5.4 - Understand Security Awareness Training CC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   An attacker sends an email that appears to be from the IT department, asking the recipient to verify their password by clicking a link. This is an example of which social engineering technique?

   • ATailgating
   • BBaiting
   • CPhishing
   • DPretexting
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A multinational corporation operates in a region with strict data protection regulations. The security team must implement a security awareness training program that satisfies regulatory requirements and effectively reduces human error. The budget is limited, and the workforce is diverse, with varying levels of technical proficiency. Which approach best balances these constraints?

   • AImplement a one-time, company-wide training video that all employees must watch, with no follow-up or assessment.
   • BDevelop a mandatory, role-based training program that is delivered in multiple languages and includes practical exercises, with completion tracked for compliance.
   • COutsource training to a vendor that provides a generic, off-the-shelf course for all employees, regardless of role or language.
   • DFocus training only on employees in high-risk roles, such as finance and HR, to save costs.
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   Which practice best aligns with password hygiene principles taught in security awareness training?

   • AUsing the same password for multiple accounts to remember it easily
   • BUsing a unique, complex password for each account and enabling multi-factor authentication
   • CWriting passwords on a sticky note under the keyboard
   • DSharing passwords with colleagues for convenience
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A small business wants to build a security-conscious culture among its employees. The budget is limited, and the owner wants the most effective starting point. Which initiative should the owner implement first?

   • ACreate a security policy document and store it on the company intranet.
   • BHire a dedicated security officer to handle all security matters.
   • CPurchase an expensive security information and event management (SIEM) system to monitor all network activity.
   • DImplement a mandatory, brief security awareness training module for all employees, followed by periodic refreshers.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization must comply with regulations that require workforce training on security and privacy. The security team wants to ensure that training is effective and not just a checkbox exercise. Which approach best meets this requirement?

   • ASend a one-time email with a link to a security policy document and require a read receipt.
   • BPost security posters in common areas and assume employees will read them.
   • CConduct training only when a security incident occurs.
   • DDeliver annual training that includes real-world scenarios and assesses employee understanding through quizzes.
   Reveal Solution Discussion Select an answer first