Security Training CT-SEC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company's training program has been running for a year. The data shows that the overall phishing click rate has dropped from 25% to 10%. However, the click rate for new employees (within their first 3 months) is 30%. The training manager is planning next year's program. Which adjustment is MOST critical to address this specific gap?

   • AReview the training content to ensure it is up-to-date with the latest phishing techniques.
   • BMake the annual training module more difficult to ensure all employees are thoroughly tested.
   • CImplement a mandatory, security-focused onboarding session for all new hires before they are given network access.
   • DIncrease the frequency of the simulated phishing campaign for all employees to monthly.
   Reveal Solution Discussion Select an answer first
2. 27foundation · medium

   What is an example of a qualitative metric for security training effectiveness?

   • AEmployee feedback on the relevance of the training content
   • BThe number of employees who completed the training
   • CThe percentage of employees who passed the assessment
   • DThe average quiz score after training
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security manager must choose a new training delivery method for a company with a highly distributed workforce, a strict budget, and a need to demonstrate a reduction in phishing click rates. The manager is considering two options: (1) a low-cost, self-paced e-learning platform with standard modules, or (2) a more expensive, gamified platform that includes built-in phishing simulations and leaderboards. The manager has budget for only one. Which factor should MOST influence the decision?

   • AThe ease of integrating the platform with the company's existing HR system for tracking completion.
   • BThe preference of the employees for a more engaging, game-like experience.
   • CThe total cost of ownership, as the cheaper option is always the better choice for a strict budget.
   • DThe ability of the platform to provide measurable data on behavior change, such as simulated phishing click rates.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has a mature security training program. The annual simulated phishing campaign shows a steady decline in click rates, but the number of employees who report the simulated emails has also declined. The security team is concerned that employees may be becoming desensitized to the simulations. Which testing method would BEST provide additional insight into this potential desensitization?

   • AConduct a follow-up survey asking employees why they did not report the simulated email.
   • BSwitch to a different vendor for the simulated phishing platform.
   • CIncrease the frequency of the simulated phishing campaigns to monthly.
   • DReview the click rate data to see if it is also declining.
   Reveal Solution Discussion Select an answer first
6. 30foundation · medium

   How does security training for management typically differ from training for general staff?

   • AManagement training is optional and less important than staff training
   • BManagement training is identical to general staff training
   • CManagement training focuses on strategic risk, policy enforcement, and incident response oversight
   • DManagement training only covers technical topics like firewall configuration
   Reveal Solution Discussion Select an answer first