Increasing Security Awareness CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A large organization with a mature security team wants to reduce the risk of social engineering attacks. They have already implemented simulated phishing campaigns and annual training. However, the click rate remains high. The security team is considering a new approach. Which approach is most likely to be effective, given the existing measures?

   • AReplace the annual training with a more entertaining, gamified online module
   • BImplement a technical control that blocks all emails containing links from external senders
   • CIncrease the frequency of the simulated phishing campaigns to weekly
   • DAnalyze the characteristics of the emails that employees click on and tailor training to those specific patterns
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A security tester is asked to design an awareness program for a company that develops software for the healthcare industry. The company has a high turnover of developers and a mix of junior and senior staff. The tester must ensure that the program is effective and sustainable. Which design principle is most important for this context?

   • ACreate a continuous, role-based training program with regular updates and refreshers for all staff
   • BProvide a large library of optional security resources and encourage staff to use them as needed
   • CFocus on a single, comprehensive training event for all new hires to ensure they are fully trained before starting work
   • DRely on on-the-job training from senior developers, as they are the most experienced
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization has a high rate of employees clicking on links in simulated phishing emails. The security team wants to implement a training method that is known to be effective in reducing this behavior. Which approach is most aligned with best practices for awareness training?

   • APost a detailed memo on the intranet explaining the dangers of phishing
   • BImplement a continuous, simulated phishing program with immediate, personalized feedback for those who click
   • CRely on the existing annual security awareness video, which covers phishing briefly
   • DConduct a one-time, mandatory classroom training session on phishing awareness
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A tester is writing a security test report for a non-technical audience, including project managers and business stakeholders. The report contains several critical vulnerabilities. How should the tester apply security awareness principles to communicate the findings effectively?

   • AUse highly technical jargon and detailed exploit code to demonstrate the severity
   • BFocus on the business impact, such as potential data loss or financial cost, and use plain language
   • CMinimize the severity of the vulnerabilities to avoid alarming the stakeholders
   • DList only the technical details and leave the risk assessment to the developers
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of a human factor that can impact security?

   • AA tester falling for a phishing email during a social engineering test
   • BA firewall misconfiguration due to a typo
   • CAn attacker using a zero-day exploit
   • DA server running outdated software
   Reveal Solution Discussion Select an answer first