Understand the Need for Awareness and Training. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a key advantage of using online self-paced training modules for security awareness?

   • AThey are the only method that can deliver simulations
   • BThey provide real-time interaction with an instructor
   • CThey guarantee that employees will retain all the information
   • DThey allow employees to complete training at their own convenience
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare organization is updating its security awareness program. The compliance officer notes that the program must address the different risk profiles of clinical staff, administrative personnel, and external vendors who access patient records. Which approach best meets the need for tailored training across these audiences?

   • ADevelop role-based training modules: clinical staff focus on patient privacy and phishing, administrative staff on data handling and social engineering, and vendors on contractual security requirements and remote access.
   • BRequire only employees who handle sensitive data to complete training, while exempting vendors and administrative staff to reduce burden.
   • CConduct a single instructor-led session for all staff and vendors, covering general security topics and the organization's incident reporting process.
   • DProvide the same annual online training to all employees and vendors to ensure consistency and simplify administration.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services firm has a mature security awareness program with annual training. Recently, the threat landscape has shifted with a rise in vishing (voice phishing) and deepfake-based social engineering. The CISO wants to update the training to address these new threats. What is the most appropriate action?

   • ADiscontinue annual training and rely on technical controls to block vishing and deepfake attacks.
   • BWait until the next annual training cycle to incorporate the new threats, as the current program is already established.
   • CReplace the entire training program with a new one focused solely on vishing and deepfakes.
   • DIssue an immediate targeted awareness campaign on vishing and deepfake tactics, and schedule an update to the next regular training cycle.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is awareness and training considered a key component of the PROTECT function in the NIST Cybersecurity Framework?

   • AIt helps personnel recognize and avoid actions that could lead to security incidents
   • BIt is required only for organizations that handle classified data
   • CIt ensures that all security controls are implemented correctly
   • DIt guarantees that no security incidents will occur
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a recommended practice for the frequency of security awareness training?

   • AProvide training only once during onboarding
   • BProvide training on a regular, recurring basis, such as annually or more often
   • CProvide training only for new hires
   • DProvide training only when an incident occurs
   Reveal Solution Discussion Select an answer first