Palo Alto Networks (PANW) Certified Cybersecurity Entry-level Technician (PCCET) Practice Exam

Which metric has skewed results that may cause analysts to "cherry-pick" incidents?

1. Number of incidents handled

2. Mean Time to Resolution (MTTR)

3. Number of feeds into SIEM

4. Number of firewalls/rules deployed

The correct answer is: Number of incidents handled

The metric related to the "Number of incidents handled" can indeed skew results and contribute to the phenomenon of analysts "cherry-picking" incidents. When this metric is emphasized, it can lead to a focus on a higher volume of incidents being addressed rather than the quality or the significance of those incidents. Analysts may prioritize easier or less complex incidents simply to inflate their numbers, creating an illusion of higher efficiency or responsiveness. This could result in overlooking critical incidents that may warrant deeper investigation or a more comprehensive response. In the context of cybersecurity, it's essential for teams to evaluate incidents based on their impact and relevance rather than just quantity. By prioritizing the number of incidents handled, an organization risks neglecting significant vulnerabilities in favor of simply performing a higher volume of work. This can ultimately lead to gaps in security measures and inadequate responses to more serious threats. Therefore, focusing on qualitative metrics alongside quantitative ones is crucial for effective incident management and ensuring that the most vital security issues are addressed appropriately.