1.12 - Establish and Maintain a Security Awareness, Education, and Training Program CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A mid-sized company is launching a new security awareness program. The security manager wants to build a culture where employees actively discuss security and help each other. The budget is limited. Which method is most effective for fostering this peer-to-peer culture?

   • AImplement a gamified leaderboard that publicly ranks employees by their security quiz scores.
   • BMandate a monthly, all-staff security webinar delivered by the security team.
   • CDistribute a weekly security newsletter with tips and recent incident summaries.
   • DCreate a security champions network where trained volunteers from each department promote security best practices and act as first points of contact.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has completed its first year of a new security awareness program. The CISO wants to know if the program is actually changing employee behavior. Which metric would provide the most direct evidence of behavior change?

   • AThe percentage of employees who completed the mandatory annual training module.
   • BThe click rate on a controlled, internal phishing simulation campaign conducted before and after the training.
   • CThe average score on the end-of-training knowledge quiz.
   • DThe number of employees who report a reduction in phishing emails to the security team.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which approach involves designating enthusiastic employees from various departments to act as peer advocates who promote security best practices and provide informal guidance to their colleagues?

   • APhishing campaign
   • BSecurity champions
   • CSocial engineering simulation
   • DGamification
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A global company has a security awareness program with a consistently low phishing simulation click rate of 2%. However, a recent real-world phishing attack successfully compromised several users. The CISO is concerned that the low simulation click rate is not predictive of real-world resilience. Which action would best address this concern?

   • AReplace the phishing simulation program with a more comprehensive annual training course.
   • BReport the low click rate to the board as evidence that the training program is effective.
   • CDiscontinue phishing simulations because the low click rate suggests they are no longer needed.
   • DIncrease the difficulty of the phishing simulations to better match the sophistication of real-world attacks.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security awareness program includes a phishing simulation. After the simulation, the security team wants to determine if the training was effective. Which follow-up action provides the most reliable measure of learning?

   • AAsk team managers to report on whether their employees are discussing security more often.
   • BCompare the click rate of the current simulation to the click rate of the previous simulation.
   • CSend a follow-up survey to all employees asking if they found the simulation helpful.
   • DReview the number of employees who completed the simulation to ensure high participation.
   Reveal Solution Discussion Select an answer first