Security Frameworks and Governance CISA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An organization conducts simulated phishing campaigns and tracks the click rate over time. What is the primary purpose of this activity?

   • ATo comply with regulatory requirements for phishing simulations
   • BTo measure the effectiveness of the security awareness program and identify areas for improvement
   • CTo test the technical security controls in place
   • DTo punish employees who fall for the simulated phishing emails
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security manager implemented a security awareness program and is now under pressure to demonstrate its value to the board. The board is not interested in technical metrics like phishing click rates; they want to understand the program's impact on business risk. Which approach best communicates the program's value to the board?

   • ATranslate security metrics into business terms, such as estimated cost avoidance from reduced incidents
   • BReport the number of training hours completed by all employees
   • CShow the number of security policies that were updated
   • DPresent the raw phishing simulation click rate data
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After implementing a new security awareness program, the CISO asks the security manager to prove that the program is actually reducing risk. Which metric would provide the most direct evidence of the program's effectiveness?

   • APercentage of employees who completed the training
   • BNumber of security awareness posters displayed
   • CEmployee satisfaction score for the training sessions
   • DReduction in the click rate on simulated phishing emails over time
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare organization has experienced multiple phishing incidents where employees clicked on malicious links in emails. The security manager wants to implement a training program that directly addresses this specific risk. Which approach is most effective for this situation?

   • APosting a security awareness poster in the break room
   • BAnnual classroom training on general security awareness
   • CQuarterly simulated phishing campaigns with immediate feedback and targeted micro-training
   • DA one-time email to all employees warning about phishing
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of a security awareness training program?

   • ATo provide employees with advanced technical skills to configure security tools
   • BTo ensure compliance with regulatory requirements only
   • CTo change employee behavior and reduce the risk of security incidents caused by human error
   • DTo replace the need for technical security controls
   Reveal Solution Discussion Select an answer first