Security Project Execution & Monitoring Flashcards

A security project is implementing multi-factor authentication (MFA) across 5,000 endpoints. Progress monitoring reveals 30% adoption after 60% of the timeline has elapsed. What should the project manager assess first?

Answer: Schedule variance and its root cause to determine corrective action

The project manager should first calculate and analyze the schedule variance to understand the magnitude of the delay and identify root causes before selecting appropriate corrective actions.

During execution monitoring, which technique involves randomly sampling security work products to assess overall quality?

Answer: Statistical sampling

Statistical sampling selects a representative subset of deliverables for inspection, allowing quality conclusions to be drawn about the entire population without inspecting every item.

A project manager is monitoring a security awareness training rollout. Which KPI MOST directly measures the effectiveness of the training?

Answer: Phishing simulation click-rate before and after training

Phishing simulation click-rate comparison before and after training directly measures behavioral change, which is the ultimate goal of security awareness training.

What is the role of the change control board (CCB) during security project execution?

Answer: To approve or reject changes to project baselines

The CCB reviews submitted change requests and decides whether to approve, reject, or defer changes to the project's scope, schedule, cost, or quality baselines.

A security project team is behind schedule on firewall rule implementation. The project manager proposes fast-tracking. What is a key risk of this approach?

Answer: Increased rework risk due to overlapping dependent activities

Fast-tracking overlaps activities that would normally be sequential, which can increase rework risk if upstream work must change after downstream work has already begun.

Which monitoring output provides a formal record of project performance data at a specific point in time?

Answer: Work performance report

A work performance report compiles and presents work performance data and information in a structured format at a specific point in time for decision-making and communication.

During security project execution, a team member raises a concern that a newly implemented control conflicts with an existing regulatory requirement. How should this be handled?

Answer: Log it as an issue, investigate the conflict, and escalate if needed

Regulatory conflicts must be formally logged in the issue register, investigated to confirm their validity, and escalated to compliance or legal stakeholders if confirmed.