27 Security Awareness · Security+

Exam objective 5.6: Given a scenario, apply security awareness concepts to improve organizational security.

This objective covers the human side of security: how an organization trains its people, how it delivers that training, how it measures whether training is changing behavior, and which topics an effective program must address. The objectives list four types of training (initial/onboarding, ongoing, targeted, and corrective), four delivery methods (learning management systems, self-service portals, one-to-one, and one-to-many), three ways to report on and monitor effectiveness (metrics, managerial reports, and personnel behavior risk scoring), and nine topics ranging from social engineering and business email compromise to removable media, situational awareness, and operational security.

This is a "given a scenario" objective, which means the exam will describe a situation—a spike in phishing clicks, a user who plugged in a found USB drive, a remote worker on hotel Wi-Fi, an executive targeted by a fake wire request—and ask you to choose the most appropriate training type, delivery method, metric, or behavior. Focus on matching the right response to the situation: who needs training, what kind, delivered how, and how you will know whether it worked.

Why Security Awareness Matters

Attackers target people because people are often easier to exploit than hardened systems. Phishing, pretexting, business email compromise, and credential theft remain among the most common initial access vectors in breach investigations year after year. A well-configured email gateway might stop 99 percent of malicious messages, but the remaining 1 percent lands in front of a person who must decide whether to click, reply, or report.

A security awareness program aims to turn every employee into a layer of defense in depth (Chapter 1). Its goals are to:

Inform people about the threats they face and the policies they must follow.
Change behavior so that secure actions become habits rather than afterthoughts.
Build a reporting culture in which people report suspicious activity quickly and without fear of blame.
Satisfy compliance requirements, since many regulations and standards (PCI DSS, HIPAA, ISO/IEC 27001, and others) require documented security training (Chapter 25).

It helps to distinguish three levels of learning that often appear in security program literature:

Level Purpose Audience Example

Awareness Focus attention on security; recognize threats

Everyone Posters, short videos, phishing simulations, newsletters

Training Teach specific skills needed for a

role

Employees with particular responsibilities

Secure coding for developers; identity verification for help desk staff

Education Build deep understanding and judgment

Security professionals

Certifications, degree programs, advanced courses

The SY0-801 objective uses "training" broadly to cover all of these, but the distinction helps you choose the right answer: awareness reaches everyone, while role-based training reaches the people whose jobs carry specific risks.

Note

Security awareness is a managerial control when it exists as a policy requirement and an operational control when it is delivered and practiced day to day (Chapter 1). The policy that mandates training is typically part of the information security policy or acceptable use policy (Chapter 22), and acknowledgements and attestations that users have completed it are compliance monitoring tools (Chapter 25).

Types of Training

The objectives list four types of training. Each answers a different question about when and why a person receives training.

Initial/Onboarding Training

Initial or onboarding training is delivered when a person joins the organization—or when a contractor, intern, or vendor first receives access—and before or shortly after they receive access to systems and data. It establishes a security baseline for every new member of the workforce.

Onboarding training typically covers the acceptable use policy (with a signed acknowledgement), recognizing and reporting phishing, password and MFA requirements, data classification and handling (Chapter 12), physical security expectations such as badge use, and how to contact the security team. Many organizations require onboarding training to be completed before account activation or within a short window (for example, the first five days), and they automatically suspend access if it is not completed. This ensures no one handles sensitive data without knowing the rules.

Ongoing Training

Ongoing training continues throughout employment because threats change and knowledge fades. A single onboarding session cannot keep pace with new attack techniques such as AI-generated voice deepfakes or QR code phishing.

Ongoing training usually includes annual refresher training (often required for compliance), microlearning modules of two to five minutes delivered weekly or monthly, regular phishing simulations, and newsletters and campaigns around timely threats such as tax-season scams. Spaced repetition beats one-time cramming, which is why modern programs favor frequent, short touchpoints that keep security top of mind.

Targeted Training

Targeted training is tailored to specific roles, groups, or risks rather than delivered identically to everyone. Different people face different threats and hold different privileges, so effective programs aim content at those risks.

Examples include:

Executives and their assistants — whaling, deepfake impersonation, and travel security.
Finance and accounts payable staff — business email compromise, invoice fraud, and payment verification.
Help desk staff — identity verification before password resets and MFA changes, and resisting vishing.
Developers — secure coding, secrets management, and dependency risks.
Administrators and HR staff — privileged access practices and handling of personal data. Targeted training is also used for groups identified as higher risk by metrics or behavior risk scoring, such as a department with a high phishing click rate.

Corrective Training

Corrective training is delivered in response to a specific mistake or policy violation, such as clicking a link in a phishing simulation, failing to lock a workstation, mishandling sensitive data, or plugging an unknown USB drive into a corporate laptop. It addresses the specific behavior, explains why it was risky, and shows the correct response.

Corrective training is most effective when it is:

Immediate — delivered at the "teachable moment," such as a landing page that appears right after a simulated phishing click.
Specific — focused on the exact mistake rather than a generic course.
Non-punitive in tone — framed as learning rather than humiliation, so users continue to report incidents rather than hide them.

Repeated failures may escalate to one-to-one coaching, manager involvement, or, ultimately, HR action according to policy. But a program that punishes too harshly discourages reporting, which is the single most valuable behavior a user can contribute.

Figure 27.1: Onboarding, ongoing, targeted, and corrective training are triggered at different points in employment, and repeated failures escalate

Training type

Trigger Audience Example scenario
Initial/
onboardin
g

Joining the organization or gaining access

All new staff, contractors, vendors

New hire must complete security basics before receiving VPN access

Ongoing Calendar schedule and new
threats
Entire workforce Monthly five-minute module on QR code phishing

Targeted Role, privilege, or identified risk

Specific groups Accounts payable staff trained on verifying bank detail changes

Corrective A specific mistake or violation

Individuals who erred

User who entered credentials on a simulated phishing page receives an immediate micro-lesson

Read the trigger in the scenario. "A new contractor starts Monday" points to onboarding. "Annual requirement" or "keep staff current" points to ongoing. "The finance department" or "developers" points to targeted. "After the user clicked" or "following the violation" points to corrective.

Delivery Methods

The objectives list four delivery methods. The right choice depends on audience size, content complexity, the need for interaction, tracking requirements, and cost.

Learning Management System (LMS)

A learning management system (LMS) is a software platform that hosts, delivers, assigns, and tracks training. Security teams use an LMS to assign courses to users or groups, send reminders, record completion dates and quiz scores, and generate compliance reports.

The LMS's greatest strength is tracking and evidence. When an auditor asks for proof that every employee completed annual training, the LMS report provides it. LMS platforms often integrate with identity systems so that new hires are automatically enrolled in onboarding courses and with HR data so that reports can be broken down by department or manager. Many security awareness vendors combine an LMS with a phishing simulation platform so that a failed simulation can automatically assign a corrective module.

The weakness of LMS-delivered content is that it can become "click-through" training that people complete without engagement. Short, interactive, scenario-based modules help counter this.

Self-Service Portals

A self-service portal is a resource that users access on demand when they need it—an intranet security page, a knowledge base, a searchable FAQ, or a "how do I report this?" page. Portals typically offer guides (how to set up MFA, how to use the password manager, how to encrypt a file before sending), policy documents, video libraries, and a simple way to report suspicious emails or incidents. Self-service portals support just-in-time learning: a user about to travel can look up travel security guidance, or a user unsure about an email can check the reporting procedure. They reduce help desk load and empower users, but they depend on users seeking them out, so they complement rather than replace assigned training.

One-to-One

One-to-one delivery is individualized training between a trainer or security professional and a single learner. It is the most personal and adaptable method, allowing the trainer to tailor content, answer questions, and confirm understanding in real time.

One-to-one delivery is ideal for corrective coaching of repeat offenders, tailored briefings for executives and other high-value targets, training privileged users on sensitive procedures, and supporting a user who fell for a real attack. Its drawback is cost: it does not scale to a whole workforce.

One-to-Many

One-to-many delivery reaches many learners at once from a single trainer or source: live presentations, webinars, town halls, lunch-and-learn sessions, recorded videos, all-staff emails, posters, and newsletters. It is cost-effective for broad awareness messages and timely threat alerts, and live sessions allow questions and discussion.

Its drawbacks are less personalization and, for passive formats, lower engagement and harder tracking (attendance can be recorded, but comprehension is difficult to verify).

Method Strengths Weaknesses Best fit

LMS Scalable, assignable, tracks completion and scores for compliance

Can become click-through; limited interaction

Onboarding, annual compliance training, automated corrective modules

Self-service portal

On-demand, just-in-time, reduces help desk load

Relies on users to seek it

out

Reference guides, how-to content, reporting instructions

One-to-onePersonalized, interactive, confirms understanding

Expensive, does not scale

Corrective coaching, executives, privileged users

One-to-manyEfficient for large audiences, good for urgent messages

Less personal, harder to verify comprehension

Town halls, webinars, threat alerts, campaigns

Real-world scenario

A manufacturing company discovers that attackers are calling its plant offices posing as IT support and asking workers to read back MFA codes. The security team takes three actions. First, it sends an all-staff alert and holds a short live briefing at each shift change (one-to-many) to warn everyone immediately. Second, it assigns a five-minute vishing module through the LMS to every employee, giving it completion evidence for the auditors. Third, the two employees who had already read codes to the caller receive one-to-one coaching with a security analyst. The intranet's security page (self-service portal) is updated with a clear statement that IT will never ask for an MFA code and a button to report suspicious calls.

Reporting and Monitoring Effectiveness

Training that does not change behavior has little value. The objectives list three ways to report on and monitor effectiveness: metrics, managerial reports, and personnel behavior risk scoring.

Metrics

Metrics are quantitative measurements that show whether the program is working. Good metrics measure behavior and outcomes, not just activity.

Metric What it measures What good looks like

Training completion rate

Percentage of assigned users who completed training

on time

Near 100 percent; required for compliance evidence

Phishing simulation click rate

Percentage of recipients who clicked a simulated malicious link

Decreasing over time

Credential submission rate

Percentage who entered credentials on a simulated phishing page

Decreasing; more serious than clicking

Reporting rate Percentage of recipients who reported the simulated phish

Increasing; ideally higher than the click rate

Time to report How quickly the first users report a phish Decreasing; fast reports let the SOC act before others click

Repeat offender rate Users who fail multiple simulations Decreasing

Real incident reports Number and quality of genuine suspicious-activity reports

Increasing, with a higher proportion of true positives

Security incidents caused by human error

Real incidents attributed to user actions Decreasing

Quiz and assessment scores

Knowledge retained after training Increasing

Completion rate is the easiest metric to collect but the weakest indicator of effectiveness: it proves people finished the course, not that they learned anything. The reporting rate is widely considered one of the most valuable metrics, because every reported phish is an early warning that lets the security team pull similar messages from other mailboxes and block the sender before more damage occurs.

Exam tip

If a question asks for the BEST measure of whether awareness training is changing behavior, prefer behavior-based metrics (phishing click rate trends, reporting rates, incidents caused by user error) over activity metrics (number of courses assigned, training hours delivered, or completion rates). A falling click rate is not automatically good news. If simulations become predictable (same sender, same time of month), users learn to spot the test rather than the threat. Vary difficulty and themes, and watch the reporting rate alongside the click rate.

Managerial Reports

Managerial reports translate program data into information that leaders can act on. Different audiences need different views:

Executives and the board need high-level trends and risk posture: Is human-related risk going up or down? How do we compare with industry benchmarks (Chapter 26)? Are we meeting compliance obligations?
Department managers need to know which of their team members are overdue on training or repeatedly failing simulations, so they can follow up.
Compliance and audit need evidence: completion records, acknowledgements, dates, and policy attestations.
The security team needs operational detail to adjust content, target training, and tune simulations.

Effective managerial reports show trends over time rather than single snapshots, compare departments or regions, highlight exceptions that need action, and tie awareness results to business risk. A report that says "Accounts payable reporting rate rose from 18 percent to 61 percent after targeted BEC training, and two real fraudulent invoice attempts were reported and blocked this quarter" is far more persuasive than "1,422 courses completed."

Personnel Behavior Risk Scoring

Personnel behavior risk scoring assigns each person (or group) a risk score based on observed security behaviors, so the organization can focus attention where human risk is highest. Inputs often include:

Phishing simulation results (clicks, credential submissions, reports).
Training completion and quiz scores.
Real security events tied to the user, such as malware detections, DLP alerts, blocked web requests, or policy violations.
Access level and exposure—a domain administrator or finance approver who clicks carries more risk than a user with limited access.
Positive behaviors, such as reporting genuine phishing or completing optional training, which lower the score.

The score drives action: high-risk users may receive targeted or one-to-one training, more frequent simulations, additional technical controls (such as stricter email filtering, browser isolation, or step-up authentication), or a review of their access. Low-risk users may receive fewer interruptions, which reduces training fatigue.

Figure 27.2: Behavior risk scoring combines several inputs into a score that drives targeted actions and is recalculated over time

Behavior risk scoring is related to user and entity behavior analytics (UEBA) and can feed into adaptive access decisions in a Zero Trust architecture (Chapter 1). It must be implemented carefully: scores should be transparent, used to help rather than shame, protected as sensitive personal data, and handled in line with privacy laws and employee agreements (Chapter 25).

Real-world scenario

A company's behavior risk scores show that 4 percent of users account for more than half of all phishing simulation failures and DLP alerts. Rather than send the whole company another annual course, the security team enrolls those users in a targeted series of short modules, schedules one-to-one sessions for the ten highest scores, and enables browser isolation for links in their email. Six months later, their average score has dropped by half, and the managerial report to the CISO shows the improvement by department.

Security Awareness Topics

The objectives list nine topics that an effective program should cover. Scenario questions often describe one of these situations and ask what a user should do or what training would address it.

Social Engineering

Social engineering manipulates people into taking actions or revealing information that benefits the attacker. Chapters 6 and 8 cover the attack types in depth; awareness training teaches people to recognize the patterns.

Training should cover:

Phishing (email), smishing (SMS), vishing (voice), and quishing (QR codes), plus messages through collaboration tools and instant messaging.
Spear phishing aimed at specific individuals and whaling aimed at executives.
Pretexting and impersonation, such as callers posing as IT support, vendors, auditors, or executives.
Physical techniques such as tailgating, shoulder surfing, and dumpster diving.
Deepfakes—synthetic voice or video impersonating a known person.

The most important lesson is to recognize the psychological levers attackers pull:

Principle How attackers use it Red flag phrase

Authority Pose as an executive, auditor, or law enforcement

"This is the CEO; do this now."

Urgency Create time pressure to prevent careful thought

"Your account will be deleted in one hour."

Scarcity Offer a limited opportunity "Only the first 50 staff get the bonus."

Familiarity/

liking

Pretend to be a friendly colleague "Hi, it's Sam from IT, we met last week."

Social proof (consensus)

Claim others have already complied "Everyone in your department has updated."

Intimidation Threaten consequences "Failure to respond will result in legal action."

Trust Abuse a known brand or relationship Spoofed vendor or bank branding Users should be taught a simple response: stop, verify through a separate known channel, and report. They should know exactly how to report (for example, a "Report Phish" button in the email client) and that reporting is always welcome, even when they are unsure or have already clicked.

Emerging Security Topics

Emerging security topics are new threats and technologies that users need to understand as they arise. Programs should be updated continually rather than reusing the same content year after year. Current examples include:

Generative AI misuse — AI-written phishing with perfect grammar (making old "look for spelling mistakes" advice unreliable), deepfake voice and video, and synthetic identities.
Safe use of AI tools — not pasting confidential data, source code, or customer information into unapproved AI services, and verifying AI output before relying on it (Chapter 9).
MFA fatigue and push bombing — repeated MFA prompts intended to make a user approve one just to stop them.
QR code phishing — malicious QR codes in emails, posters, or parking meters that bypass link scanning.
Adversary-in-the-middle phishing kits that steal session cookies to bypass MFA.
Supply chain and vendor-impersonation attacks.

Emerging-topic content is often delivered through quick one-to-many alerts and short ongoing modules, because waiting for the next annual course leaves users exposed.

Note

Advice changes as threats evolve. Spotting typos used to be a reliable phishing clue; with AI-generated text, it is much less so. Modern training emphasizes context (unexpected request, unusual channel, pressure, payment or credential request) over surface features.

Password and Credential Management

Password and credential management training teaches users to create, protect, and use credentials securely (Chapter 18 covers the technical controls). Key points include:

Use long passphrases rather than short complex passwords; length matters more than complexity.
Never reuse passwords across sites, since a breach of one site enables credential stuffing against others.
Use the organization-approved password manager to generate and store unique passwords.
Enable MFA everywhere, and prefer phishing-resistant methods such as passkeys or FIDO2 security keys where available.
Never share credentials or MFA codes with anyone, including IT staff; legitimate IT will not ask.
Deny unexpected MFA prompts and report them, because an unexpected prompt means someone else has your password.
Change a password immediately and report if it may have been exposed.
Do not store passwords in browsers on shared machines, in plaintext files, or on sticky notes.

Remote Work, Teleworking, and Hybrid Work

Remote, teleworking, and hybrid arrangements move work outside the controlled office environment. Training should cover:

Secure connections — use the corporate VPN or zero trust access client; avoid untrusted public Wi-Fi or use it only through the VPN; secure the home router with a strong admin password, WPA3 (or WPA2) encryption, and current firmware.
Physical privacy — lock screens when stepping away, use privacy screens in public, keep confidential calls private, and be aware of smart speakers and family members.
Device separation — do not let family members use company devices, and keep work data off personal devices unless permitted by policy.
Secure printing and disposal — avoid printing sensitive documents at home or shred them properly.
Video conferencing hygiene — check what is visible on camera and screen share, and use meeting passcodes or waiting rooms.
Travel — be careful at hotels, airports, and cafes; never leave devices unattended. Bring Your Own Device (BYOD)

BYOD allows employees to use personal devices for work. Training must explain the BYOD policy (Chapter 22) and the user's responsibilities:

Enroll the device in mobile device management (MDM) or install the required management or containerization app before accessing corporate data.
Keep the operating system and apps updated, and use a strong screen lock and biometrics.
Install apps only from official app stores; do not jailbreak or root the device.
Understand that corporate data may be stored in a separate container and that the organization may remotely wipe corporate data (or the whole device, depending on policy) if it is lost, stolen, or the employee leaves.
Report a lost or stolen device immediately.
Understand the privacy boundaries—what the organization can and cannot see on a personal device.

Business Email Compromise (BEC)

Business email compromise (BEC) is fraud in which an attacker uses a compromised or spoofed business email account to trick employees into sending money or sensitive data. Unlike mass phishing, BEC messages often contain no malware or links, so they easily pass email filters. They rely entirely on persuasion and trust.

Common BEC patterns include CEO fraud (an "executive" requests an urgent, confidential wire), vendor invoice fraud (a compromised or lookalike supplier account sends changed bank details), payroll diversion (an "employee" asks HR to change direct deposit details), gift card requests, and requests for sensitive data such as employee tax forms.

Training should teach users to:

Verify payment and bank detail changes out of band, by calling a known phone number from existing records—never one in the email.
Look for lookalike domains (for example, examp1e.com or example-co.com) and display names that do not match the actual address.
Be suspicious of secrecy and urgency ("keep this confidential, I'm in a meeting").
Follow dual-approval procedures for payments, even when an executive appears to ask for an exception.

Figure 27.3: A BEC-resistant payment procedure checks red flags and verifies requests out of band before any money moves From: "Dana Whitfield, CFO" <dana.whitfield@examp1e-corp.com>

Reply-To: cfo.office.private@freemail.example

Subject: Urgent - confidential wire today

I need you to process a wire to our new acquisition partner before 3 PM.

Please keep this confidential until the announcement. I am in meetings

all afternoon so reply by email only.

The sample above shows classic red flags: a lookalike domain, a Reply-To address that differs from the sender, urgency, secrecy, and an attempt to block verification by phone. Technical controls such as DMARC, SPF, and DKIM (Chapter 14) help against direct spoofing but do not stop lookalike domains or truly compromised accounts, which is why people and procedures remain critical.

An accounts payable clerk receives an email from a long-time supplier stating that its bank has changed and future payments should go to a new account. The email comes from the supplier's real domain and continues an existing thread, because the supplier's mailbox has been compromised. Thanks to targeted BEC training, the clerk follows procedure and calls the supplier's contact using the number stored in the vendor master file. The contact confirms no bank change was requested. The clerk reports the email, the security team alerts the supplier, and a fraudulent payment is avoided.

Removable Media and Cables

Removable media and cables can carry malware or enable data theft. Attackers deliberately leave infected USB drives in parking lots and lobbies (a "USB drop") counting on curiosity, and malicious cables or USB devices can look like ordinary chargers while acting as keyboards that type commands or as wireless implants.

Training should cover:

Never plug in found or unknown USB drives; turn them in to security.
Use only organization-issued, encrypted removable media when policy allows removable media at all.
Do not use unknown charging cables or public USB charging ports; use your own charger plugged into an electrical outlet, or a USB data blocker.
Do not plug unknown devices (gifts, conference giveaways) into corporate systems.
Follow data-handling rules when copying data to removable media, since lost drives are a common cause of breaches.

Technical controls such as endpoint device control, disabled autorun, and DLP (Chapter 14) support this training, but users must understand why the rules exist.

Common trap

A USB drive labeled "Payroll 2026 – Confidential" left in a parking lot is bait. The correct user action is to hand it to the security team unopened, not to plug it into a computer "to find the owner." On the exam, answers that involve plugging in an unknown device are almost always wrong.

Situational Awareness

Situational awareness is the habit of noticing what is happening around you and recognizing when something is out of place. In security, it means users act as sensors who spot and report anomalies. Training should help people recognize:

Physical anomalies — unfamiliar people without badges, tailgating, propped-open doors, unattended packages, or someone photographing screens or whiteboards.
Digital anomalies — unexpected MFA prompts, unusual login notifications, files that suddenly cannot be opened, new browser toolbars, or a computer running unusually slowly.
Behavioral anomalies — requests that bypass normal procedures, a colleague asking for access they do not need, or unusual interest in sensitive projects.
Risky or unexpected behavior in the user's own actions, such as being about to send sensitive data to the wrong recipient.

Operational Security (OPSEC)

Operational security (OPSEC) is the practice of protecting small pieces of information that, combined, could reveal sensitive details to an adversary. The concept comes from the military: individually harmless facts can be aggregated into intelligence.

For employees, OPSEC means being careful about what they share publicly and casually:

Social media — posting about projects, travel plans, office layouts, badge photos, or new systems gives attackers material for targeted phishing and physical intrusion.
Professional networking profiles — detailed lists of internal tools and technologies help attackers plan attacks.
Conversations at conferences, on public transport, or on calls in shared spaces.
Photos and video calls that accidentally show whiteboards, screens, or documents.
Discarded information — documents, printouts, and devices that are not shredded or securely disposed of.

OPSEC connects directly to the passive reconnaissance that attackers and penetration testers perform (Chapter 26): the less the organization leaks publicly, the less material an attacker has for crafting convincing social engineering.

Memory aid

Situational awareness is about noticing what is around you; operational security is about not revealing what is yours. One is looking out, the other is keeping in.

Building a Security Culture

Training types, delivery methods, measurement, and topics come together in a cycle: assess human risk, plan goals and metrics, deliver content, measure results, and improve. Executive support is essential— leaders who complete training, report phishing themselves, and follow verification procedures without demanding exceptions signal that security matters. Positive reinforcement, such as recognizing good reporters and gamifying training, builds a culture in which people want to participate.

Exam tip

When a scenario asks how to improve a program whose completion rates are high but whose phishing failures are not improving, look for answers that make training more engaging, targeted, frequent, and measured by behavior—such as targeted training for high-risk groups, immediate corrective micro-lessons, and tracking reporting rates—rather than simply making the annual course longer.

Chapter Summary

Security awareness turns people into a layer of defense by informing them, changing behavior, building a reporting culture, and meeting compliance requirements.
Training types: initial/onboarding (when someone joins or gains access), ongoing (continuous refreshers and microlearning), targeted (tailored to roles or identified risks), and corrective (in response to a specific mistake, delivered promptly and constructively).
Delivery methods: LMS (scalable, assignable, trackable), self-service portals (on-demand, just-in-time), one-to-one (personal, expensive), and one-to-many (efficient, less personal).
Effectiveness is shown through behavior-based metrics (click rates, reporting rates, time to report, incidents caused by human error), managerial reports tailored to each audience, and personnel behavior risk scoring that focuses effort on the highest-risk individuals.
Topics include social engineering and its psychological levers, emerging threats such as AI-generated phishing and deepfakes, password and credential management, remote and hybrid work, BYOD, BEC with out-of-band verification, removable media and cables, situational awareness, and operational security.
The single most valuable user behavior is quick, blame-free reporting.

Key Terms

Security awareness; awareness versus training versus education; initial/onboarding training; acknowledgement; ongoing training; microlearning; targeted training; role-based training; corrective training; teachable moment; learning management system (LMS); self-service portal; just-in-time learning; one-to-one delivery; one-to-many delivery; metrics; completion rate; click rate; credential submission rate; reporting rate; time to report; repeat offender; managerial report; personnel behavior risk scoring; social engineering; phishing; smishing; vishing; quishing; pretexting; authority; urgency; social proof; deepfake; emerging security topics; MFA fatigue; password manager; passkey; credential stuffing; remote work; teleworking; hybrid work; BYOD; MDM; containerization; remote wipe; business email compromise (BEC); out-of-band verification; lookalike domain; USB drop; malicious cable; USB data blocker; situational awareness; operational security (OPSEC); security culture.

Review Questions

1. A user enters credentials on a page reached from a simulated phishing email. Immediately afterward, the user sees a short page explaining the red flags in the email and is assigned a three-minute module on credential phishing. Which type of training is this?

A. Initial/onboarding
B. Ongoing
C. Targeted
D. Corrective

2. An organization must prove to auditors that every employee completed annual security training and acknowledged the acceptable use policy. Which delivery method BEST supports this requirement?

A. One-to-many town hall presentations
B. A learning management system
C. A self-service portal of security guides
D. Posters in common areas

3. A security manager wants to know whether the awareness program is actually reducing risk. Which of the following metrics would provide the BEST evidence? (Select TWO.)

A. Number of training modules purchased this year
B. Trend in phishing simulation click rates
C. Total hours of training delivered
D. Percentage of users who report simulated phishing emails
E. Number of posters displayed in offices

4. An accounts payable clerk receives an email from a known supplier's real email address requesting that future payments be sent to a new bank account. What should the clerk do FIRST?

A. Reply to the email and ask the supplier to confirm the change
B. Update the bank details because the email came from the supplier's real domain
C. Call the supplier using the phone number already on file to verify the request
D. Forward the email to the CFO for approval

5. A company's analysis shows that a small group of employees with privileged access fail most phishing simulations and trigger frequent DLP alerts. Which approach would MOST efficiently reduce this risk?

A. Require the entire company to repeat annual training
B. Use personnel behavior risk scoring to assign targeted and one-to-one training to the high-risk group
C. Stop running phishing simulations to reduce user frustration
D. Post a reminder about phishing on the self-service portal

6. An employee finds a USB drive labeled "Executive Bonuses" in the parking garage. What is the BEST action?

A. Plug it into a non-domain computer to identify the owner
B. Scan it with antivirus before opening it
C. Turn it in to the security team without plugging it in
D. Throw it away

7. The CISO asks for a quarterly report for the board that shows whether human-related security risk is improving and how departments compare. Which reporting element does this BEST describe?

A. Personnel behavior risk scoring
B. Managerial reports
C. Corrective training
D. Self-service portal analytics

8. Attackers have started sending emails with QR codes that lead to fake login pages, and the existing annual training does not mention this technique. Which TWO actions would BEST address this? (Select TWO.)

A. Wait for next year's annual training update
B. Send an all-staff alert describing the QR code phishing technique
C. Add a short module on QR code phishing to ongoing training
D. Disable all mobile devices
E. Assign corrective training to every employee

9. A software engineer posts a detailed list of the company's internal tools, cloud platforms, and VPN product on a professional networking site. Which security awareness topic is MOST relevant?

A. Removable media
B. Operational security
C. BYOD
D. Password management

10. An employee working from a coffee shop notices someone repeatedly glancing at the laptop screen and positioning a phone toward it. Which concept is the employee demonstrating by noticing this?

A. Situational awareness
B. Operational security
C. Corrective training
D. Benchmarking

11. A company is about to allow employees to access email on personal smartphones. Which training content is MOST important to include? (Select TWO.)

A. Requirement to enroll the device in MDM before accessing company data
B. How to configure a home router's firewall
C. That the company may remotely wipe corporate data if the device is lost
D. How to perform a penetration test on the phone
E. How to bypass the device's screen lock if forgotten

12. A new group of contract developers begins work next week and will have access to the source code repository. Which combination of training types is MOST appropriate before they begin committing code?

A. Corrective training only
B. Initial/onboarding training plus targeted secure coding training
C. Ongoing training only
D. One-to-many town hall attendance only

Answers and Explanations

1. D. Training delivered in direct response to a specific mistake—here, submitting credentials to a simulated phishing page—is corrective training, ideally delivered immediately at the teachable moment. Onboarding occurs when someone joins, ongoing training follows a schedule, and targeted training is aimed at roles or groups before mistakes occur.
2. B. An LMS assigns training, records completion dates and acknowledgements, and produces reports that serve as audit evidence. Town halls, self-service portals, and posters can raise awareness but do not reliably track individual completion.
3. B, D. Click rate trends and reporting rates measure changes in actual behavior. Modules purchased, hours delivered, and posters displayed measure activity or spending, not whether people behave more securely.
4. C. Bank detail changes must be verified out of band through a known, independently sourced contact method. The supplier's mailbox may be compromised, so replying to the email or trusting the real domain would confirm nothing. Forwarding to the CFO does not verify the request with the supplier.
5. B. Behavior risk scoring identifies the individuals carrying the most human risk so that targeted and one-to-one training can focus there, which is more efficient and effective than retraining everyone. Stopping simulations removes visibility, and a portal post relies on high-risk users seeking it out.
6. C. Unknown removable media may contain malware or a malicious device that acts as a keyboard, so it should be handed to security unopened. Plugging it into any computer, even after antivirus scanning, risks compromise. Throwing it away loses the chance to investigate a possible targeted attack.
7. B. A managerial report summarizes program results, trends, and comparisons for leadership decision-making. Behavior risk scoring may feed such a report, but the board-level summary itself is a managerial report. Corrective training and portal analytics do not describe board reporting.
8. B, C. An all-staff alert (one-to-many) warns users quickly, and adding the technique to ongoing training ensures lasting coverage of this emerging topic. Waiting a year leaves users exposed, disabling all mobile devices is disproportionate, and corrective training is for people who made a mistake.
9. B. Publicly listing internal technologies gives attackers reconnaissance material; avoiding such disclosure is operational security. Removable media, BYOD, and password management are unrelated to what the engineer posted.
10. A. Noticing a possible shoulder-surfing attempt is situational awareness—recognizing anomalies in one's surroundings. Operational security concerns not revealing information; the employee's next step (moving or using a privacy screen) applies both concepts, but noticing the threat is situational awareness.
11. A, C. BYOD training should explain MDM enrollment requirements and the organization's ability to remotely wipe corporate data, so users understand their obligations and privacy trade-offs. Home router configuration is a remote work topic, penetration testing is not a user responsibility, and bypassing a screen lock undermines security.
12. B. New contractors need onboarding training covering policies and basic security before receiving access, plus targeted secure coding training because their role carries specific risk. Corrective training responds to mistakes, ongoing training alone omits the onboarding baseline, and a town hall alone provides neither role-specific content nor completion tracking.