Security and Awareness Training NDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A new manager asks why the company invests in security awareness training instead of just buying more security software. Which explanation best justifies the investment?

   • ATraining is required by law in all industries, so the company has no choice
   • BTraining eliminates the need for security software, saving money
   • CTraining reduces the risk of human error, which is a common cause of security incidents, and complements technical controls
   • DSecurity software is not effective, so training is the only way to protect the company
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company has completed a one-time security awareness training for all employees. Six months later, a new phishing technique starts circulating. What should the security team do to maintain effective defense?

   • AAssume employees will remember the original training and apply it.
   • BWait until the next annual training to update the content.
   • CSend a brief email alert describing the new phishing technique.
   • DLaunch a refresher training module focused on the new technique.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After a year of mandatory security awareness training, the security team wants to evaluate whether the program is actually changing employee behavior. They have access to phishing simulation click rates, helpdesk reports of reported suspicious emails, and post-training quiz scores. Which combination of metrics provides the most reliable evidence of behavior change?

   • ACounting the number of training modules completed by each employee
   • BComparing phishing simulation click rates before and after training, and tracking the volume of emails reported to the helpdesk
   • CReviewing only the post-training quiz scores to confirm employees retained the material
   • DSurveying employees about their confidence in identifying phishing emails
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization has completed its initial security awareness training. The security team notices that phishing simulation click rates drop immediately after training but gradually rise over the following months. What should the team do to maintain the improvement?

   • ASchedule periodic refresher training and ongoing phishing simulations throughout the year
   • BStop phishing simulations because they are not working
   • CSend a one-time memo reminding employees to be careful with emails
   • DIncrease the difficulty of the next annual training exam
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of security awareness training in an organization?

   • ATo replace the need for technical security controls such as firewalls and antivirus software
   • BTo provide employees with detailed technical knowledge of network protocols and encryption algorithms
   • CTo ensure that employees can identify and respond to security threats appropriately
   • DTo guarantee that no security breach will ever occur in the organization
   Reveal Solution Discussion Select an answer first