Security Project Execution & Monitoring Flashcards

A security project manager uses Estimate at Completion (EAC) to forecast final project cost. If the CPI is 0.90 and Budget at Completion (BAC) is $500,000, what is the EAC (assuming current performance continues)?

Answer: $555,556

EAC = BAC ÷ CPI = $500,000 ÷ 0.90 = $555,556, meaning the project is forecast to overrun budget if current cost efficiency continues.

Which communication artifact is MOST appropriate for providing an executive summary of security project health to senior leadership?

Answer: Dashboard with traffic-light status indicators

Executive dashboards use traffic-light (RAG) indicators to convey overall project health concisely, allowing senior leaders to quickly identify areas needing attention.

During the execution phase, which activity BEST demonstrates integrated change control in a security project?

Answer: Assessing the impact of a change on all project constraints before approval

Integrated change control requires assessing how a proposed change affects scope, schedule, cost, quality, risk, and resources holistically before the CCB approves or rejects it.

A security project has a To-Complete Performance Index (TCPI) of 1.25. What does this mean for the project team?

Answer: The team must be 25% more efficient than originally planned for the rest of the project

A TCPI of 1.25 means the team must achieve 125% efficiency on remaining work to meet the original budget, indicating significant cost recovery challenge.

Which monitoring control ensures that security project lessons are captured continuously rather than only at closure?

Answer: Retrospectives or lessons learned sessions held at milestone intervals

Conducting retrospectives or lessons learned sessions at milestone intervals captures insights while they are fresh and allows the team to apply improvements during the current project.

A security project's risk register shows a previously low-probability threat has increased to high probability due to a new regulatory announcement. What is the CORRECT response?

Answer: Reassess the risk, update the register, and trigger response planning for the escalated risk

When a risk's probability changes materially, the project manager must reassess its rating, update the risk register, and invoke or revise response strategies accordingly.

Which security project execution practice BEST supports continuous compliance monitoring in a cloud environment?

Answer: Automated compliance-as-code tools integrated into CI/CD pipelines

Compliance-as-code tools embedded in CI/CD pipelines continuously evaluate infrastructure and application configurations against security policies, providing real-time compliance visibility.