Security and Awareness Training NDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A regional bank has a high rate of employees clicking on simulated phishing emails. The security team wants to reduce this behavior. They have already delivered an annual instructor-led training session. Which additional measure would most directly address the problem?

   • APost security awareness posters in break rooms and elevators.
   • BRequire employees to sign an acceptable use policy annually.
   • CIncrease the frequency of the annual instructor-led training to twice a year.
   • DLaunch a monthly simulated phishing campaign with immediate feedback for users who click.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   After a year of security awareness training, the security team observes that phishing click rates have decreased, but the number of reported incidents has also decreased. What is the most likely explanation?

   • AEmployees are no longer falling for phishing, so there are fewer incidents to report.
   • BEmployees are not reporting phishing because they are tired of the training.
   • CThe simulated phishing campaign is no longer challenging enough.
   • DThe training is ineffective and employees are ignoring it.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A startup with 50 employees is experiencing an increase in malware infections caused by employees downloading unauthorized software. The CEO asks the security lead for a cost-effective way to reduce this risk. What should the security lead recommend?

   • AFire employees who download unauthorized software.
   • BIgnore the issue because malware infections are rare.
   • CImplement a strict technical control that blocks all software downloads.
   • DConduct a security awareness training session focused on the risks of unauthorized software and safe download practices.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of simulated phishing exercises in security awareness training?

   • ATo test employees' ability to recognize and respond to phishing attempts in a safe environment
   • BTo punish employees who fall for phishing emails
   • CTo replace all other forms of security training
   • DTo collect employees' personal information for security clearance
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has completed its annual security awareness training. Six months later, a new phishing technique that uses QR codes is spreading widely. Employees are not familiar with this tactic. What should the security team do to address this evolving threat?

   • AWait until the next annual training cycle to update the curriculum
   • BDisable all QR code scanning capabilities on company devices
   • CLaunch a targeted refresher module and a simulated QR code phishing campaign for all employees
   • DIssue a one-time email warning about QR code phishing and consider it addressed
   Reveal Solution Discussion Select an answer first