CSPM Security Project Execution & Monitoring 5 — Questions and Answers
Question 1: A security project manager uses Estimate at Completion (EAC) to forecast final project cost. If the CPI is 0.90 and Budget at Completion (BAC) is $500,000, what is the EAC (assuming current performance continues)?
- $450,000
- $555,556 (Correct answer)
- $500,000
- $510,000
Correct answer: $555,556
EAC = BAC ÷ CPI = $500,000 ÷ 0.90 = $555,556, meaning the project is forecast to overrun budget if current cost efficiency continues.
Question 2: Which communication artifact is MOST appropriate for providing an executive summary of security project health to senior leadership?
- Detailed issue log
- Dashboard with traffic-light status indicators (Correct answer)
- Complete risk register
- Work breakdown structure
Correct answer: Dashboard with traffic-light status indicators
Executive dashboards use traffic-light (RAG) indicators to convey overall project health concisely, allowing senior leaders to quickly identify areas needing attention.
Question 3: During the execution phase, which activity BEST demonstrates integrated change control in a security project?
- Updating the WBS independently for each change
- Assessing the impact of a change on all project constraints before approval (Correct answer)
- Implementing changes immediately to save time
- Delegating change decisions to individual team members
Correct answer: Assessing the impact of a change on all project constraints before approval
Integrated change control requires assessing how a proposed change affects scope, schedule, cost, quality, risk, and resources holistically before the CCB approves or rejects it.
Question 4: A security project has a To-Complete Performance Index (TCPI) of 1.25. What does this mean for the project team?
- The team must be 25% more efficient than originally planned for the rest of the project (Correct answer)
- The project is 25% under budget and on track
- The team can slow down as they have budget surplus
- The project will finish 25% early
Correct answer: The team must be 25% more efficient than originally planned for the rest of the project
A TCPI of 1.25 means the team must achieve 125% efficiency on remaining work to meet the original budget, indicating significant cost recovery challenge.
Question 5: Which monitoring control ensures that security project lessons are captured continuously rather than only at closure?
- Retrospectives or lessons learned sessions held at milestone intervals (Correct answer)
- A single post-project debrief report
- The project charter review
- Monthly steering committee meetings
Correct answer: Retrospectives or lessons learned sessions held at milestone intervals
Conducting retrospectives or lessons learned sessions at milestone intervals captures insights while they are fresh and allows the team to apply improvements during the current project.
Question 6: A security project's risk register shows a previously low-probability threat has increased to high probability due to a new regulatory announcement. What is the CORRECT response?
- Remove the risk as it is now a certainty
- Reassess the risk, update the register, and trigger response planning for the escalated risk (Correct answer)
- Wait until the regulation is published before acting
- Transfer the risk to a different project
Correct answer: Reassess the risk, update the register, and trigger response planning for the escalated risk
When a risk's probability changes materially, the project manager must reassess its rating, update the risk register, and invoke or revise response strategies accordingly.
Question 7: Which security project execution practice BEST supports continuous compliance monitoring in a cloud environment?
- Annual manual compliance audits
- Automated compliance-as-code tools integrated into CI/CD pipelines (Correct answer)
- Quarterly stakeholder compliance reviews
- Storing compliance evidence in spreadsheets
Correct answer: Automated compliance-as-code tools integrated into CI/CD pipelines
Compliance-as-code tools embedded in CI/CD pipelines continuously evaluate infrastructure and application configurations against security policies, providing real-time compliance visibility.
CSPM Security Project Execution & Monitoring 5
A security project manager uses Estimate at Completion (EAC) to forecast final project cost.
If the CPI is 0.90 and Budget at Completion (BAC) is $500,000, what is the EAC (assuming current performance continues)?