5.2 Describe Security Program Elements (user Awareness, Training, and Physical Access Control) 200-301 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A large organization has a high turnover of temporary contractors who need access to specific systems for short periods. The security team wants to ensure these contractors understand their security responsibilities without delaying their start date. Which training approach is most appropriate?

   • ASend contractors a link to the company's security policy and assume they read it.
   • BRequire contractors to complete the same full-day training as permanent employees.
   • CProvide a concise, role-based security briefing before granting system access, with a refresher if the contract is extended.
   • DAllow contractors to start work and provide training within the first month.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A data center is located in a building shared with other tenants. The data center operator wants to ensure that only authorized personnel can access the server floor. The building management requires that fire exits remain unlocked during business hours. Which physical access control strategy best meets both requirements?

   • ALock all fire exits and use a single key for the server floor
   • BUse a mantrap at the entrance to the server floor and keep fire exits alarmed with delayed egress
   • CInstall a biometric scanner on the fire exits
   • DPost a security guard at the fire exits
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A hospital is updating its security program. The IT department handles sensitive patient data, while the front-desk staff manage physical access to the building. The compliance officer wants training that is relevant to each group's role. Which training approach best meets this requirement?

   • AConduct training only when a security incident occurs
   • BOffer a one-time advanced technical training for all staff
   • CProvide role-based training: privacy and data-handling for IT, and physical access procedures for front-desk staff
   • DDeliver the same general security awareness module to all employees
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A small business wants to improve its security culture without a large budget. Employees are often unaware of common threats like phishing and social engineering. Which initiative is most cost-effective for raising awareness?

   • ADistribute a one-time brochure at onboarding
   • BSend a monthly newsletter with security tips and real-world examples
   • CPurchase an expensive security awareness platform with advanced features
   • DHire a full-time security trainer
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is implementing a new security program. The facility has a high rate of tailgating incidents, and employees frequently fall for phishing emails. The budget is limited, and the security team must choose a set of measures. The CEO wants quick results but also wants a sustainable program. Which plan best balances immediate risk reduction and long-term improvement?

   • AInstall a mantrap at the main entrance and launch a monthly phishing simulation with training for all employees.
   • BConduct a security awareness workshop and install CCTV cameras throughout the facility.
   • CDeploy an advanced email security gateway and add security guards at all entrances.
   • DSend a one-time email about security policies and install biometric readers on all doors.
   Reveal Solution Discussion Select an answer first