5.4 - Understand Security Awareness Training CC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is creating a password policy to accompany its security awareness training. The goal is to encourage strong, unique passwords without burdening employees. Which policy is most aligned with current best practices?

   • AAllow employees to use the same password for work and personal accounts to reduce the number of passwords they must remember.
   • BRequire passwords to contain at least one uppercase letter, one number, and one special character, with a minimum length of 8 characters.
   • CRequire password changes every 30 days and prohibit reuse of the last 10 passwords.
   • DRequire passwords of at least 12 characters and encourage the use of a password manager.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which statement best describes the role of ongoing security awareness training in mitigating risks?

   • AIt only protects against external threats
   • BIt eliminates all security risks
   • CIt transfers risk to the employees
   • DIt reduces the likelihood of incidents caused by human error
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   How does security awareness training primarily help employees resist social engineering attacks?

   • ABy ensuring employees never communicate with outsiders
   • BBy automatically blocking all social engineering attempts
   • CBy teaching employees to recognize common tactics and respond appropriately
   • DBy providing employees with advanced hacking tools to test attackers
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After a security awareness training session, an employee asks why the organization spends time and money on training when technical controls like firewalls and antivirus are already in place. Which response best addresses this question?

   • ATraining is required by law, so the organization has no choice but to provide it.
   • BTechnical controls cannot prevent all attacks, and employees are often the last line of defense against social engineering.
   • CTechnical controls are ineffective, so training is the only way to protect the organization.
   • DTraining is a way to shift blame to employees if a security incident occurs.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a high rate of employees falling for phishing emails. The security team wants to implement a training program that is both effective and minimally disruptive to productivity. Which strategy best achieves this?

   • ARequire all employees to complete a full-day security training workshop once a year.
   • BSend a monthly email newsletter with security tips and examples of phishing emails.
   • CConduct regular, short training sessions with simulated phishing exercises, and provide immediate feedback to employees who click on simulated emails.
   • DImplement a strict policy that punishes employees who fall for phishing simulations.
   Reveal Solution Discussion Select an answer first