Understand the Need for Awareness and Training. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A retail company has completed its first year of security awareness training. The security team wants to determine whether the training actually reduced risky behaviors. Which method would provide the most reliable evidence of training effectiveness?

   • ATrack the number of employees who completed the training modules and passed the end-of-course quiz.
   • BSend a satisfaction survey to employees asking if they found the training useful.
   • CConduct a series of simulated phishing campaigns and compare click rates before and after training.
   • DReview help desk tickets related to security incidents to see if the volume decreased.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A cybersecurity consulting firm is designing a security awareness program for a client in the energy sector. The client has a mix of office-based staff and field engineers who work in remote locations with limited internet connectivity. The training must be effective for both groups and allow for measurement of effectiveness. Which delivery strategy best meets these requirements?

   • AProvide instructor-led training at a central location for all employees, and use paper-based quizzes to measure effectiveness.
   • BDeliver all training through online modules that require internet access, and use the platform's built-in quizzes for assessment.
   • CUse a blended approach: online modules for office staff, downloadable offline modules for field engineers that sync when connectivity is available, and a common set of phishing simulations for both groups.
   • DRely on on-the-job training and mentorship for field engineers, and provide online training only to office staff.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A public utility company is trying to build a security-conscious culture. The security team has observed that employees often ignore security policies because they perceive them as obstacles to productivity. The CEO is supportive but has not actively participated in any security initiatives. Which combination of actions would most effectively foster a security-conscious culture?

   • AHave the CEO publicly endorse security as a core value, and involve employees in security decision-making through a security champions program.
   • BFocus on rewarding employees who report security incidents, while ignoring those who do not follow policies.
   • CIncrease the number of security policies and enforce them strictly with automatic technical controls.
   • DOutsource security awareness to an external vendor and require employees to complete an annual online course.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A government agency with a high-security environment is planning its annual security awareness training. The training must be effective for employees who handle classified information, and the agency has a strict policy against using external cloud services for training. Which delivery method is most appropriate?

   • AInstructor-led classroom sessions conducted on-site, using internal materials and hands-on exercises.
   • BDistribute printed manuals and require employees to read them and sign an acknowledgment.
   • CSelf-paced online modules hosted on a commercial training platform.
   • DA webinar delivered by an external consultant over the internet.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What should security awareness training include regarding organizational policies?

   • AAn explanation of the policies and how to apply them in daily work
   • BOnly the penalties for violating policies
   • CDetails on how to bypass policies for convenience
   • DA summary of all policies without practical examples
   Reveal Solution Discussion Select an answer first