Security Fundamentals and Core Concepts Questions

Mapping to CIA triad (brief)

• Firewalls — Availability & Confidentiality (traffic control, segmentation)
• Endpoint Detection & Response (EDR) — Integrity & Confidentiality (malware detection, containment)
• Multi-Factor Authentication (MFA) — Confidentiality & Integrity (auth assurance)
• Periodic Role Reviews — Confidentiality & Integrity (least privilege, privileges correctness)
• Encryption at Rest — Confidentiality (data protection)
• SIEM — Availability, Integrity & Confidentiality (detection, correlation, audit trail)

---

Control metrics, KPIs and data sources

1. Firewalls

• Mean time to block new malicious IPs (hours) — firewall logs, threat intel feeds, ticketing system
• Percentage of denied suspicious flows vs allowed risky flows (%) — firewall logs, NetFlow/PCAP samples
• Policy drift rate (policies changed without approval per month) — firewall config management, change logs, CMDB

2. EDR

• Detection coverage (%) = endpoints with agent + telemetry health — EDR inventory, MDM reports
• Mean time to detect (MTTD) and mean time to remediate (MTTR) for endpoint alerts (hours) — EDR alert logs, SOAR/ticketing
• Percentage of successful containment actions vs failed attempts (%) — EDR action logs, forensic snapshots

3. MFA

• MFA adoption rate for privileged accounts (%) — IAM logs, directory services
• Number of successful logins bypassing MFA (should be 0) — auth logs, conditional access reports
• Authentication failure spikes correlated to brute-force attempts — auth logs, WAF/IDS

4. Periodic Role Reviews

• Percentage of accounts reviewed and certified on schedule (%) — IAM access review reports, GRC tool
• Number of excessive privilege findings closed within SLA (%) — ticketing system, IAM logs
• Time-to-remediate orphaned or stale roles (days) — IAM audit logs, HR system

5. Encryption at Rest

• Percentage of sensitive data volumes encrypted at rest (%) — data discovery tools, storage inventory
• Key compromise incidents (count) and key rotation compliance (%) — KMS logs, HSM audit trails
• Time to detect unencrypted sensitive object (hours) — DLP/discovery scans, storage audit

6. SIEM

• Mean time to detect and escalate correlated incidents (MTTD) — SIEM alert timestamps, SOAR tickets
• False positive rate of prioritized alerts (%) — SIEM alert metadata, SOC feedback loop
• Log coverage completeness (%) = % of critical sources sending logs and within retention SLAs — log source inventory, logging pipeline metrics

---

Rationale: each metric ties to measurable outcomes (reduce exposure, speed of response, policy hygiene). Data sources listed are commonly available in production telemetry and integrate with SOAR/GRC for reporting.