1.6 Manage Security Awareness and Training Programs ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has a high turnover rate in its customer service department. The security team has limited time and budget to train new hires. They need to ensure that new employees are trained quickly without compromising the quality of the training. What is the most effective approach?

   • ADevelop a comprehensive training program that covers all security topics in depth, and require new hires to complete it within their first month.
   • BCreate a condensed, role-specific training module that focuses on the most critical security risks for customer service, such as phishing and data privacy, and deliver it during onboarding.
   • CProvide a general security awareness video that all new hires must watch, regardless of their role.
   • DWait until the employee has been on the job for a few months and then provide training based on observed incidents.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security manager is leading a security awareness program in a company where the executive team is not visibly supportive. The program is struggling to gain traction, and employees see it as a low priority. The manager has limited budget and cannot offer incentives. What is the most effective way to increase executive support and program visibility?

   • ALaunch the program without executive support and hope that employee engagement will increase over time.
   • BSend a series of emails to the executive team explaining the importance of the program and asking for their support.
   • CSchedule a meeting with the executive team to present the program's objectives, metrics, and the risks of not having their support, and propose specific ways they can champion the program.
   • DOutsource the program to a vendor that has experience in executive communication.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of establishing metrics for a security awareness program?

   • ATo compare the program with competitors' programs
   • BTo satisfy regulatory requirements for reporting
   • CTo evaluate the program's effectiveness against its objectives and identify areas for improvement
   • DTo justify the program's budget to finance
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which metric is most directly indicative of a security awareness training program's effectiveness in changing behavior?

   • AThe reduction in the number of successful phishing attacks reported by employees
   • BThe average score on a post-training quiz
   • CThe number of employees who completed the training
   • DThe total cost of delivering the training program
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When launching a new security awareness program, which action best demonstrates tailored stakeholder engagement to secure buy-in from senior executives?

   • ASending a detailed technical report on the latest malware threats to all executives
   • BPresenting the program's alignment with business objectives and risk reduction in financial and operational terms
   • CFocusing exclusively on compliance requirements to avoid legal penalties
   • DRequesting that executives personally attend every training session
   Reveal Solution Discussion Select an answer first