1.7 - Support And/or Implement Security Awareness and Training (e.g., Social Engineering/phishing/tabletop Exercises/awareness Communications) SSCP Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   What is the first step you should take when you suspect an email is a phishing attempt?

   • AClick the link to see where it leads
   • BReply to the sender to ask if the email is legitimate
   • CDelete the email immediately without telling anyone
   • DReport it to the appropriate security team or use the organization's reporting channel
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security manager is planning a tabletop exercise to test the incident response plan for a ransomware attack. The exercise must not disrupt normal business operations, but it must be realistic enough to challenge the participants. The manager has a limited budget and cannot use a third-party facilitator. What is the MOST appropriate approach for this exercise?

   • AConduct a full-scale simulation that involves shutting down a test environment
   • BCancel the exercise and rely on the documented incident response plan
   • CUse a discussion-based format with a facilitator from the internal security team who presents a scenario and injects
   • DSend the incident response plan to all participants and ask them to review it independently
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A security team is reviewing the results of its latest phishing simulation. The click rate is 10%, but the reporting rate is only 15%. The team is concerned that employees are not reporting phishing attempts. Which of the following is the MOST likely reason for the low reporting rate, and what is the BEST action to address it?

   • AThe phishing simulation is too easy to detect; make it more sophisticated
   • BThe reporting process is too complex; remove the reporting requirement entirely
   • CEmployees are not recognizing the emails as phishing; provide more training on identifying phishing indicators
   • DEmployees are recognizing the emails but are not motivated to report them; simplify the reporting process and emphasize its importance
   Reveal Solution Discussion Select an answer first