5.2 Describe Security Program Elements (user Awareness, Training, and Physical Access Control) 200-301 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a high rate of employees clicking on phishing emails. The security team has implemented technical controls like email filtering, but the click rate remains high. Which additional measure would be most effective in reducing the click rate?

   • AImplement a simulated phishing campaign that sends fake phishing emails and provides immediate feedback to users who click.
   • BIncrease the frequency of email filtering updates.
   • CSend a monthly email reminder about phishing risks.
   • DBlock all external emails to employees.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is designing a new office layout. The CEO's office and the IT server room are located on the same floor. The security team wants to protect both areas while allowing employees to move freely in the rest of the office. Which physical access control strategy is best?

   • APlace a security guard at the entrance to the floor to check all employees.
   • BUse the same key for both the CEO's office and the server room, issued to all managers.
   • CUse a single access-controlled door with badge readers for both the CEO's office and the server room.
   • DInstall separate badge readers on the CEO's office and the server room, with access rights assigned per employee.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is implementing a new security program. The leadership wants to ensure that employees understand the reasons behind physical security measures and the importance of reporting suspicious activity. Which approach best integrates awareness, training, and physical controls?

   • ASend an email with a list of physical security rules
   • BProvide training only to security staff
   • CConduct onboarding training that explains physical security policies and provides a clear process for reporting incidents
   • DInstall physical controls and assume employees will understand them
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A retail company wants to reduce the risk of social engineering attacks on its customer service staff. The staff often receive phone calls from people claiming to be IT support. Which awareness topic is most important to include in training?

   • AHow to change a password
   • BHow to use a mantrap
   • CHow to configure firewall rules
   • DHow to verify the identity of callers before sharing information
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A research lab wants to restrict access to a secure area to only the five authorized researchers. The lab manager wants a method that is difficult to share or steal. Which physical access control is best suited for this requirement?

   • APhysical key held by a receptionist
   • BBiometric fingerprint scanner
   • CProximity card with a printed photo
   • DCombination lock with a shared code
   Reveal Solution Discussion Select an answer first