5.4 - Understand Security Awareness Training CC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An organization is planning to enforce multi-factor authentication (MFA) for all employees. The security team is concerned about user resistance and the potential for help desk overload. Which implementation approach best addresses these concerns while maintaining security?

   • AImplement MFA for all employees at once, with no prior training, to ensure immediate security.
   • BMake MFA optional for employees who find it inconvenient.
   • CDelay MFA implementation until the next fiscal year to allow more time for planning.
   • DRoll out MFA in phases, starting with a pilot group, and provide training and support resources before and during the rollout.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An employee receives an email that appears to be from the CEO, urgently requesting the employee's login credentials for a 'confidential project.' The employee is suspicious. Which action should the employee take?

   • AReport the email to the security team and verify the request through a known official channel.
   • BProvide the credentials because the request is urgent and from the CEO.
   • CReply to the email asking for more details about the project.
   • DCall the phone number provided in the email signature to verify the request.
   Reveal Solution Discussion Select an answer first
4. 18foundation · medium

   Why is ongoing security awareness training critical for regulatory compliance?

   • AIt guarantees the organization will pass all compliance audits
   • BIt demonstrates due diligence in reducing human-related risks
   • CIt ensures employees never make mistakes
   • DIt replaces the need for technical security audits
   Reveal Solution Discussion Select an answer first
5. 19foundation · medium

   Why does security awareness training emphasize multi-factor authentication (MFA) as part of password protection?

   • AIt allows employees to share passwords securely
   • BIt makes passwords easier to remember
   • CIt eliminates the need for passwords entirely
   • DIt provides an additional layer of security beyond the password
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security manager is evaluating the effectiveness of the company's security awareness training program. The program currently consists of an annual online course that employees complete independently. The manager wants to improve the program to better reduce the risk of social engineering attacks. Which change would most likely improve the program's effectiveness?

   • AIncrease the frequency of the annual course to a semi-annual course.
   • BRequire employees to sign an acknowledgment that they have read the security policy.
   • CAdd simulated phishing campaigns that send realistic phishing emails to employees and provide immediate feedback to those who fall for them.
   • DMake the annual course longer and more detailed to cover more topics.
   Reveal Solution Discussion Select an answer first