1.6 Manage Security Awareness and Training Programs ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of a segmented training program design?

   • ACreating a single video that covers all security topics and making it available to everyone
   • BOffering a specialized module on secure coding for developers and a separate module on data handling for finance staff
   • CProviding the same annual security refresher course to every employee
   • DHolding an optional security awareness fair for interested employees
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security awareness program includes monthly phishing simulations. After six months, the overall click rate has decreased from 20% to 12%. The security manager wants to determine if this improvement is statistically significant and whether the program is effective. What should the manager do?

   • AAsk employees for feedback on the training to see if they found it useful.
   • BCompare the click rates month over month and declare success if the trend is downward.
   • CIncrease the frequency of phishing simulations to see if the click rate drops further.
   • DConduct a statistical test, such as a chi-square test or a t-test, to determine if the decrease in click rates is statistically significant.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A software development company wants to create a security training program for its engineers. The training team is unsure whether to focus on secure coding practices or general security awareness. They have a limited budget and need to prioritize. What should they do first?

   • AHire an external consultant to deliver a one-time secure coding workshop for all engineers.
   • BConduct a needs assessment that includes a review of common vulnerabilities in the company's codebase and interviews with engineering leads.
   • CRequire all engineers to obtain a security certification, such as CSSLP, to ensure they have the necessary knowledge.
   • DImplement a general security awareness course for all employees, including engineers, to ensure a baseline.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security manager is reviewing the quarterly metrics of the security awareness program. The overall phishing click rate has decreased, but the click rate in the finance department has increased. The manager needs to decide how to respond. What is the most appropriate action?

   • ADiscontinue phishing simulations in the finance department to avoid further negative metrics.
   • BConduct a root cause analysis to understand why the finance department's click rate increased, and then implement targeted training or communication for that department.
   • CIgnore the increase in finance because the overall trend is positive.
   • DIncrease the frequency of phishing simulations for all departments to improve the overall metrics.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security manager needs to report the results of the annual security awareness program to the board of directors. The board is primarily interested in the program's impact on reducing risk and the return on investment. What should the manager include in the report?

   • AA detailed list of all training modules and their content outlines.
   • BA summary of completion rates, quiz scores, and the number of phishing simulations conducted.
   • CA dashboard showing trends in phishing click rates, incident reports, and a comparison of pre- and post-training behavior, along with a narrative on how these changes reduce risk.
   • DAn executive summary that only highlights the number of employees trained and the total cost of the program.
   Reveal Solution Discussion Select an answer first