1.6 Manage Security Awareness and Training Programs ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A university is implementing a new security awareness program. The IT security team has faced resistance from academic faculty who view mandatory training as an infringement on their academic freedom. The team needs to secure faculty buy-in. What is the most effective strategy?

   • AOffer the training as optional and provide incentives such as gift cards for those who complete it.
   • BExempt faculty from the training and focus only on staff and students.
   • CIssue a directive from the university president making the training mandatory for all faculty.
   • DPartner with respected faculty members to co-develop training content that addresses academic-specific risks, and communicate the benefits in terms of protecting research and intellectual property.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security manager is preparing a quarterly report on the security awareness program for senior management. The report should highlight areas for improvement. Which data would be most useful for identifying weaknesses in the program?

   • AThe overall budget spent on the training program.
   • BThe number of employees who have not completed the training.
   • CA breakdown of phishing simulation click rates by department and by type of phishing email.
   • DThe total number of training hours completed by all employees.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security awareness program has been running for a year. The CISO wants to know if the program is worth the investment. The program includes training, phishing simulations, and awareness campaigns. The security team has collected data on completion rates, quiz scores, phishing click rates, and incident reports. What is the most important factor to consider when evaluating the program's ROI?

   • AThe total cost of the program compared to the cost of security incidents that were prevented.
   • BThe percentage of employees who completed the training.
   • CThe number of phishing simulations conducted during the year.
   • DThe average quiz score across all employees.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a key element of an effective report on a security awareness program for senior management?

   • AA list of employees who failed the training quiz
   • BA comparison of the program with industry best practices
   • CA detailed list of every training module's content and length
   • DA summary of key metrics, outcomes, and recommended improvements
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which method is most appropriate for gathering data to assess the security training needs of different job roles?

   • AAsking managers to guess which employees are most likely to make mistakes
   • BUsing a single generic training module for all employees without assessment
   • CReviewing recent security incidents and audit findings to identify recurring human-related weaknesses
   • DConducting a survey of employees to self-report their confidence in security topics
   Reveal Solution Discussion Select an answer first