Program Management CAS-005 Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A financial services firm has a high rate of employees falling for phishing emails. The security team wants to implement a phishing awareness program that includes realistic simulations and provides metrics to measure improvement. The program must also respect employee privacy and avoid creating a hostile work environment. Which approach is most appropriate?

   • AUse phishing simulations only for new employees during onboarding, and rely on annual training for existing staff.
   • BSend simulated phishing emails and automatically block network access for employees who click until they complete training.
   • CRun phishing simulations with a clear communication campaign explaining the program's purpose, and provide immediate feedback and training to those who click.
   • DConduct phishing simulations without informing employees to get a true baseline, and publicly name employees who click.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A global company is updating its security training to address new threats such as ransomware and social engineering. The training must be consistent across all regions but also allow for local regulatory nuances. The training team has limited budget and needs to track completion. Which approach is most effective?

   • AConduct live training sessions in each region with local trainers, and track attendance manually.
   • BUse a single, global training video with no regional variations to ensure consistency.
   • CCreate separate, fully customized training programs for each region to address local regulations.
   • DDevelop a core training module with standardized content, and add region-specific add-ons for local regulations, delivered through a learning management system (LMS) with tracking.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security program is implementing a new vulnerability management process. The team needs to clarify who is responsible for scanning, who must approve remediation, and who should be consulted on risk acceptance. The CISO wants to avoid confusion and ensure accountability. Which tool is most appropriate?

   • APublish a communication plan that outlines how updates will be shared with stakeholders.
   • BDevelop a detailed project plan with timelines and milestones for vulnerability remediation.
   • CEstablish a security incident response team to handle vulnerabilities as they are discovered.
   • DCreate a RACI matrix that assigns Responsible, Accountable, Consulted, and Informed roles for each task in the process.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team needs to communicate a new password policy that requires multi-factor authentication (MFA) for all users. The policy will affect all employees, and the team wants to minimize help desk calls and ensure a smooth transition. Which communication strategy is most effective?

   • AAnnounce the policy during a company-wide meeting and provide no additional resources.
   • BSend a series of emails with clear instructions, hold drop-in sessions for assistance, and provide a FAQ page on the intranet.
   • CSend a single email announcing the policy and require users to set up MFA by a deadline.
   • DPost a notice on the company intranet and rely on users to read it.
   Reveal Solution Discussion Select an answer first