Quiz: Security Metrics, Measurement, and Reporting to the Board
A 26-question self-check covering metric selection, MTTD/MTTR/coverage, maturity models, and board reporting. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP — so certification candidates can self-assess. Answers and one-line explanations are at the end; try the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] A measurement that looks impressive but supports no decision — typically unbounded and lacking a denominator — is best called a: A. key risk indicator B. vanity metric C. benchmark D. maturity score
2. "Mean time to detect" measures the elapsed time from: A. detection to containment B. the incident's start to its detection C. ticket open to ticket close D. alert to acknowledgement
3. [Sec+] "Mean time to respond" most commonly measures from: A. incident start to detection B. detection to resolution/containment C. patch release to patch deploy D. board meeting to board meeting
4. Control coverage is most honest only when you can trust the: A. numerator B. vendor C. denominator (total in-scope items) D. color of the dashboard
5. [CISSP] A metric that measures how much risk the organization is currently carrying, as an early-warning signal, is a: A. KPI B. KRI C. SLA D. SLO
6. Which is the best reason to report the median detection time alongside the mean? A. medians are always lower B. a single slow outlier can distort the mean C. boards prefer medians D. it doubles the number of metrics
7. [Sec+] On a five-level maturity scale, a process that is documented, standardized, and applied consistently across the organization is at which level? A. Initial B. Repeatable C. Defined D. Optimized
8. The four questions a board metrics pack should answer are best summarized as: A. who, what, when, where B. are we exposed / improving / spending well / how do we compare C. confidentiality, integrity, availability, accountability D. people, process, technology, tools
9. "We blocked 2.4 million attacks this quarter" fails as a board metric primarily because it is: A. false B. too small C. unbounded activity with no denominator or outcome D. classified
10. [CISSP] A board approves a risk appetite. For a metric to be meaningful to that board, it should ideally be presented: A. as a raw count B. against the appetite threshold and as a trend C. in packets per second D. without comparison, to avoid bias
11. Optimizing a single metric until it stops reflecting reality (e.g., closing tickets early to cut MTTR) is an instance of: A. defense in depth B. Goodhart's law / metric gaming C. least privilege D. the CIA triad
12. [Sec+] Which belongs on an operational dashboard rather than a board deck? A. risk vs. appetite B. program maturity trend C. SIEM rule false-positive rate D. major-incident business impact
13. A risk burn-down chart is most useful for showing a board: A. how many alerts fired B. quantified risk declining over time toward appetite C. the org chart D. firewall throughput
14. The relationship between executive and operational metrics is best described as: A. they are unrelated B. executive metrics aggregate and abstract operational ones C. operational metrics replace executive ones D. only operational metrics are real
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
15. "More SIEM alerts always means better detection."
16. [Sec+] "A coverage metric of 100% MFA on admin accounts means there is no remaining identity risk."
17. "Because boards are non-technical, the CISO should avoid all numbers and speak only in generalities."
18. "Reporting a failing (amber) metric to the board damages the CISO's credibility more than hiding it would."
19. "A maturity score is a precise measurement, so reporting it to two decimal places (e.g., 2.47) is appropriate."
20. "MTTD should be measured from the attacker's true first action, even though that time is usually reconstructed after the fact."
Section 3 — Fill in the blank (1 pt each)
21. A _ metric measures how well a process performs; a _ metric signals how much risk the organization is carrying.
22. MTTD + MTTR for an incident together describe the attacker's total _ of _ — from first action to contained.
23. [Sec+] A reference value (peer average, prior period, regulatory threshold) used to give a metric meaning by comparison is a __.
Section 4 — Short answer (2 pts each)
24. [CISSP] A board metrics pack should answer four questions. List them, and for each name one metric or visual from the chapter that answers it.
25. Compute and interpret: three incidents have detection intervals of 1, 3, and 14 hours. Give the MTTD and the median, and explain in one sentence which you would lead a board slide with and why.
Section 5 — Applied scenario (5 pts)
26. Dana is building Meridian's first board scorecard. (a) Name three metrics you would put on the one-screen executive view and the board question each answers. (b) For one of them, explain how it "rolls up" from an operational metric the SOC produces. (c) Identify one honest "watch" item you would include and explain why including bad news strengthens rather than weakens the deck. (d) Give one metric you would deliberately leave off the board view and say why.