Practice security pipeline metrics vocabulary: mean time to remediate, vulnerability scan coverage, security debt, false positive rate in SAST, and security gate pass rate language.
0 / 14 completed
1 / 14
What is 'mean time to remediate' (MTTR) in a security context?
Mean time to remediate (security MTTR) measures the average time from vulnerability discovery to confirmed fix. It is a key security programme health metric — a lower MTTR means vulnerabilities spend less time exploitable in production.
2 / 14
A security report says 'we have 23 open ___ findings.' What word fits?
'Critical findings' are the highest severity vulnerabilities — those with exploitable paths, high CVSS scores, or known active exploits. Tracking the count of open critical findings is a standard security KPI.
3 / 14
What is 'vulnerability scan coverage' as a security pipeline metric?
Scan coverage measures how much of the attack surface is actually scanned. 100% coverage means every repository, container image, and IaC template is scanned. Gaps in coverage are blind spots that attackers can exploit.
4 / 14
What is 'security debt' in a DevSecOps context?
Security debt is the security equivalent of technical debt: known vulnerabilities, unpatched dependencies, and architectural weaknesses that accumulate when teams prioritise speed over security. Measuring and reducing security debt is a core DevSecOps objective.
5 / 14
A high 'false positive rate in SAST' is a problem because:
A high false positive rate erodes trust in the security tool. When developers see mostly false alarms, they start dismissing all alerts — including real vulnerabilities. Tuning SAST tools to reduce false positives is critical for DevSecOps adoption.
6 / 14
Code Review Comment
During a code review for the new user authentication service, Sarah comments: "This endpoint doesn't include any rate limiting. We're seeing an increasing number of failed login attempts – potentially indicating brute force attacks. I think we need to add some basic throttling to protect against that."
Which metric does Sarah implicitly refer to when discussing the 'failed login attempts' and suggesting a solution?
Sarah is referring to Mean Time To Remediate (MTTR), which represents the average time it takes to fix a security vulnerability or incident. The comment highlights an issue (increased failed login attempts) and proposes a solution (rate limiting). It's important to note that while 'severity' relates to impact, MTTR focuses on *response* time; a false positive rate measures the accuracy of alerts, not the speed of remediation.
7 / 14
Code Review Comment
During a code review for the new user authentication service, Sarah comments: "This endpoint doesn't include any rate limiting. We're seeing an increasing number of failed login attempts – potentially indicating brute force attacks. I think we need to add some basic throttling to protect against that."
Which metric does Sarah implicitly refer to when discussing the 'failed login attempts' and suggesting a solution?
Sarah is referring to Mean Time To Remediate (MTTR), which represents the average time it takes to fix a security vulnerability or incident. The comment highlights an issue (increased failed login attempts) and proposes a solution (rate limiting). It's important to note that while 'severity' relates to impact, MTTR focuses on *response* time; a false positive rate measures the accuracy of alerts, not the speed of remediation.
8 / 14
Code Review Comment
During a code review for the new user authentication service, Sarah comments: "This endpoint doesn't include any rate limiting. We're seeing an increasing number of failed login attempts – potentially indicating brute force attacks. I think we need to add some basic throttling to protect against that."
Which metric does Sarah implicitly refer to when discussing the 'failed login attempts' and suggesting a solution?
Sarah is referring to Mean Time To Remediate (MTTR), which represents the average time it takes to fix a security vulnerability or incident. The comment highlights an issue (increased failed login attempts) and proposes a solution (rate limiting). It's important to note that while 'severity' relates to impact, MTTR focuses on *response* time; a false positive rate measures the accuracy of alerts, not the speed of remediation.
9 / 14
Code Review Comment
During a code review for the new user authentication service, Sarah comments: "This endpoint doesn't include any rate limiting. We're seeing an increasing number of failed login attempts – potentially indicating brute force attacks. I think we need to add some basic throttling to protect against that."
Which metric does Sarah implicitly refer to when discussing the 'failed login attempts' and suggesting a solution?
Sarah is referring to Mean Time To Remediate (MTTR), which represents the average time it takes to fix a security vulnerability or incident. The comment highlights an issue (increased failed login attempts) and proposes a solution (rate limiting). It's important to note that while 'severity' relates to impact, MTTR focuses on *response* time; a false positive rate measures the accuracy of alerts, not the speed of remediation.
10 / 14
David from the security team sent a Slack message: 'The new pipeline is showing a high number of 'high severity' findings. We need to investigate if our vulnerability scan coverage is adequate and whether we're properly prioritizing remediation.' What does 'vulnerability scan coverage' primarily refer to in this context?
Vulnerability scan coverage describes the extent to which a security scanning tool examines your codebase. It's not just about finding vulnerabilities; it's about ensuring that *all* relevant code – and therefore potential attack vectors – are being assessed by the scanner. A low coverage means some parts of your system aren't being checked, potentially missing critical issues.
11 / 14
Maria is drafting a PR description for a security fix related to input validation. She writes: 'Implemented stricter validation on the user ID field to prevent SQL injection attacks. This reduces our overall false positive rate.' What does 'false positive rate' indicate in this scenario?
'False positive rate' specifically measures how often a security tool incorrectly identifies something as a vulnerability. A high rate suggests the tool is overly sensitive and generating alerts about issues that don't pose a real risk – wasting developer time and potentially masking genuine threats.
12 / 14
Ben, during a standup meeting, reports: 'Our MTTR for critical vulnerabilities is currently averaging 72 hours. We need to improve this metric to reduce the window of opportunity for attackers.' What does 'mean time to remediate' (MTTR) represent in security operations?
Mean Time To Remediate (MTTR) is a key performance indicator (KPI) in security. It measures the efficiency of your team's response to vulnerabilities – specifically, how quickly you identify and fix them after they're discovered. A lower MTTR indicates a faster and more effective security posture.
13 / 14
Chloe is discussing 'security debt' with her team during a retrospective. She states: 'We've been prioritizing speed of delivery over thorough security reviews, and now we have significant security debt – essentially, vulnerabilities that haven't been addressed because they weren't properly checked.' What does 'security debt' primarily represent?
'Security debt' is a metaphor for the risks you're taking by neglecting security best practices. It represents the accumulated vulnerability exposure resulting from shortcuts or omissions in your development process – essentially, it's the cost of delayed remediation; the longer vulnerabilities remain unfixed, the higher the risk.
14 / 14
Ethan observes that a recent automated security scan identified many 'high' severity findings in a new microservice. He notes: 'The service is using legacy libraries with known vulnerabilities, but we haven't yet updated them due to the complexity of the migration.' What potential issue is this primarily highlighting?
This situation demonstrates a key aspect of *vulnerability scan coverage*. The service's reliance on unpatched legacy libraries means those components are not being actively scanned. This creates gaps in your security posture and contributes directly to the accumulation of 'security debt' – vulnerabilities that aren't detected because they aren't being examined.
What does the "Security Pipeline Metrics Vocabulary" exercise cover?
Practice security pipeline metrics vocabulary: mean time to remediate, vulnerability scan coverage, security debt, false positive rate in SAST, and security gate pass rate language.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Security Pipeline Metrics Vocabulary"?
This exercise has 14 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Devsecops Pipeline Language exercises?
Browse the full Devsecops Pipeline Language hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.