Security and Awareness Training NDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization's security team wants to evaluate whether its simulated phishing campaign is improving employee vigilance over time. Which approach would provide the most meaningful measurement?

   • ACompare click rates across different departments in a single campaign.
   • BCount how many employees report the simulated phishing emails.
   • CAsk employees to self-assess their confidence in spotting phishing.
   • DTrack the trend of click rates across multiple campaigns over several months.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is evaluating the effectiveness of its training program. They have data on quiz scores, completion rates, and phishing simulation click rates. Which data point is the most reliable indicator of whether employees will apply training in real situations?

   • AQuiz scores, because they measure knowledge.
   • BAll are equally reliable.
   • CPhishing simulation click rates, because they measure actual behavior.
   • DCompletion rates, because they show participation.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A global company must deliver security awareness training to employees in different regions and time zones. Some regions have strict data privacy laws that restrict the use of third-party training platforms. The training must include phishing simulations and be measurable. Which approach best balances these constraints?

   • ASend training materials via email and ask employees to confirm they have read them
   • BDeploy a self-hosted training platform that keeps employee data within each region's data residency boundaries, and run localized phishing simulations
   • CConduct instructor-led training in each region, but skip phishing simulations to avoid data privacy issues
   • DUse a single global online training platform with phishing simulations, and exclude employees in regions with data privacy restrictions
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which group is primarily responsible for designing and delivering security awareness training programs?

   • AExternal auditors
   • BThe human resources department only
   • CThe security team
   • DIndividual employees
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is designing a training program for a company that handles highly sensitive data. They have a limited budget and must choose between (a) annual in-depth training for all employees, or (b) quarterly short refresher courses with targeted content. Which approach is more likely to maintain a high level of awareness?

   • AQuarterly short refreshers, because they provide more frequent reinforcement.
   • BA combination of both, but this exceeds the budget.
   • CNeither, because training is not effective for sensitive data handling.
   • DAnnual in-depth training, because it covers more material.
   Reveal Solution Discussion Select an answer first