350-201 Question 33
Select 3An organization is reviewing its incident response metrics to improve its overall security posture. Which of the following metrics are most effective for identifying areas of improvement in the incident response process?
- A
Mean Time to Detect (MTTD)
- B
Mean Time to Respond (MTTR)
- C
Number of incidents handled per month
- D
Percentage of false positives in alerts
- E
Employee satisfaction rate during incident handling
Show answer and explanation
Correct answers: A, B, D
Explanation
MTTD, MTTR, and false positive rates are critical incident response metrics that directly impact the speed, accuracy, and efficiency of handling security incidents. Monitoring and improving these metrics helps organizations optimize their detection and response processes to reduce risk and improve security posture.
- A. Correct.
MTTD measures the time it takes to identify a security incident. A high MTTD may indicate gaps in monitoring or detection capabilities, making it a critical metric for identifying improvement areas.
- B. Correct.
MTTR measures the time taken to contain and resolve an incident. A longer MTTR signals inefficiencies in the incident response process, making it a key metric for improvement.
- C. Incorrect.
While the number of incidents handled per month provides a general overview of workload, it does not directly indicate performance or areas for improvement in the incident response process.
- D. Correct.
The percentage of false positives in alerts is critical, as a high false-positive rate may overwhelm analysts and reduce efficiency. Addressing this can improve the overall incident response process.
- E. Incorrect.
Employee satisfaction rate during incident handling is not a standard metric for assessing incident response effectiveness or identifying specific areas of improvement.