1.6 Manage Security Awareness and Training Programs ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is the primary purpose of identifying key stakeholders for a security awareness program?

   • ATo tailor communication and engagement strategies to the interests and influence of each stakeholder group
   • BTo identify which stakeholders are most likely to resist the program
   • CTo list all employees who must complete mandatory training
   • DTo determine which stakeholders have the authority to approve the program budget
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is about to implement a new policy on remote work security. The security team needs to train all employees, but they have no data on the current level of awareness or the specific risks employees face when working remotely. The budget is limited, and the training must be completed within two weeks. What is the best course of action?

   • ADeploy a baseline training module on remote work security to all employees immediately, and plan to conduct a needs assessment for future iterations.
   • BConduct a comprehensive needs assessment survey and interviews with a sample of employees, then design a tailored training program based on the findings.
   • CHire an external consultant to conduct a needs assessment and develop a custom training program.
   • DSkip the training and rely on a strong policy document that employees must sign.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital network is updating its security training. The training team has anecdotal evidence that phishing is a problem but lacks data on which departments are most susceptible. They need to design targeted training for high-risk groups. What should they do first?

   • AInterview a sample of employees from each department to ask about their phishing awareness.
   • BMandate the same annual security training for all employees to ensure baseline compliance.
   • CConduct a phishing simulation across all departments and analyze the click rates by role and department.
   • DReview security incident reports from the past year and assume the departments with the most incidents are the highest risk.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A global manufacturing company is launching a new security awareness program. The CISO wants to ensure that the program is well-received across different regions and departments. The security team has limited resources and cannot conduct individual meetings with every manager. What should the security team do first to gain buy-in and tailor the program effectively?

   • AIdentify key stakeholders from each region and department, and conduct targeted interviews or focus groups to understand their concerns and needs.
   • BSend a global email to all employees announcing the new program and its mandatory completion date.
   • CDefer the program until the next fiscal year to allow more time for budget approval and stakeholder alignment.
   • DRoll out a generic training module to all employees first, then collect feedback after completion to adjust future iterations.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A retail company has a large workforce of part-time hourly employees who do not have corporate email accounts. The security team needs to deliver a short phishing awareness module to these employees. Which delivery method is most appropriate for this audience?

   • AProvide a printed one-page handout with tips on identifying phishing emails and require a signed acknowledgment.
   • BRequire them to complete an online course on a corporate learning management system (LMS) during their shift.
   • CSend a text message to their personal phones with a link to a short video and a quiz.
   • DDeliver a 10-minute interactive video presentation at the start of each shift, followed by a brief quiz on a shared tablet.
   Reveal Solution Discussion Select an answer first