Program Management CAS-005 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is merging with another organization and must integrate two different security training programs. The merged entity has a diverse workforce with varying levels of security awareness. The CISO wants a unified training program that is cost-effective and can be delivered within three months. Which approach is most appropriate?

   • AConduct a training needs assessment to identify gaps, then develop a unified core curriculum with optional advanced modules for high-risk roles.
   • BAdopt the more comprehensive of the two existing training programs and roll it out to all employees.
   • CCreate a new training program from scratch without assessing existing content or employee needs.
   • DRun both existing training programs in parallel and let employees choose which to complete.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which of the following is an example of an effective security communication channel?

   • AA monthly email newsletter summarizing recent security updates
   • BSending a single mass email at the start of employment
   • CVerbally communicating policies only during annual performance reviews
   • DPosting security policies only on a physical bulletin board in a remote office
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   What is the primary purpose of a security report?

   • ATo provide stakeholders with information about security incidents and compliance status
   • BTo store raw log data for forensic analysis
   • CTo serve as a marketing tool for the security team
   • DTo replace the need for incident response procedures
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is evaluating the effectiveness of its phishing training program. The click rate on simulated phishing emails has plateaued at 5%, but the rate of employees reporting suspicious emails is low. The team wants to improve reporting behavior. Which approach is most likely to increase reporting?

   • AImplement a 'report and win' incentive program that rewards employees who report suspicious emails, and provide immediate feedback on their reports.
   • BMake reporting mandatory and require employees to report all suspicious emails or face disciplinary action.
   • CSend a company-wide email emphasizing the importance of reporting suspicious emails.
   • DIncrease the difficulty of simulated phishing emails to reduce the click rate further.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company that processes personal data of EU citizens is required to provide privacy training to all employees. The training must be documented to demonstrate compliance with GDPR. The company has a high turnover rate and needs to train new hires quickly. Which approach is most suitable?

   • AProvide a printed privacy handbook to each new hire and ask them to sign a form acknowledging receipt.
   • BRely on managers to verbally explain privacy responsibilities to new hires during onboarding.
   • CImplement an online privacy training module that is mandatory for all new hires and annual for existing employees, with automated completion records.
   • DConduct a one-hour classroom training session for new hires every quarter, and track attendance on a spreadsheet.
   Reveal Solution Discussion Select an answer first