Personnel & Training GCIP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm is hiring a contractor for a six-month project that will involve access to customer financial records. The contractor will work remotely. The firm's policy requires personnel risk assessments for all contractors. Which set of actions best fulfills this requirement?

   • ARely on the contracting agency's statement that the contractor has been vetted and grant access immediately.
   • BRequire the contractor to sign a non-disclosure agreement and provide a list of previous employers.
   • CConduct a background check, verify references, and require the contractor to complete security awareness training before access is granted.
   • DGrant access first so the contractor can start, then conduct the background check within 30 days.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A multinational corporation is developing a cybersecurity training program for its employees. The workforce includes office staff, remote workers, and field technicians. The training must be consistent across the organization but also relevant to different roles. The company has a limited training budget. Which approach is most effective?

   • ACreate a training program only for employees who handle sensitive data, and exempt others.
   • BDevelop a core training module for all employees and additional role-specific modules for different job functions, delivered through an online platform.
   • CProvide a single online training course that covers all topics in depth for every employee.
   • DConduct in-person training sessions at each office location, with the same content for all employees.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A utility company has a high rate of employees falling for phishing emails. The security team is considering two options: (1) a mandatory annual training course, or (2) a monthly simulated phishing campaign with immediate feedback. The budget allows only one. Which option should they choose to most effectively reduce the click rate?

   • ANeither, because phishing is a technical problem that requires better email filters.
   • BThe monthly simulated phishing campaign, because it provides repeated, realistic practice and immediate feedback.
   • CBoth, because they are equally important.
   • DThe annual training course, because it covers all topics in depth.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What does lifecycle management of access rights involve?

   • AMonitoring user activity to detect unauthorized access attempts.
   • BGranting access at onboarding, reviewing and adjusting access as roles change, and revoking access upon termination.
   • CCreating strong passwords and enforcing regular password changes.
   • DAssigning each user a unique identifier and requiring multi-factor authentication.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following best describes the structure of a cybersecurity training program for personnel?

   • AA set of mandatory annual security awareness videos that employees must watch but are not required to understand.
   • BAn informal, unstructured discussion group where employees share security tips without any formal curriculum or assessment.
   • CA one-time, generic presentation on security policies delivered to all employees at onboarding.
   • DA series of role-based modules that teach specific skills and are delivered through methods such as instructor-led sessions, e-learning, or hands-on labs.
   Reveal Solution Discussion Select an answer first