1.6 Manage Security Awareness and Training Programs ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which training delivery method is most effective for reaching a geographically dispersed workforce with consistent content?

   • ASelf-paced online modules accessible via the corporate learning management system
   • BSending a one-time email with security tips
   • CPosting printed security posters in break rooms
   • DInstructor-led classroom sessions held at headquarters
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm has three distinct employee groups: remote sales staff who use personal devices, back-office data processors who handle sensitive customer data, and executives who have access to merger information. The security team must design a training program that addresses the specific risks of each group. What is the most effective approach?

   • AOutsource training to a vendor that offers a standard security awareness course for all industries.
   • BDevelop one comprehensive training module covering all security topics and require everyone to complete it annually.
   • CCreate three tailored training tracks: one for remote workers on device security and phishing, one for data processors on data handling and privacy, and one for executives on insider threats and confidential information.
   • DProvide the same training to all employees but add an extra module for executives on mergers and acquisitions.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large enterprise is rolling out a new security awareness program. The CISO has mandated that the program be mandatory for all employees. However, the marketing department has a strong culture of autonomy and resents mandatory training. The security team has limited resources and cannot afford to create multiple custom programs. What is the best way to gain marketing's buy-in while still meeting the CISO's mandate?

   • ADelay the rollout for marketing until they can create a fully customized program.
   • BCreate a single, engaging training program that includes marketing-specific examples and scenarios, and communicate the benefits in terms of protecting the company's brand and customer data.
   • CEnforce the mandate strictly and report non-compliance to the CISO.
   • DAllow marketing to opt out of the training if they sign a waiver acknowledging the risks.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When selecting training materials for a security awareness program, which factor is most important to consider?

   • AThe materials must be produced by an external vendor to ensure credibility
   • BThe materials must align with the learning objectives and be appropriate for the target audience's technical level
   • CThe materials must be visually appealing and include the latest graphics
   • DThe materials must be available in both print and digital formats
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After implementing a new security awareness program, the CISO wants to measure its effectiveness in reducing risky behaviors. The program includes training modules and simulated phishing campaigns. Which metric would provide the most direct evidence of behavior change?

   • AThe average score on the end-of-training quiz.
   • BThe number of employees who report phishing emails using the 'Report Phishing' button.
   • CThe number of security incidents reported to the help desk each month.
   • DThe percentage of employees who completed the training modules.
   Reveal Solution Discussion Select an answer first