CAS-003 · Question #957
A company's Chief Information Security Officer (CISO) is reviewing KPls from me security operations team. These KPls indicate the following trends: - The mean time to close security events that have…
The correct answer is D. Increase the investment in training for Tier 2 analysts. The key data points are: Tier 1 analyst tenure has dropped from 12 to 9 months (high turnover), the escalation rate from Tier 1 to Tier 2 jumped from 50% to 75%, and Tier 2's mean time to close is unchanged even though it is now receiving 50% more work. The overall close time…
Question
A company's Chief Information Security Officer (CISO) is reviewing KPls from me security operations team. These KPls indicate the following trends:
- The mean time to close security events that have been escalated to a Tier 2 analyst has not
changed
- The average tenure for Tier 1 security analysts has fallen from 12 months to 9 months
- The percentage of events escalated from a Tier 1 analyst to a Tier 2 analyst has increased from
50 to 75.
- The mean time to pick up and respond to a security event has not changed
- Resource and event volumes have not changed
- The overall mean time to close security events has increased from 8 hours to 12 hours
Which of the following actions is MOST likely to result in a sustainable improvement in these KPls?
Options
- AIncrease the investment in training for Tier 1 analysts
- BPromote the strongest Tier 1 analyst to Tier 2
- CMove one or more security analysts from Tier 2 to Tier 1
- DIncrease the investment in training for Tier 2 analysts
How the community answered
(25 responses)- A12% (3)
- B4% (1)
- C24% (6)
- D60% (15)
Explanation
The key data points are: Tier 1 analyst tenure has dropped from 12 to 9 months (high turnover), the escalation rate from Tier 1 to Tier 2 jumped from 50% to 75%, and Tier 2's mean time to close is unchanged even though it is now receiving 50% more work. The overall close time increased from 8 to 12 hours. The bottleneck is clearly at Tier 2 - it is absorbing significantly more events but not closing them faster, creating a growing queue. Training Tier 1 analysts (option A) is not sustainable because high turnover means the investment is repeatedly lost. Promoting a Tier 1 analyst to Tier 2 (option B) weakens Tier 1 further. Moving Tier 2 analysts to Tier 1 (option C) reduces Tier 2 capacity at the worst time. Training Tier 2 analysts (option D) is sustainable because Tier 2 retention is not identified as a problem, and better-trained Tier 2 analysts can close escalated events faster, relieving the queue and reducing overall mean time to close.
Topics
Community Discussion
No community discussion yet for this question.