Assessment & Evaluation Methods Flashcards

Which metric best measures the effectiveness of a patch management program over time?

Answer: Mean time to patch (MTTP) critical vulnerabilities

Mean time to patch measures how quickly the organization remediates known vulnerabilities, directly reflecting patch management effectiveness.

During a system audit, you discover that log retention is set to 30 days but policy requires 90 days. What type of finding is this?

Answer: Compliance gap

A compliance gap exists when an operational setting does not meet the documented policy or regulatory requirement.

Which evaluation approach compares system performance against a previously recorded baseline?

Answer: Baseline comparison

Baseline comparison evaluates current metrics against a known-good snapshot to detect degradation or anomalies.

A sysadmin wants to assess whether CPU utilization spikes are recurring at a specific time. Which tool category is most appropriate?

Answer: Performance monitoring with historical graphing

Performance monitoring tools with historical graphing (e.g., Grafana, Nagios) reveal time-correlated patterns in resource utilization.

What is the primary purpose of a post-incident review (PIR)?

Answer: Identify root causes and prevent recurrence

A PIR (also called a post-mortem) focuses on root cause analysis and process improvements to prevent similar incidents.

Which of the following best describes a gray-box assessment?

Answer: Assessor has partial knowledge such as network diagrams but no credentials

Gray-box testing provides the assessor with limited information (e.g., architecture diagrams) to simulate a partially informed attacker or reviewer.

In capacity planning assessments, what does the 80% rule refer to?

Answer: Resource utilization should not exceed 80% to allow headroom for spikes

The 80% rule states that sustained resource utilization above 80% indicates insufficient headroom, signaling the need for capacity expansion.