Understand the Need for Awareness and Training. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which method is commonly used to measure the effectiveness of security awareness training?

   • AAsking employees to rate the training on a scale of 1 to 10
   • BChecking whether employees completed the training within the deadline
   • CCounting the number of training sessions delivered
   • DConducting phishing simulations to see how many employees fall for the simulated attack
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A multinational corporation is expanding its security awareness program to include third-party vendors who have access to its network. The vendors have varying levels of technical expertise and are located in different countries with different data privacy regulations. The compliance team wants to ensure that training is effective and compliant. What is the most appropriate approach?

   • AProvide a written security policy document to vendors and require them to sign an acknowledgment that they have read it.
   • BExempt vendors from training because they are not employees and are responsible for their own security.
   • CRequire all vendors to complete the same training as employees, using the company's internal learning management system.
   • DDevelop a vendor-specific training module that covers the company's security policies, remote access requirements, and relevant regulatory obligations, and deliver it via a web-based platform accessible to vendors.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which training delivery method is most effective for providing hands-on experience in responding to a simulated security incident?

   • APosters and email reminders
   • BInstructor-led classroom sessions
   • COnline self-paced modules
   • DSimulations and tabletop exercises
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is an effective way to integrate security awareness into daily operations?

   • APosting security policies only on the intranet
   • BMaking security a topic only during incident response
   • CRestricting security training to an annual event
   • DIncluding security reminders in routine communications and team meetings
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A technology startup with a rapidly changing product and frequent employee turnover is designing its security awareness program. The HR director asks how often training should be conducted. Which frequency is most appropriate for this environment?

   • AAnnual training for all employees, with new hires completing a basic module during onboarding.
   • BMonthly training for all employees, regardless of role or risk level.
   • CA one-time training session for all employees, repeated only when a major security incident occurs.
   • DQuarterly training sessions, plus onboarding training for new hires and refresher modules when significant threats or organizational changes occur.
   Reveal Solution Discussion Select an answer first