Security Awareness

1. A company's security team sends simulated phishing emails to all 800 employees. The emails contain a link to a fake login page. The system automatically tracks which employees click the link and how many enter credentials. Employees who click immediately receive an automated message explaining the mistake and are directed to a 15-minute training module. What is the primary purpose of this campaign?

A. To punish employees who fail phishing tests with mandatory extended training B. To measure the organization's phishing click rate (susceptibility to phishing) and provide immediate targeted training to users who click, reducing future risk through measurable behavioral improvement C. To test the email filtering system's ability to block phishing emails before they reach employee inboxes D. To identify which employees are insider threats by tracking who attempts to enter credentials into a fake login page

2. A security monitoring system alerts the security team that an employee's account logged in from Brazil at 3 AM local time. The employee has never accessed the system from outside the US, has no travel scheduled, and normal login hours are 8 AM to 6 PM. Which category of anomalous behavior does this represent?

A. Risky behavior; the login from Brazil represents a security risk that could compromise the system B. Unexpected behavior; the login deviates significantly from the user's established normal access patterns — different country, unusual time — indicating possible credential compromise or unauthorized access C. Unintentional behavior; the employee may have accidentally enabled a VPN exit node in Brazil, causing the system to show a foreign IP address D. Insider threat; all login anomalies from unusual locations indicate deliberate insider threat activity

3. A security awareness program tracks the following metrics monthly: what percentage of employees clicked simulated phishing links, what percentage of employees have enrolled in the organization's approved password manager, what percentage of active accounts have MFA enabled, and how many password-sharing incidents were reported. What does tracking these metrics enable the security team to do?

A. Identify which employees are most likely to be insider threats based on their security awareness performance B. Quantitatively measure whether security awareness training is producing behavioral improvements over time, identify areas where additional training is needed, and demonstrate program effectiveness to stakeholders C. Satisfy regulatory compliance requirements that mandate specific phishing click rates and MFA adoption percentages D. Determine which employees should be dismissed for repeated security awareness failures

4. During a security review, a user reports that they accidentally typed "arnazon.com" instead of "amazon.com" while shopping on a personal device during lunch. The security team notes that mistyped domain names can redirect users to malicious sites. Which category of anomalous behavior does typing the wrong domain name represent?

A. Risky behavior; the user was accessing non-work sites during company time, creating security exposure B. Unintentional behavior; the typo was an accidental human error rather than a deliberate security violation or an indicator of compromise — unintentional mistakes can still result in security incidents despite good user intent C. Unexpected behavior; domain typos are not part of the user's normal browsing pattern and deviate from expected behavior D. Social engineering; the user was deceived by a typosquatting attack designed to look like a legitimate site

5. A security team is building a formal security awareness program. They identify that finance employees need specific training on wire transfer fraud and CEO impersonation attacks, while warehouse employees need training on physical security and device handling. All employees receive baseline phishing recognition training. What program design principle is being applied?

A. Compliance mandate integration; the different training tracks are required by separate regulatory frameworks applicable to each department B. Depth of training based on job function; a minimum awareness level is established for all employees and additional role-specific training is layered on top based on each job function's unique security risks C. Security tiering; employees are classified by risk level and receive training proportional to their risk classification D. Threat modeling; the security team is creating a threat model for each department and delivering training corresponding to identified threats

6. A security awareness team receives automated daily reports showing that employee A's workstation uploaded 2.3 GB of data to an external cloud storage service at 11 PM, employee B replaced a system configuration file that controls login behavior, and employee C's account sent 450 emails in 3 minutes. All three of these events were flagged for security review without any human monitoring. Which monitoring approach makes this possible?

A. Manual monitoring by a dedicated security analyst assigned to each employee group B. Automated reporting systems that continuously track security events and generate alerts and reports without manual effort, enabling the security team to review exceptions rather than monitor raw data C. Penetration testing; the security team is actively attacking the environment to discover these behaviors before they become security incidents D. Peer monitoring; employees are trained to report each other's suspicious behavior to the security team

Matching: Security Awareness Concepts

Match each concept (1–4) to its correct description (A–D).

1Phishing Click Rate

2Risky Behavior

3MFA Adoption Rate

4Unexpected Behavior

AActions that create security risk, such as modifying the hosts file, replacing core OS files, or uploading sensitive data to unauthorized external locations

BActions deviating from established normal patterns, such as logins from foreign countries or sudden spikes in data transfer volumes, that may indicate compromised credentials

CPrimary metric from simulated phishing campaigns: the percentage of users who clicked a simulated phishing link, tracking organizational susceptibility over time

DSecurity awareness metric tracking the percentage of user accounts enrolled in multifactor authentication; higher is better

Security Awareness — Quiz