1.12 - Establish and Maintain a Security Awareness, Education, and Training Program CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is updating its security awareness training. The training manager wants to include a section on emerging technologies that employees may encounter. Which topic is most appropriate for a general audience?

   • AA detailed technical guide on how to configure a blockchain node.
   • BA review of the company's existing firewall and intrusion prevention system configurations.
   • CA high-level overview of blockchain technology and its potential use cases in the company's industry.
   • DA tutorial on how to use the company's internal ticketing system.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A university is updating its security awareness training for faculty and staff. The training coordinator wants to include a module on emerging technologies that could impact the institution. Which topic is most relevant to include?

   • AA refresher on the university's password policy and the importance of using a password manager.
   • BThe risks and benefits of using generative AI tools for research and administrative tasks, including data privacy considerations.
   • CA review of the university's acceptable use policy for campus computers.
   • DA case study on a recent phishing attack that targeted another university.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is it important to periodically update security awareness training content to include emerging technologies such as cryptocurrency, artificial intelligence, and blockchain?

   • ATo satisfy employee requests for more interesting training material
   • BTo comply with mandatory legal requirements that all training include these topics
   • CTo ensure employees are aware of the latest threats and safe practices associated with new technologies
   • DTo replace all legacy security training content with new technology topics
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A manufacturing company is reviewing its annual security awareness training. The training manager wants to ensure the content is current and relevant. Which action is the most effective way to identify emerging technology topics that should be added?

   • AConduct a quarterly review of threat intelligence reports and industry publications to identify new attack vectors and technologies.
   • BReuse the previous year's training content to ensure consistency and avoid introducing errors.
   • CAsk the legal department to review the training content for compliance with current regulations.
   • DCompare the training content against a competitor's publicly available training materials.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A large retail organization has a mature security awareness program with mandatory annual training. However, engagement metrics are declining, and the CISO wants to increase participation and knowledge retention. The training team has a small budget and access to the corporate learning management system. Which strategy is most likely to improve engagement and retention?

   • AIntroduce gamification elements such as leaderboards, badges, and short quiz challenges with small rewards for top performers.
   • BReplace the annual training with a longer, more comprehensive course covering all security topics in detail.
   • COutsource the training program to a third-party vendor with a standard, off-the-shelf security awareness package.
   • DMake the annual training mandatory and require a passing score of 100% on the final exam.
   Reveal Solution Discussion Select an answer first