A retail company has a high rate of employees writing down passwords on sticky notes. The security team wants to implement a training program to address this behavior. Which training objective is most directly aligned with this issue?

Describe the process for reporting a security incident

Explain the company's social media policy

Teach employees how to create and remember strong, unique passwords

Explain the importance of using multi-factor authentication

Which of the following is a key element of an effective security awareness training program?

Tailoring content to the specific risks and roles within the organization

Focusing exclusively on technical staff

Delivering training only once during employee onboarding

Using complex technical jargon to ensure depth

A company has a security policy that states 'all employees must complete security awareness training annually.' The training department has created a detailed, step-by-step guide on how to enroll in and complete the training. The security team has also published a document recommending that employees use a password manager. Which three types of documents are represented in this scenario?

Policy, standard, and guideline

Guideline, procedure, and standard

Policy, procedure, and guideline

Standard, procedure, and policy

Certified Information Systems Auditor

Domain 5Objective 1

Security Frameworks and Governance CISA Practice Questions (Page 3)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

24questions here

5free pages

4concepts

26%of the exam

Questions 11–15

11application · medium
A retail company has a high rate of employees writing down passwords on sticky notes. The security team wants to implement a training program to address this behavior. Which training objective is most directly aligned with this issue?
Select an answer first
12foundation · easy
Which of the following is a key element of an effective security awareness training program?
Select an answer first
13application · easy
An organization is implementing a new access control system. The security team has written a document that specifies the exact steps an administrator must follow to grant a new user access. Which type of document is this?
Select an answer first
14expert · hard
A company has a security policy that states 'all employees must complete security awareness training annually.' The training department has created a detailed, step-by-step guide on how to enroll in and complete the training. The security team has also published a document recommending that employees use a password manager. Which three types of documents are represented in this scenario?
Select an answer first
15foundation · easy
An organization wants to adopt a framework that provides a structured approach for aligning IT governance with business objectives while also incorporating security and risk management. Which framework is most appropriate for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.

Security Frameworks and Governance CISA Practice Questions (Page 3)

Questions 11–15

A retail company has a high rate of employees writing down passwords on sticky notes. The security team wants to implement a training program to address this behavior. Which training objective is most directly aligned with this issue?

Which of the following is a key element of an effective security awareness training program?

An organization is implementing a new access control system. The security team has written a document that specifies the exact steps an administrator must follow to grant a new user access. Which type of document is this?

An organization wants to adopt a framework that provides a structured approach for aligning IT governance with business objectives while also incorporating security and risk management. Which framework is most appropriate for this purpose?

Keep studying — Protection of Information Assets