1.12 - Establish and Maintain a Security Awareness, Education, and Training Program CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common metric used to evaluate the effectiveness of a security awareness program?

   • AReduction in the number of successful phishing incidents
   • BMore frequent software updates
   • CHigher employee satisfaction with the cafeteria
   • DIncrease in the number of security policies
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A healthcare organization is launching a new security awareness program. The compliance officer insists on a formal, documented training record for every employee to satisfy audit requirements. The CISO wants to measure actual behavior change, not just completion. The budget is sufficient for one primary method. Which approach best satisfies both the compliance and behavioral objectives?

   • AConduct live, instructor-led workshops and take a paper attendance sheet as the official record.
   • BLaunch a security champions program and ask champions to informally report on their colleagues' security habits.
   • CDeploy a phishing simulation platform that tracks individual user clicks, provides remedial training, and generates a completion report for the compliance officer.
   • DImplement a computer-based training (CBT) module with a final quiz and store the quiz scores in the HR system as the official training record.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a primary reason to include blockchain technology in a security awareness program?

   • ATo replace traditional database training
   • BTo encourage employees to invest in cryptocurrency
   • CTo help employees understand the security implications of blockchain-based applications and transactions
   • DTo teach employees how to mine cryptocurrency
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A software development company wants to improve its secure coding practices. The security team has a limited budget and wants to embed security knowledge within each development team rather than relying solely on central security reviews. Which approach best aligns with this goal?

   • APurchase a static application security testing (SAST) tool and require its output to be reviewed by the security team.
   • BIncrease the frequency of central security code reviews from quarterly to monthly.
   • CMandate a one-time, all-day secure coding bootcamp for every developer.
   • DEstablish a security champions program, selecting a volunteer developer from each team to receive advanced training and act as a local security liaison.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security awareness program includes a module on social engineering. The training team wants to evaluate whether employees can apply the concepts, not just recall them. Which assessment method is best suited for this goal?

   • AA scenario-based assessment where employees must identify a social engineering attempt in a simulated email or phone call.
   • BA review of the training completion certificate to confirm the module was finished.
   • CA multiple-choice quiz asking employees to define social engineering and list common techniques.
   • DA survey asking employees to rate their own confidence in identifying social engineering attacks.
   Reveal Solution Discussion Select an answer first