A security tester is preparing to conduct a social engineering assessment for a client. The client's management is skeptical about the value of such tests, believing that technical controls are sufficient. Which statement BEST explains the role of security awareness in the context of security testing?

Security awareness testing is a way to measure the effectiveness of technical controls

Security awareness testing is a substitute for technical security testing

Security awareness testing helps identify weaknesses in human behavior that technical controls cannot address

Security awareness testing is only useful for compliance purposes and does not provide actionable insights

A security tester is recommending improvements to a client's security awareness program. The client has a high rate of employees falling for phishing emails. Which improvement would MOST directly reduce the risk of successful phishing attacks?

Implement a reporting mechanism that makes it easy for employees to report suspicious emails

Increase the frequency of security awareness training sessions

Implement a technical solution that automatically deletes phishing emails

Conduct regular phishing simulations and provide immediate feedback to employees who click

An organization has a high rate of employees falling for phishing emails. The security team is considering a new awareness campaign. Which approach would MOST effectively leverage human psychology to reduce the success of phishing attacks?

Increase the frequency of phishing simulations to make employees more suspicious of all emails

Implement a reward system for employees who report phishing emails

Teach employees to pause and verify the legitimacy of unexpected requests, especially those creating urgency

Encourage employees to rely on their intuition to spot phishing emails

Certified Tester Security Tester

Domain 6Objective 6

The Importance of Security Awareness CT-SEC Practice Questions (Page 3)

Part of the Human Factors in Security Testing domain, which makes up ~14% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

Questions 11–15

11foundation · easy
Which of the following is a common human-related threat that security awareness aims to mitigate?
Select an answer first
12application · medium
A security tester is preparing to conduct a social engineering assessment for a client. The client's management is skeptical about the value of such tests, believing that technical controls are sufficient. Which statement BEST explains the role of security awareness in the context of security testing?
Select an answer first
13application · medium
A security tester is recommending improvements to a client's security awareness program. The client has a high rate of employees falling for phishing emails. Which improvement would MOST directly reduce the risk of successful phishing attacks?
Select an answer first
14foundation · easy
Which psychological principle is commonly exploited in social engineering attacks?
Select an answer first
15application · medium
An organization has a high rate of employees falling for phishing emails. The security team is considering a new awareness campaign. Which approach would MOST effectively leverage human psychology to reduce the success of phishing attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

The Importance of Security Awareness CT-SEC Practice Questions (Page 3)

Questions 11–15

Which of the following is a common human-related threat that security awareness aims to mitigate?

A security tester is recommending improvements to a client's security awareness program. The client has a high rate of employees falling for phishing emails. Which improvement would MOST directly reduce the risk of successful phishing attacks?

Which psychological principle is commonly exploited in social engineering attacks?

An organization has a high rate of employees falling for phishing emails. The security team is considering a new awareness campaign. Which approach would MOST effectively leverage human psychology to reduce the success of phishing attacks?

Keep studying — Human Factors in Security Testing