Security and Awareness Training NDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a strong security team, but employees often ignore security policies because they see security as an obstacle to their work. The CEO wants to shift the culture. What is the most effective first step?

   • AOutsource security awareness training to an external vendor.
   • BHave the security team send out a memo reminding employees of the policies.
   • CIncrease the penalties for policy violations.
   • DHave the CEO publicly endorse security as a business enabler and participate in training sessions.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is designing a training program for a company that handles highly sensitive financial data. The program must comply with industry regulations that require annual training. The team also wants to address new threats as they emerge. Which approach best satisfies both the regulatory requirement and the need for agility?

   • ADeliver the required annual training and supplement it with quarterly threat briefings and targeted micro-modules when new threats appear
   • BProvide only the annual training and rely on the security team to monitor new threats
   • CReplace the annual training with monthly micro-modules that cover current threats
   • DConduct a single comprehensive training session that covers all possible future threats
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After a security awareness campaign, the CISO wants to know if the training actually changed employee behavior. Which metric would provide the most direct evidence of behavior change?

   • AThe number of reported phishing emails forwarded to the security team.
   • BThe percentage of employees who completed the online training module.
   • CThe number of security awareness posters displayed across the office.
   • DThe average score on the post-training quiz.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of refresher training in a security awareness program?

   • ATo reinforce key security concepts and introduce updates on new threats
   • BTo replace initial training for new employees
   • CTo test employees' technical skills in penetration testing
   • DTo provide a one-time certification that lasts forever
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's security team has been running the same annual training for three years. The team notices that employees are becoming complacent and ignoring the content. What should the team do to reinvigorate the program?

   • AMake the training mandatory with a passing score.
   • BShorten the training to make it quicker to complete.
   • CUpdate the training with new threat examples and interactive elements like simulations.
   • DKeep the same training because it has worked in the past.
   Reveal Solution Discussion Select an answer first