

The trap here is assuming that average resolution time (MTTR) equates to SLA compliance, when in fact averages can hide outliers and do not show the proportion of incidents meeting the SLA.

Practice this question →
78
MCQhard

While establishing baselines for Cortex XDR alert volume to detect operational anomalies, you notice a massive seasonal spike in alerts that threatens to invalidate your baseline threshold. What is the best practice approach to handle this seasonality in security metrics?

A.Permanently increase the global alert severity threshold to ignore all alerts during the seasonal window.
B.Replace all quantitative alert metrics with qualitative analyst feedback scores.
C.Disable automated alert generation in Cortex XDR until the seasonal window concludes.
D.Segment historical data and apply contextual rolling baselines that account for expected cyclical business variations.
AnswerD

Segmenting historical data and applying contextual rolling baselines isolates cyclical peaks so seasonal spikes do not distort anomaly thresholds. This satisfies the seasonality constraint by modelling expected business cycles, keeping detection sensitive to genuine deviations rather than predictable volume increases.

Why this answer

When establishing baselines for security operations, cyclical or seasonal variations must be accounted for using rolling or adjusted seasonal baselines to prevent alert fatigue or masking real anomalies.

Practice this question →
79
MCQmedium

Your SOC leadership team needs to measure the operational efficiency of incident containment. Which metric should you track within Cortex XSOAR to evaluate how quickly analysts isolate compromised endpoints?

A.False Alarm Percentage
B.Mean Time to Detect (MTTD)
C.Mean Time to Contain (MTTC)
D.Alert Escalation Ratio
AnswerC

Mean Time to Contain directly measures the elapsed duration from incident detection to endpoint isolation, matching the requirement to quantify containment speed. Unlike Mean Time to Detect or Mean Time to Respond, MTTC stops at containment completion, so it isolates analyst efficiency at the isolation step within Cortex XSOAR.

Why this answer

Mean Time to Contain (MTTC) measures the average time from incident detection to containment — i.e., how quickly analysts isolate compromised endpoints. This directly reflects operational efficiency of containment actions within Cortex XSOAR. MTTC is the metric SOC leadership uses to evaluate containment speed.

Exam trap

The trap is confusing detection metrics (MTTD) with containment metrics (MTTC); the question specifically asks about isolating compromised endpoints, which is containment, not detection.

How to eliminate wrong answers

Option A is wrong because False Alarm Percentage measures the proportion of alerts that are false positives, which reflects detection quality/tuning, not containment speed. Option B is wrong because Mean Time to Detect (MTTD) measures how long it takes to detect an incident, which is a detection metric, not a containment metric. Option D is wrong because Alert Escalation Ratio measures how often alerts are escalated versus handled at lower tiers, which speaks to triage/workflow, not the speed of isolating endpoints.

Practice this question →
80
MCQhard

An architect is defining a Service Level Objective (SLO) for the SOC using Cortex XSIAM. The SLO states that 95% of high-severity incidents must be resolved within 4 hours of creation. The architect needs to create a metric that measures compliance with this SLO over a rolling 30-day window. Which Cortex XSIAM feature should the architect use to automatically calculate and alert on SLO compliance?

A.Configure a correlation rule that evaluates incident resolution times in real time and generates an alert when an incident exceeds 4 hours.
B.Use the built-in 'SLO Compliance' dashboard widget that automatically tracks all SLOs defined in the system.
C.Leverage the 'Incident SLA' field that is automatically populated by Cortex XSIAM based on severity and resolution time.
D.Create a scheduled XQL query that runs daily, calculates the percentage of high-severity incidents resolved within 4 hours over the past 30 days, and triggers a webhook if below 95%.
AnswerD

Cortex XSIAM supports scheduled XQL queries that can aggregate incident data over a rolling window. By writing a query that filters high-severity incidents, computes resolution times, and calculates the compliance percentage, the architect can automate SLO monitoring. A webhook can notify stakeholders if the threshold is breached, providing timely alerts without manual intervention.

Why this answer

A scheduled XQL query is the most flexible and accurate way to compute rolling SLO compliance in Cortex XSIAM. It can aggregate incident data, apply the 95% threshold, and trigger notifications via webhook. This approach leverages native query capabilities and automation, ensuring the metric is consistently updated and actionable without relying on non-existent built-in widgets.

Exam trap

The trap here is assuming Cortex XSIAM has a built-in SLO compliance widget, when in fact custom XQL queries are required for bespoke SLO metrics.

Practice this question →
81
Multi-Selecthard

An architect is designing a metrics program for a Cortex XSIAM deployment and wants to ensure that reported security metrics drive continuous improvement rather than merely describe past activity. The SOC director requires that each metric be tied to a decision or action. Which TWO characteristics must the architect build into the metric definitions to satisfy this requirement? (Choose two.)

Select 2 answers
A.Each metric is stored in a separate dedicated dataset to simplify long-term retention
B.Each metric has an explicit target or threshold that triggers a defined response when breached
C.Each metric is reported with the highest possible decimal precision to avoid rounding ambiguity
D.Each metric is reviewed only once per year during the annual audit cycle
E.Each metric has a named owner accountable for investigating deviations and initiating corrective action
AnswersB, E

A target or threshold converts a passive measurement into a decision trigger. When the metric crosses the boundary, the team knows exactly which action to take, such as retuning a detection rule or reallocating analysts. Without this, the metric is merely descriptive. Building thresholds and linked responses into the definition ensures every reported number has an operational consequence, which is what the director demands.

Why this answer

Metrics drive improvement only when they are connected to decisions. An explicit target or threshold defines when action is needed, and a named owner ensures that action actually occurs. Together they turn a measurement into an operational feedback loop.

Precision, dedicated storage, and annual-only review do not create that linkage, so they cannot satisfy the requirement that each metric be tied to a decision or action.

Exam trap

The trap here is equating measurement rigor, such as extra precision or isolated storage, with actionability, when only a threshold and an accountable owner actually cause a decision to be made.

Practice this question →
82
MCQeasy

What is the primary objective of establishing a baseline for Mean Time to Resolution (MTTR) in security operations?

A.To provision cloud storage capacity in Cortex Data Lake
B.To determine firewall rule redundancy across Panorama devices
C.To automatically lock out user accounts that take too long to respond
D.To measure improvements in incident response speed and evaluate the impact of optimizations over time
AnswerD

Baselining MTTR establishes a quantitative reference point, enabling security operations to measure whether response-time improvements actually occur after process or tooling changes. This satisfies the stem's objective of evaluating optimisation impact over time rather than merely tracking incidents.

Why this answer

Establishing an MTTR baseline provides a measurable reference point to track improvements in incident response speed over time. It allows security operations teams to quantify the impact of process changes, automation, and tooling investments. Without a baseline, you cannot objectively demonstrate whether response times are improving or degrading.

Exam trap

SecOps-Architect often tests whether candidates confuse MTTR as a measurement baseline with operational actions like account lockout or storage provisioning — the key is recognizing it as a performance benchmark.

How to eliminate wrong answers

Option A is wrong because MTTR baselines have nothing to do with provisioning Cortex Data Lake storage capacity. Option B is wrong because firewall rule redundancy analysis is a network security task unrelated to incident response metrics. Option C is wrong because MTTR is a measurement metric, not an automated account lockout mechanism; locking accounts is a policy action, not a baseline objective.

Practice this question →
83
Multi-Selectmedium

An architect is operationalizing security metrics for a Cortex XSIAM deployment. The SOC manager wants to track the 'Alert Triage Efficiency' metric, defined as the average time from alert creation to analyst assignment. The architect needs to ensure the metric is accurate and actionable. Which two data points must be captured and correlated to calculate this metric correctly? (Choose two.)

Select 2 answers
A.The timestamp when an analyst is assigned to the alert or incident.
B.The number of automated playbook executions triggered by the alert.
C.The timestamp when the alert was created in Cortex XSIAM.
D.The MITRE ATT&CK tactic associated with the alert.
E.The severity level of the alert as determined by the analytics engine.
AnswersA, C

The assignment timestamp indicates when an analyst took ownership, ending the triage efficiency interval. Cortex XSIAM captures this when an owner is set on the alert or incident. Correlating it with the creation timestamp yields the average time to assignment, directly reflecting triage responsiveness.

Why this answer

To calculate the average time from alert creation to analyst assignment, the architect must capture both the alert creation timestamp and the assignment timestamp. These two data points define the interval. Cortex XSIAM records both events natively, allowing correlation and aggregation.

Other attributes like severity or MITRE tactic are useful for filtering but not for the core calculation.

Exam trap

The trap here is including contextual attributes like severity or MITRE tactic as necessary data points, when only the two timestamps define the metric's interval.

Practice this question →
84
MCQhard

A multinational corporation uses Cortex XSIAM across three geographically dispersed SOCs. The security leadership wants to measure the consistency of incident triage across regions to identify process drift. Which metric best captures the uniformity of triage decisions, such as severity assignment and escalation, across all SOCs?

A.Alert Volume per Analyst
B.False Positive Rate
C.Mean Time to Resolution (MTTR)
D.Triage Consistency Score
AnswerD

Triage Consistency Score is a composite metric that quantifies how uniformly analysts across different SOCs apply triage rules, such as severity assignment and escalation. It can be calculated from Cortex XSIAM incident data by comparing decisions on similar alerts, revealing process drift. This directly addresses the need to measure uniformity across regions.

Why this answer

Triage Consistency Score directly measures how uniformly triage decisions are made across different SOCs. By analyzing Cortex XSIAM incident data, such as severity and escalation choices on comparable alerts, this metric highlights process drift. It provides actionable insight for standardizing triage procedures across regions, which is the core requirement.

Exam trap

The trap here is assuming that speed or workload metrics reflect process consistency, when in fact consistency requires comparing decision patterns on similar incidents.

Practice this question →
85
MCQhard

An organization is reporting on 'Dwell Time' as a core security posture metric using Cortex XSIAM. If Dwell Time is defined as the duration from initial compromise to containment, which data sources must be successfully correlated to calculate this metric accurately?

A.Initial endpoint intrusion telemetry/alerts and final incident response containment timestamps
B.Firewall active session logs and DNS query volume statistics alone
C.WildFire file upload quotas and automated sandbox verdict latency
D.Cortex XDR agent heartbeat intervals and operating system patch levels
AnswerA

Dwell Time spans compromise to containment, so Cortex XSIAM must correlate the initial endpoint intrusion telemetry or alert that marks compromise with the incident response containment timestamp. Without both correlated, the elapsed duration cannot be calculated, satisfying the stem's definition.

Why this answer

Dwell Time is calculated as the delta between the moment of initial compromise and the moment containment is achieved. In Cortex XSIAM, this requires correlating endpoint intrusion telemetry or the earliest alert indicating the initial access vector with the incident response containment timestamp recorded when the incident is closed or the host is isolated. Without both endpoints of that timeline, the metric cannot be derived.

Exam trap

The trap here is confusing telemetry volume metrics (DNS, firewall, WildFire) with lifecycle timestamps — candidates must recognize that dwell time requires two specific temporal anchors, not general activity data.

How to eliminate wrong answers

Option B is wrong because firewall session logs and DNS query volume are network telemetry that may indicate activity but do not establish the initial compromise timestamp or the containment event. Option C is wrong because WildFire upload quotas and sandbox verdict latency are malware analysis pipeline metrics, not incident lifecycle timestamps. Option D is wrong because agent heartbeat intervals and OS patch levels are endpoint health/compliance data unrelated to the compromise-to-containment duration.

Practice this question →
86
MCQhard

A security operations architect is building a metrics dashboard in Cortex XSIAM to track the SOC's incident response performance. The dashboard must show, for each severity level, the percentage of incidents that met their defined response SLA. Which Cortex XSIAM capability should the architect use to calculate and display SLA compliance by severity?

A.Enable the built-in SLA widget in the Cortex XSIAM console.
B.Configure a playbook that calculates SLA compliance and writes the result to an incident field.
C.Create a correlation rule that triggers when an incident exceeds its SLA.
D.Use XQL queries to aggregate incident durations and compare them to SLA targets, then visualize the results in a dashboard widget.
AnswerD

XQL queries can aggregate incident data, calculate durations, compare them to severity-specific SLA targets, and compute compliance percentages. The results can be rendered in dashboard widgets that update over time. This directly meets the requirement to show SLA compliance by severity, giving the architect full control over definitions and presentation within Cortex XSIAM.

Why this answer

XQL queries provide the flexibility to aggregate incident durations, apply severity-specific SLA targets, and compute compliance percentages that can be visualized in dashboard widgets. This approach gives the architect control over definitions and ensures the dashboard reflects the SOC's actual SLA structure, unlike rules, playbooks, or generic widgets that do not aggregate by severity.

Exam trap

The trap here is assuming a prebuilt SLA widget or a correlation rule can automatically produce severity-specific compliance percentages, when they either lack aggregation or do not apply the SOC's custom severity targets.

Practice this question →
87
Multi-Selectmedium

Which TWO actions should an architect take when presenting security metrics to management to ensure credibility and actionable decision-making? (Choose two)

Select 2 answers
A.Provide contextual trend analysis and comparisons against historical baselines rather than raw isolated numbers
B.Align technical security metrics with business risk and operational impact
C.Present raw, unparsed log strings directly without summarization
D.Hide all negative performance metrics to avoid difficult conversations
E.Change baseline definitions weekly so targets are always artificially met
AnswersA, B

Contextual trend analysis and historical baselines transform raw metrics into meaningful signals, showing whether security posture is improving or degrading. This satisfies the credibility requirement by grounding figures in comparison, enabling management to make informed decisions rather than reacting to isolated numbers.

Why this answer

Option A is correct because presenting security metrics with contextual trend analysis and comparisons against historical baselines transforms isolated data points into meaningful patterns that management can interpret, enabling them to see whether risk is increasing or decreasing over time. Option B is correct because aligning technical security metrics with business risk and operational impact ensures that management understands how security posture translates into financial, regulatory, and operational consequences, which is essential for actionable decision-making and prioritization. Option C is incorrect because raw, unparsed log strings lack the summarization and interpretation needed for executive-level decision-making and would obscure rather than clarify the security posture.

Option D is incorrect because hiding negative performance metrics undermines credibility and transparency, preventing management from making informed risk decisions. Option E is incorrect because changing baseline definitions weekly to artificially meet targets is a manipulative practice that destroys the credibility and integrity of the metrics program.

Practice this question →
88
MCQmedium

An architect is establishing security operations baseline metrics in Cortex XSIAM. The team wants to measure the percentage of alerts that are determined to be actionable threats versus benign noise. Which metric should be configured?

A.Alert Volume Growth Rate
B.Analyst Utilization Rate
C.Incident Escalation Rate
D.Signal-to-Noise Ratio (or True Positive Rate)
AnswerD

Signal-to-Noise Ratio measures the proportion of alerts that resolve to genuine actionable threats against benign false positives, directly satisfying the stem's requirement to quantify actionable threats versus noise. It exposes analyst tuning gaps that raw alert volume or mean time to respond would obscure.

Why this answer

The signal-to-noise ratio, also expressed as the true positive rate, directly measures the proportion of alerts that represent genuine actionable threats versus benign false positives. This is exactly the metric the team needs to quantify how much of the alert stream is meaningful. Configuring it in Cortex XSIAM lets the SOC track detection quality and tuning effectiveness over time.

Exam trap

SecOps-Architect often tests the confusion between volume-based metrics (alert counts, growth rates) and quality-based metrics (signal-to-noise, true positive rate), tempting candidates to pick a metric that sounds operational but does not measure actionability.

How to eliminate wrong answers

Option A is wrong because alert volume growth rate measures how quickly the number of alerts is increasing or decreasing, which says nothing about whether those alerts are true threats or noise. Option B is wrong because analyst utilization rate measures how busy analysts are, a staffing efficiency metric, not a measure of alert quality or actionability. Option C is wrong because incident escalation rate tracks how often alerts are escalated to incidents, which reflects process flow rather than the ratio of actionable threats to benign noise.

Practice this question →
89
MCQhard

A security operations architect is establishing a metrics framework in Cortex XSIAM to measure the efficiency of the incident triage process. The SOC manager wants to know the average time it takes for an analyst to acknowledge an incident after it is created. Which metric should the architect implement?

A.Mean Time to Resolve (MTTR)
B.Incident Dwell Time
C.Mean Time to Acknowledge (MTTA)
D.Mean Time to Detect (MTTD)
AnswerC

MTTA measures the average time between incident creation and analyst acknowledgment, directly answering the SOC manager's question about triage efficiency. It highlights how quickly analysts pick up new incidents, which is critical for reducing response delays and improving overall SOC performance.

Why this answer

The SOC manager wants the average time from incident creation to analyst acknowledgment, which is precisely Mean Time to Acknowledge (MTTA). MTTR covers the full resolution cycle, MTTD measures detection speed, and Dwell Time measures attacker presence; none isolate the acknowledgment step. MTTA is the correct metric for triage efficiency.

Exam trap

The trap here is confusing MTTA with MTTR, assuming that resolution time includes acknowledgment, or misapplying detection-centric metrics to triage.

Practice this question →
90
MCQmedium

A security operations team uses Cortex XSIAM and Cortex XSOAR. The SOC manager wants to measure how well the team is utilizing automation to reduce manual effort. The manager asks the architect to define a metric that quantifies the proportion of incident response actions that were executed automatically versus manually. Which metric should the architect recommend?

A.Mean Time to Detect (MTTD)
B.Alert Volume Trend
C.Automation Coverage Ratio
D.False Positive Rate (FPR)
AnswerC

Automation Coverage Ratio measures the percentage of response actions performed by automated playbooks relative to total actions. It directly reflects how much manual effort is offloaded to automation, which is exactly what the SOC manager wants to quantify. This metric can be derived from Cortex XSOAR playbook execution logs and Cortex XSIAM automation statistics, providing a clear picture of automation adoption.

Why this answer

Automation Coverage Ratio directly quantifies the share of response actions executed automatically, which is the core of the manager's request. MTTD, Alert Volume Trend, and FPR are valuable but focus on detection speed, workload volume, and detection accuracy respectively, not on the balance between manual and automated response. Thus, Automation Coverage Ratio is the only metric that answers how well automation reduces manual effort.

Exam trap

The trap here is confusing general SOC efficiency metrics like MTTD or FPR with a metric specifically designed to measure automation adoption.

Practice this question →
91
MCQhard

An architect is designing a metric to measure the 'Automation Coverage' of incident response in Cortex XSOAR. The metric is defined as the percentage of incidents that were fully resolved by automated playbooks without human intervention. The architect notices that some incidents are closed by playbooks but still require manual approval steps. The organization wants the metric to exclude incidents that required any human approval, even if the playbook completed the remediation. Which Cortex XSOAR feature should the architect use to accurately identify incidents that were fully automated?

A.Filter incidents by the 'Playbook Run Status' field set to 'Completed' and assume all such incidents are fully automated.
B.Use the 'Manual Intervention' flag that is automatically set when an analyst interacts with a playbook task.
C.Query the incident's playbook execution log for tasks of type 'Manual Approval' or 'Manual Task' and exclude incidents where any such task was completed by a user.
D.Configure a custom incident field that is set to 'true' only if no analyst logs into the Cortex XSOAR UI during the incident's lifetime.
AnswerC

Cortex XSOAR records every playbook task execution, including manual approval and manual task types. By querying the execution log for tasks where the assignee was a user and the task type indicates human interaction, you can accurately identify incidents that required human approval. Excluding those incidents yields a precise measure of fully automated resolutions.

Why this answer

To accurately measure fully automated incident resolution, the architect must inspect the playbook execution log for manual approval or manual task completions by users. This data is natively captured in Cortex XSOAR and provides an auditable trail of human intervention. Excluding incidents with any such tasks ensures the automation coverage metric reflects only those resolved end-to-end without human input.

Exam trap

The trap here is equating a 'Completed' playbook status with full automation, overlooking that manual approval steps can still be part of a completed playbook run.

Practice this question →
92
MCQhard

A security operations team tracks mean time to detect (MTTD) in Cortex XSIAM. Leadership notices MTTD improved sharply after the team enabled additional low-severity correlation rules, even though no detection engineering work changed. The architect must explain why the metric moved and how to keep it trustworthy. What is the most accurate explanation?

A.MTTD improvement indicates the SOC's triage capacity increased, so the team should raise severity thresholds to preserve the gain.
B.Cortex XSIAM recalculates historical MTTD when new rules are enabled, so the improvement is a backfill artifact that should be ignored entirely.
C.MTTD is measured from the first alert of any severity, so adding low-severity rules shifts the start timestamp earlier; the team should measure from the first high-severity or confirmed alert.
D.Low-severity rules generate alerts earlier in the attack chain, so MTTD genuinely improves and no adjustment is needed.
AnswerC

If the clock starts at any alert, adding noisy low-severity rules mechanically pulls the start earlier without improving real detection. Anchoring the start to the first high-severity or later-confirmed alert keeps the metric tied to meaningful compromise signals. This explains the observed shift and gives a defensible correction that preserves comparability across reporting periods.

Why this answer

When MTTD starts at the first alert regardless of severity, adding low-severity correlation rules mechanically moves the start timestamp earlier and improves the number without better detection. Anchoring the measurement to the first high-severity or confirmed alert keeps the KPI tied to meaningful compromise signals and preserves comparability across periods.

Exam trap

The trap here is accepting an MTTD improvement at face value when the measurement anchor allows any alert, including noisy low-severity ones, to start the clock.

Practice this question →
93
MCQhard

Your organization has implemented a comprehensive metric reporting framework in Cortex XSIAM. However, analysts are complaining that leadership is weaponizing the 'Mean Time to Resolve' (MTTR) metric to rush investigations, leading to superficial incident closures and recurring security issues. As a SecOps Architect, how should you address this metric dysfunction?

A.Double the MTTR target time across all severity levels to give analysts more breathing room.
B.Abolish all metrics entirely and rely solely on subjective management intuition.
C.Pair MTTR with quality and accuracy metrics such as Incident Reopen Rate and False Negative Discovery Rate to balance speed with thoroughness.
D.Automate all incident closures so analysts no longer have to record resolution times.
AnswerC

Pairing MTTR with Incident Reopen Rate and False Negative Discovery Rate counteracts the rush to close tickets superficially, because those quality metrics expose incidents reopened or missed after closure, forcing balance between speed and thoroughness.

Why this answer

When MTTR is used in isolation, analysts may cut corners to lower their times. Best practice requires pairing speed metrics (MTTR) with quality metrics, such as Reopen Rate or Recurrence Rate, to ensure thoroughness.

Practice this question →
94
Multi-Selectmedium

An architect is establishing baselines for Security Operations Center (SOC) performance metrics. Which THREE operational factors must be accounted for to ensure the baseline accurately reflects normal operating conditions? (Choose three)

Select 3 answers
A.Analyst shift schedules and staffing level variations
B.Office interior wall paint colors
C.Changes in enterprise asset inventory and attack surface scope
D.The brand of coffee consumed in the SOC breakroom
E.Seasonal business cycles and holiday operational slowdowns
AnswersA, C, E

Analyst availability directly determines how many alerts can be triaged per hour. Baselines must therefore model shift patterns, handover gaps, weekend coverage and headcount changes, otherwise normal staffing dips are misread as degraded SOC performance.

Why this answer

Option A is correct because SOC baselines must account for analyst shift schedules and staffing level variations, since detection, triage, and response throughput naturally dips during nights, weekends, and handoff periods, and ignoring these would skew metrics such as mean time to detect (MTTD) and mean time to respond (MTTR). Option C is correct because changes in enterprise asset inventory and attack surface scope directly alter alert volume and workload; onboarding new endpoints, cloud workloads, or external-facing services increases telemetry and incidents, so the baseline must be normalized to the monitored estate. Option E is correct because seasonal business cycles and holiday operational slowdowns change both attacker activity and internal user/change activity, producing predictable shifts in alert counts and response times that must be modeled rather than treated as anomalies.

Option B is not relevant because office interior wall paint colors have no measurable effect on SOC telemetry, alert generation, or analyst performance. Option D is not relevant because the brand of coffee in the breakroom is a morale or comfort factor, not an operational variable that influences security monitoring metrics.

Practice this question →
← PreviousPage 2 of 2 · 94 questions total

Ready to test yourself?

Try a timed practice session using only Operationalizing Security Metrics questions.

Start 20-question session