Security and Privacy CRISC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key benefit of conducting regular security awareness training for all employees?

   • AIt eliminates the need for security policies
   • BIt ensures that all employees become security experts
   • CIt reduces the risk of security incidents caused by human error
   • DIt guarantees compliance with all security regulations
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary role of security standards such as ISO/IEC 27002 in an organization?

   • ATo certify that an organization is completely secure
   • BTo provide a list of mandatory legal requirements
   • CTo replace the need for risk assessments
   • DTo offer best-practice guidance for implementing security controls
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why are security awareness and training programs important for reducing human-related security risks?

   • AThey guarantee that employees will never make mistakes
   • BThey eliminate the need for technical security controls
   • CThey are only required for IT staff, not general employees
   • DThey help employees recognize and avoid common threats like phishing and social engineering
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which security concept ensures that data has not been altered or destroyed in an unauthorized manner?

   • AAvailability
   • BConfidentiality
   • CIntegrity
   • DNon-repudiation
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is developing a security training program. They have different departments: finance, IT, and customer service. Each department has different security risks. What is the most effective approach to developing this training?

   • ADeliver the same generic training to all employees to ensure consistency
   • BCreate role-based training modules tailored to the specific risks of each department
   • CProvide training only to new employees during onboarding
   • DFocus only on the IT department since they handle the most sensitive data
   Reveal Solution Discussion Select an answer first