ISC2 CISSP Practice Question

The correct answer is Number of vulnerabilities found in production versus during review. Comparing vulnerabilities found in production versus during the review process directly measures the effectiveness of the code review in catching security issues before release. This ratio indicates how well the review process is identifying vulnerabilities that could otherwise make it to production. A successful code review process should result in most vulnerabilities being discovered during review rather than in production.

Lines of code reviewed per hour is incorrect because lines of code reviewed per hour measures efficiency rather than effectiveness. Reviewing code quickly doesn't necessarily mean the review is identifying security issues correctly.

Number of team members participating in reviews is incorrect because the number of participants doesn't directly indicate review quality. Having more reviewers doesn't guarantee better vulnerability detection if the reviewers lack security expertise or if the review process is flawed.

Total time spent on reviews is incorrect because total time spent on reviews measures effort but not results. Spending more time on reviews doesn't necessarily correlate with finding more or more important vulnerabilities.