Security and Awareness Training NDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small company with 30 employees wants to improve its phishing resistance. The budget is limited, and the security team has no dedicated training platform. Which approach is the most cost-effective and still provides measurable results?

   • ARun manual phishing simulations using a free email tool and track clicks in a spreadsheet
   • BPurchase an expensive enterprise LMS with advanced reporting
   • CRely on employees to self-report if they receive suspicious emails
   • DHire an external security consultant to deliver a one-time workshop
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has employees who are geographically dispersed and work remotely. The security team needs to deliver training that is consistent across all locations and can be tracked for compliance. Which delivery method is most suitable?

   • APrinted training manuals mailed to each employee
   • BA one-time webinar that employees can attend live
   • CSelf-paced online courses with completion tracking and periodic assessments
   • DInstructor-led training at a central location
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the best way to evaluate whether security awareness training has changed employee behavior?

   • AAsk employees to rate their own confidence in a survey
   • BReview the number of security-related emails sent by the security team
   • CMonitor the rate of successful phishing simulations over time
   • DCount the number of security awareness posters displayed in the office
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   After a simulated phishing campaign, the security team finds that the click rate is 15%, but the helpdesk also reports a 40% increase in employees forwarding suspicious emails for verification. How should the team interpret these results?

   • AThe training is ineffective because the click rate is still high
   • BThe training is effective because employees are reporting more, but the click rate shows more work is needed
   • CThe training is fully successful because reporting increased
   • DThe results are inconclusive because the two metrics are unrelated
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A mid-sized company recently suffered a ransomware infection after an employee clicked a link in a phishing email. The security team must roll out a training program that reaches all 500 employees across multiple shifts and locations, including remote workers. The program must include realistic phishing simulations and provide measurable data on who is clicking. Which training delivery method best meets these requirements?

   • AA mandatory instructor-led classroom session held once per year at headquarters
   • BA one-time email blast containing a security awareness video and a link to a quiz
   • CPosting printed security posters in common areas and break rooms
   • DAn online learning management system (LMS) with on-demand modules and integrated simulated phishing campaigns
   Reveal Solution Discussion Select an answer first