Security and Awareness Training NDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team has a limited budget and must choose between two training initiatives: (1) a one-time, high-production-value instructor-led workshop, or (2) a year-long series of short online modules with monthly simulated phishing tests. The goal is to achieve a sustained reduction in security incidents. Which initiative should they choose?

   • AThe year-long series, because it provides continuous reinforcement and measurable feedback.
   • BNeither, because training has little impact on security incidents.
   • CBoth initiatives, because more training is always better.
   • DThe one-time workshop, because it provides in-depth, interactive learning.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A manager notices that a team member frequently leaves their workstation unlocked. According to the roles and responsibilities in security training, what is the manager's primary responsibility in this situation?

   • AChange the employee's password to prevent unauthorized access.
   • BReport the behavior directly to the security team for disciplinary action.
   • CRemind the employee of the security policy and reinforce the importance of locking the workstation.
   • DIgnore the behavior because it is not a serious security issue.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A small company has no dedicated security team. The CEO wants to build a security-aware culture. According to the principles of security awareness training, who should be primarily responsible for championing this initiative?

   • AEach individual employee, who should self-train on security topics.
   • BThe IT helpdesk staff, since they handle day-to-day technical issues.
   • CThe CEO and senior management, who must model and prioritize security.
   • DThe external auditor, who reviews security practices annually.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company has a high rate of employees falling for phishing simulations. The security team wants to improve the program. The CEO is supportive but managers are not enforcing training completion. Employees say they are too busy. Which strategy addresses both the managerial and employee barriers?

   • AAssign the security team to personally monitor and remind each employee
   • BSend a strongly worded email from the CEO demanding that employees complete the training
   • CMake the training optional but offer a small gift card for completion
   • DMake training completion a performance metric for employees and managers, and provide short, job-relevant micro-modules
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company is developing a security awareness program. The security team wants to ensure that employees understand the 'why' behind security policies, not just the 'what'. Which training approach best achieves this?

   • ATesting employees on the exact wording of the policies.
   • BListing all security policies and requiring employees to sign them.
   • CProviding a quick reference card with do's and don'ts.
   • DPresenting real-world case studies that show the consequences of security failures.
   Reveal Solution Discussion Select an answer first