Program Management CAS-005 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A mid-sized company is rolling out a new security training program. The training team must deliver sessions to employees across multiple time zones and with varying technical backgrounds. The CISO wants to ensure that all employees receive the same core content and that the program can be tracked for completion. Which approach best satisfies these requirements?

   • ASchedule a series of live webinars at a fixed time and require attendance for all employees.
   • BDevelop a self-paced online course with mandatory modules, a final assessment, and automated tracking of completion and scores.
   • CDistribute a detailed training manual and ask employees to sign a form confirming they have read it.
   • DCreate separate training tracks for technical and non-technical employees, with different content and delivery methods.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare organization must comply with GDPR and HIPAA. The privacy officer wants to implement a privacy training program that ensures all staff understand their obligations when handling personal data. The program must be measurable and demonstrate compliance to auditors. Which approach is most effective?

   • AConduct a one-time, all-hands privacy training session and document attendance.
   • BProvide role-based privacy training with scenario-based assessments and maintain completion records for audit purposes.
   • CPost privacy policies on the intranet and send a reminder email to all employees.
   • DRequire all employees to watch a general privacy video and sign an acknowledgment form annually.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has experienced a sharp increase in successful phishing attacks despite annual security awareness training. The CISO wants a new program that reduces click rates on simulated phishing emails and improves reporting of suspicious messages. The security team has limited time to develop content and needs to measure effectiveness. Which approach best meets these requirements?

   • AImplement a strict policy that punishes employees who click on simulated phishing emails with mandatory retraining and disciplinary action.
   • BReplace the annual training with a single, comprehensive simulated phishing exercise and a mandatory refresher course for all employees.
   • CDeploy a monthly simulated phishing campaign with immediate, targeted micro-training for users who click, and track click and report rates over time.
   • DSend a monthly email newsletter with tips on identifying phishing emails and encourage employees to read it.
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   Which of the following topics should be included in a privacy training program?

   • AData subject rights and how to respond to requests
   • BHow to sell customer data to third parties
   • CTechniques for anonymizing data after a breach
   • DHow to maximize the collection of personal data
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   Which of the following is a common method used in phishing awareness training programs to reinforce learning?

   • AAnnual penetration testing of the network
   • BSimulated phishing campaigns
   • CMandatory use of a password manager
   • DWeekly full-disk encryption audits
   Reveal Solution Discussion Select an answer first