Understand the Need for Awareness and Training. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A software development company is updating its security awareness training. The training currently covers general topics like password hygiene and phishing. The company has recently adopted a DevOps model with frequent code deployments and uses cloud services. The security team wants to ensure the training addresses the new risks. Which topic should be added to the training to best address the evolving environment?

   • ASecure coding practices and safe use of cloud development environments.
   • BAdvanced network penetration testing techniques.
   • CGeneral office safety and ergonomics.
   • DFinancial fraud detection and anti-money laundering procedures.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regional bank has experienced a rise in phishing incidents where employees clicked malicious links in emails that appeared to come from the CEO. The bank's security team wants to implement a training program that directly addresses this human-related risk. Which approach best aligns with the purpose of awareness and training under the PROTECT function?

   • ADeploy a mandatory annual online course covering the bank's acceptable use policy and password standards.
   • BImplement a quarterly simulation-based training that teaches employees to recognize phishing indicators and report suspicious emails, with immediate feedback.
   • CSend a one-time email alert to all employees warning them about the recent phishing campaign and advising them to be cautious.
   • DRestrict email access to only the executive team and require all other employees to use a separate communication platform.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard · select all that apply

   A financial institution has implemented a security awareness program that includes online modules, phishing simulations, and instructor-led workshops. The compliance officer wants to assess the effectiveness of the program using multiple methods. Which of the following are valid methods to measure training effectiveness? (Select all that apply.)

   • AReview the number of security incidents reported by employees to the help desk.
   • BCompare click rates on simulated phishing emails before and after training.
   • CConduct focus groups with employees to gather qualitative feedback on the training's relevance and applicability.
   • DTrack the percentage of employees who complete the online modules within the required timeframe.
   Check answers Discussion Select an answer first
5. 9expert · hard

   A large insurance company has a mature awareness program with annual training and quarterly phishing simulations. Despite this, the click rate on simulated phishing emails has plateaued at 15%, and a recent real phishing attack successfully compromised two accounts. The CISO suspects that employees are not applying training in real situations. Which change to the program would most likely improve real-world behavior?

   • ARedesign the training to include realistic, context-specific scenarios and provide immediate, constructive feedback after each simulation.
   • BReplace the annual training with a one-time, intensive in-person workshop on phishing recognition.
   • CIncrease the frequency of phishing simulations to weekly and publicly shame departments with high click rates.
   • DDiscontinue phishing simulations and rely solely on technical email filtering to block malicious messages.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   According to the NIST Cybersecurity Framework, which groups should receive tailored security awareness and training?

   • AOnly IT and security staff
   • BOnly new hires during onboarding
   • CEmployees, executives, and third parties such as contractors and vendors
   • DOnly employees who handle sensitive data
   Reveal Solution Discussion Select an answer first