Managing Security Awareness GSLC Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security awareness program has been in place for a year. The metrics show that the click rate has decreased, but the reporting rate has also decreased. The security team is unsure why. What should they do first?

   • AIncrease the frequency of simulations to boost engagement.
   • BReview the simulation design and employee feedback to see if the simulations are becoming too easy or if employees are confused about reporting.
   • CRemove the reporting metric because the click rate is the most important.
   • DAssume the program is working and focus on other priorities.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company with a remote workforce wants to deliver security awareness training that is engaging and effective. Which delivery method is most likely to achieve this goal?

   • AInteractive, online training modules that include real-world scenarios and quizzes.
   • BA mandatory video conference call that all employees must attend at a specific time.
   • CA one-time, in-person seminar held at the company headquarters.
   • DA series of emailed PDF documents that employees can read at their own pace.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which metric is commonly used to measure the effectiveness of a security awareness program?

   • AThe number of security policies published
   • BThe number of security awareness posters displayed in the office
   • CThe percentage of employees who complete training modules
   • DThe reduction in the number of employees who fall for simulated phishing emails
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is designing a phishing simulation program. The CISO wants to measure the program's effectiveness over time, but also wants to avoid overwhelming employees with frequent simulations. The team has a small budget. Which approach best balances these constraints?

   • ARun simulations monthly with different scenarios and track only the click rate.
   • BRun simulations only when a new phishing trend emerges and do not track metrics.
   • CRun a small, targeted simulation quarterly and track click rates and reporting rates as key metrics.
   • DRun a large simulation annually and compare the click rate to industry benchmarks.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An organization has a security awareness program, but employees are hesitant to report incidents because they fear being blamed. Which change would most effectively improve incident reporting?

   • AIncrease the severity of consequences for employees who fail to report incidents.
   • BRequire employees to report incidents through their manager, who will investigate and determine fault.
   • CSend a memo reminding employees that reporting is mandatory and failure to report is a policy violation.
   • DImplement a no-blame culture and publicly recognize employees who report incidents.
   Reveal Solution Discussion Select an answer first