Personnel & Training GCIP Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A government agency has a security awareness program that includes annual training and periodic reminders. An audit reveals that employees are still engaging in risky behaviors, such as using weak passwords and plugging in unknown USB devices. The agency wants to improve its program. Which approach is most likely to be effective?

   • AImplement a continuous awareness program with regular, short, interactive modules and practical exercises, such as USB drop tests and password strength checks.
   • BIncrease the length and frequency of the annual training sessions.
   • CReplace the awareness program with a formal training course that includes a final exam.
   • DImplement a technical solution that prevents the use of weak passwords and blocks USB devices.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A defense contractor is assessing the risk of employees who will work on a classified program. The assessment must consider factors that could make an employee vulnerable to coercion or exploitation. Which factor is most relevant to this assessment?

   • AThe employee's level of education and technical certifications.
   • BThe employee's commute time and work schedule flexibility.
   • CFinancial difficulties, such as significant debt or unexpected wealth.
   • DThe employee's preference for working from home.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A mid-sized utility company recently experienced a phishing incident where several employees clicked a malicious link. Management wants to reduce the likelihood of similar incidents. The security team proposes a one-hour annual online course that covers phishing recognition and password hygiene, with a quiz at the end. Which additional action would most effectively strengthen the program's impact?

   • AConduct monthly simulated phishing campaigns and provide immediate, personalized feedback to employees who fail.
   • BReplace the annual course with a mandatory in-person instructor-led training session each year.
   • CIncrease the quiz passing score to 100% and require employees to retake the course until they pass.
   • DAdd a detailed policy document on email usage to the annual course and require employees to acknowledge it.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A healthcare organization is developing a cybersecurity training program for its staff. The program must include role-based content for clinicians, administrators, and IT staff. Which evaluation method would best measure the program's effectiveness in changing behavior?

   • ACount the number of employees who complete the training.
   • BCollect employee satisfaction scores after each training session.
   • CTrack the number of security incidents reported by employees before and after training.
   • DMeasure the average time employees spend completing the training modules.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A regional utility company recently experienced a spear-phishing incident that bypassed email filters and tricked two finance employees into revealing their credentials. The security manager wants to reduce the likelihood of similar incidents. The company has a compliance-driven annual training that focuses on regulatory requirements and is delivered as a slide deck. Which approach best addresses the immediate gap?

   • ADeploy a technical control that blocks all incoming email with links or attachments.
   • BLaunch a short, recurring awareness campaign with simulated phishing and immediate feedback for employees.
   • CIncrease the frequency of the existing compliance training to quarterly and require a passing score.
   • DReplace the annual training with a one-time advanced threat briefing for the finance team only.
   Reveal Solution Discussion Select an answer first