The Importance of Security Awareness CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security tester is assessing an organization's susceptibility to phishing. The tester sends an email that appears to be from the CEO, asking employees to purchase gift cards for a client. Several employees comply. Which human factor is being exploited in this scenario?

   • AReciprocity, where employees feel obligated to return a favor
   • BSocial proof, where employees follow the actions of others
   • CAuthority bias, where employees are inclined to obey requests from a perceived authority figure
   • DScarcity, where employees feel a sense of urgency to act quickly
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security tester is analyzing the results of a social engineering assessment. The tester finds that employees are more likely to fall for phishing emails that appear to come from a senior executive than from a generic sender. Which psychological principle BEST explains this finding?

   • ASocial proof, where people follow the actions of others
   • BReciprocity, where people feel obligated to return a favor
   • CScarcity, where people are more likely to act when they believe a resource is limited
   • DAuthority bias, where people are more likely to comply with requests from perceived authority figures
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why are human factors considered a significant source of security vulnerabilities?

   • ABecause humans cannot be trained to follow security policies
   • BBecause human errors are impossible to detect in security testing
   • CBecause humans are always the weakest link in any security system
   • DBecause human behavior can be predictable and exploited through psychological manipulation
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a key benefit of implementing a security awareness program?

   • AIt eliminates the need for technical security controls
   • BIt ensures that only IT staff need to follow security policies
   • CIt guarantees that all security incidents are prevented
   • DIt reduces the likelihood of successful social engineering attacks
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security tester is evaluating an organization's resilience to insider threats. The organization has a strong technical security posture, but employees have access to sensitive data as part of their roles. Which combination of factors would MOST likely increase the risk of an insider threat?

   • AEmployees are satisfied with their jobs and have no financial pressures
   • BEmployees are unaware of the importance of protecting sensitive data and there is no monitoring of data access
   • CEmployees receive regular security awareness training and there are strict access controls
   • DThe organization has a strong technical security posture and employees are aware of security policies
   Reveal Solution Discussion Select an answer first