Cyber Security Quiz: Security Awareness Training
10 questions · exam conditions
0:00
Security Awareness TrainingQuestion 1 of 10

An organization reports a 98% annual security-training completion rate and an average quiz score of 94%. During workplace observations, employees continue to leave unlocked workstations unattended and discuss sensitive customer information in public areas.

Which change would provide the BEST evidence that the awareness program is achieving its intended goal?

Increase the passing score and compare average quiz results with the previous annual training cycle.
Require managers to certify that every employee has opened each assigned training module.
Use realistic practice exercises and measure subsequent reductions in the observed unsafe behaviors.
Add more detailed policy language and track the time employees spend viewing the material.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Security Awareness Training

Practice Security Awareness Training in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Security Awareness Training, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An organization reports a 98% annual security-training completion rate and an average quiz score of 94%. During workplace observations, employees continue to leave unlocked workstations unattended and discuss sensitive customer information in public areas.

Which change would provide the BEST evidence that the awareness program is achieving its intended goal?

  1. Increase the passing score and compare average quiz results with the previous annual training cycle.
  2. Require managers to certify that every employee has opened each assigned training module.
  3. Use realistic practice exercises and measure subsequent reductions in the observed unsafe behaviors. (correct answer)
  4. Add more detailed policy language and track the time employees spend viewing the material.
Explanation: When a question asks whether a security awareness program is "achieving its intended goal," you need to focus on behavioral outcomes, not training metrics. The whole point of security awareness training is to change how people actually behave — not how well they perform on a quiz or whether they clicked through a module. The scenario reveals a classic gap: the organization has excellent completion rates and quiz scores, yet employees still leave workstations unlocked and discuss sensitive information publicly. This tells you that knowledge acquisition alone isn't translating into safer behavior. Option C directly addresses this by using realistic practice exercises — think simulated social engineering scenarios or observed drills — and then measuring whether the specific unsafe behaviors decrease afterward. That's a direct, evidence-based link between the training intervention and real-world conduct. Option A is tempting but flawed: raising the passing score and comparing quiz averages still measures knowledge retention, not behavioral change. Scoring higher on a test doesn't mean anyone will actually lock their screen. Option B is similarly misguided — having managers confirm that employees opened modules is a compliance checkbox, not evidence of learning or behavior change. An employee can open every module and still walk away from an unlocked workstation. Option D adds more policy detail and tracks time-on-screen, which measures content exposure, not comprehension or behavior. Spending more minutes staring at a policy document doesn't make someone more likely to follow it. A good study tip: whenever a question involves training or awareness programs, look for answer choices that measure observable behavioral change rather than activity metrics like completion rates, scores, or time spent. Those are outputs, not outcomes.

Question 2

An employee enters credentials on a suspicious website, closes the browser, and says nothing because the employee is unsure whether the site was malicious and fears being blamed. The security team learns about the event two days later.

Which awareness message would BEST reduce the likelihood of a similar delay?

  1. Report suspected mistakes immediately, even when uncertain, because rapid response is more important than assigning blame. (correct answer)
  2. Investigate the website independently and report only after confirming that credentials were captured by an attacker.
  3. Change the affected password quietly and report only if unauthorized account activity becomes visible afterward.
  4. Wait for a supervisor to collect evidence and determine whether the event meets the incident-reporting threshold.
Explanation: Questions like this test your understanding of incident response culture — specifically, the human behaviors that cause reporting delays and how security awareness training can correct them. When you see a scenario where an employee hesitates to report a potential breach, ask yourself: what psychological or procedural barrier caused the delay, and which answer directly removes it? Here, the employee's hesitation came from fear of blame, not lack of knowledge that the event occurred. Answer A directly targets that barrier by decoupling reporting from blame assignment and emphasizing that speed of response matters more than fault. This aligns with a core principle in security operations: a two-day delay in reporting a potential credential compromise gives attackers a significant window to pivot, exfiltrate data, or establish persistence. Removing the stigma around "I might be wrong" is exactly what makes reporting cultures effective. Answer B is dangerous because it tells employees to independently confirm a breach before reporting — most employees lack the forensic tools to do this, and the delay for self-investigation is precisely what security teams are trying to eliminate. Answer C encourages a quiet password change, which destroys the urgency signal and may leave other systems or shared credentials unaddressed; security teams still need to investigate scope. Answer D shifts responsibility to a supervisor and introduces another waiting period, compounding the original delay rather than fixing it. Your study tip: on security awareness questions, watch for answers that add steps, conditions, or gatekeepers before reporting. Effective awareness training almost always reduces barriers — it never raises them.

Question 3

An employee who needs to work from home forwards an internally labeled customer roster to a personal email account. The employee argues that no external recipient was intended and that the personal account uses encryption.

Which training principle is MOST relevant to this situation?

  1. Encryption makes a personal service acceptable for internally labeled data when the employee remains the sole intended recipient.
  2. An employee may transfer internally labeled data after receiving informal approval from a nearby coworker who works with similar information.
  3. Internal classification labels apply only to printed records; electronic copies may be moved freely for legitimate business purposes.
  4. Data must be handled through approved services according to its classification label, regardless of the employee's intent or the destination's encryption. (correct answer)
Explanation: When you see a question involving data classification and employee behavior, ask yourself: does the employee's intent or the destination's security features change how classified data must be handled? The answer, in any well-designed data governance framework, is no. Data classification policies exist precisely to remove ambiguity. When an organization labels data as "internal," it is designating approved handling procedures — specific systems, services, and controls — that must be followed regardless of context. D captures this principle exactly: the classification label governs the data, not the employee's rationale or the receiving system's encryption capability. Forwarding internal data to a personal email account bypasses organizational controls like access logging, data loss prevention tools, and retention policies — even if the employee never shares it further. A is tempting because encryption sounds like a legitimate safeguard, but encryption only protects data in transit or at rest — it does not make an unapproved service compliant with internal classification requirements. The organization loses visibility and control the moment data leaves approved infrastructure. B introduces informal peer approval, which has no standing in any formal classification policy; only designated authorities can approve exceptions. C presents a common misconception — that classification applies to physical documents only. In practice, classification labels follow the data, not the medium, whether printed, emailed, or stored in the cloud. Your study tip: on security exam questions, watch for answer choices that offer a workaround to policy based on good intentions or technical features. Classification-based data handling policies are designed to be unconditional — if a choice gives the employee an "out," it's almost certainly wrong.

Question 4

A manager finds an unmarked USB drive in a conference room and asks an employee to connect it to a workstation to determine its owner. The organization permits only approved, encrypted removable media.

Based on appropriate awareness training, what should the employee do?

  1. Avoid connecting the drive and submit it through the organization's approved security or lost-property process. (correct answer)
  2. Connect the drive to an isolated office workstation and open only files that appear to identify its owner.
  3. Scan the drive with endpoint antivirus first, then inspect it if the scan reports no known threats.
  4. Use the manager's workstation because the manager's request provides sufficient business authorization to inspect it.
Explanation: Questions about removable media hinge on a core security principle: unknown devices are untrusted devices, regardless of who asks you to inspect them. When you see a scenario involving an unvetted USB drive, your mental framework should immediately shift to "what policy and what risk?" — not "what would be helpful?" Organizations that restrict removable media to approved, encrypted devices do so precisely because unknown drives are a primary vector for malware delivery, including the classic "baiting" attack where adversaries intentionally leave infected drives in public areas. A manager's curiosity about the owner's identity does not override that risk. The correct action — A — is to refuse connection and route the device through the organization's official security or lost-property process, where trained personnel can handle it safely. This protects the network, complies with policy, and is exactly what security awareness training is designed to produce. B is dangerous because no workstation should be considered expendable for ad hoc inspections, and opening files manually bypasses nothing — malware can execute on file access or even directory enumeration. C is a classic false-confidence trap: antivirus catches known signatures, but zero-day exploits or novel malware will pass a clean scan and still compromise the system. D misunderstands authorization entirely — a manager can authorize a business action, but they cannot unilaterally override a security policy simply by making a request. Policy authority belongs to the security team, not the requesting individual. Your study tip: on security awareness questions, always privilege policy and process over convenience or authority. If a scenario offers a "just this once" shortcut, it's almost certainly the wrong answer.

Question 5

After a phishing-awareness campaign, the percentage of employees who select a simulated malicious link decreases substantially. However, security operations finds that employees who do select the link typically wait several hours before reporting it, allowing similar messages to remain in other inboxes.

Which revised training objective would BEST address the remaining risk?

  1. Require employees who select simulated links to complete disciplinary training before regaining email access.
  2. Teach immediate use of the reporting mechanism and measure how quickly suspicious messages are reported. (correct answer)
  3. Repeat instruction on recognizing misspelled domains and measure whether link-selection rates continue declining.
  4. Teach employees to delete suspicious messages immediately so malicious content is removed from their inboxes.
Explanation: When a security awareness program already succeeds at reducing risky behavior, the remaining gap shifts from recognition to response speed. The passage tells you exactly what the residual problem is: employees who fall for phishing links wait hours before reporting, leaving identical messages sitting in colleagues' inboxes. Any revised training objective must directly close that specific gap. B is the best answer because it targets the actual vulnerability. Training employees to use the reporting mechanism immediately — and measuring response time as the key metric — directly reduces the window during which other users remain exposed. Speed of reporting is the lever that controls how quickly security operations can quarantine a campaign. A introduces punishment rather than skill-building. Disciplinary consequences might discourage future link-clicks, but they don't teach the immediate-reporting behavior needed to protect other employees, and they may even discourage honest reporting out of fear. C addresses link-selection rates, which the passage already confirms are declining. Doubling down on recognition training ignores the real remaining risk — the reporting delay — making this a solution to yesterday's problem rather than today's. D sounds cautious but is actually counterproductive. Deleting a suspicious message removes it from your inbox but doesn't alert security operations, meaning similar messages stay active elsewhere and the threat goes uninvestigated. A useful study habit here: when a scenario describes a specific residual risk, the correct training objective will map directly onto that gap — not onto an older, already-improving metric. Watch for answer choices that solve the original problem rather than the one the passage actually describes.

Question 6

Several employees approve repeated multifactor authentication notifications that they did not initiate. The organization already provides annual instruction on creating long, unique passwords.

Which topic should be emphasized in the next awareness update?

  1. Changing passwords immediately after any authentication request, whether the employee initiated it or not, to limit reuse risk.
  2. Approving repeated prompts when they display a familiar location or arrive during normal business hours, since those factors reduce suspicion.
  3. Using shorter, memorable passwords on multifactor-enabled accounts because the additional factor compensates for password weakness.
  4. Denying unexpected prompts, reporting them promptly, and initiating authentication only through trusted, self-initiated workflows. (correct answer)
Explanation: When employees approve MFA prompts they didn't initiate, the organization is facing MFA fatigue (also called prompt bombing) — an attack where adversaries flood users with authentication requests hoping someone clicks "approve" out of habit or confusion. Questions like this test whether you understand the correct behavioral response to unsolicited authentication events. The right training emphasis, answer D, addresses the problem directly: teach employees to deny unexpected prompts immediately, report them to security teams, and only authenticate through workflows they personally initiated. This closes the attack vector by turning passive, confused employees into active defenders. If someone didn't just log in, there's no legitimate reason to receive a prompt — and approving one hands attackers authenticated access. The distractors each embed a dangerous misconception. A sounds reasonable but is actually harmful — changing your password after every unexpected prompt creates unnecessary disruption and doesn't address the root behavior of approving prompts you didn't trigger. B is particularly dangerous because it teaches employees to rationalize approving suspicious prompts based on superficial cues like location or time of day. Attackers routinely operate during business hours or from familiar IP ranges, so these factors offer no real protection. C inverts sound security logic entirely — MFA compensates for some risks, but deliberately weakening passwords undermines the overall security posture, not strengthens it. As a study tip: on security awareness questions, watch for answer choices that rationalize unsafe behavior (like B) or swap cause for effect (like C). The correct answer almost always emphasizes prompt skepticism, reporting, and verified initiation — not convenience or partial compensating controls.

Question 7

A security team plans a simulated phishing campaign. One proposal would use a realistic benefits message, request employees' actual passwords, publicly identify everyone who responds, and provide training at the end of the quarter.

Which alternative would BEST support awareness goals while limiting avoidable harm?

  1. Use the same realistic message but retain submitted passwords only until the campaign's final report is completed and then securely delete them.
  2. Announce the exact message content and delivery time beforehand so that no employee can mistakenly respond to the simulation.
  3. Use an authorized simulation that avoids collecting real credentials, delivers timely coaching, and reports aggregate trends rather than shaming individuals. (correct answer)
  4. Send the realistic message only to new employees and privately discipline anyone who submits credentials, to keep the campaign targeted.
Explanation: When evaluating a simulated phishing campaign, you need to balance two competing priorities: realistic enough to test awareness and ethical enough to avoid unnecessary harm. The key criteria are whether real credentials are collected, whether feedback is timely and constructive, and whether reporting protects employee dignity. Option C is the strongest choice because it satisfies all three criteria. Using an authorized simulation without harvesting real passwords eliminates credential exposure risk entirely. Delivering coaching immediately after someone clicks (rather than weeks later) maximizes learning while the experience is fresh. Reporting aggregate trends rather than publicly identifying individuals prevents the reputational harm that turns a training exercise into a punitive one — which typically destroys trust and undermines future security culture. Option A still collects real passwords, just temporarily. Even brief retention creates exposure risk, and employees cannot consent to something they don't know is a simulation. Retention period doesn't fix the core problem of harvesting live credentials. Option B eliminates risk by announcing the simulation in advance, but it also eliminates effectiveness entirely. If employees know exactly what to expect and when, the exercise tests nothing meaningful about real-world susceptibility. Option D introduces two serious problems: it singles out a specific employee group (new hires), which creates uneven training coverage, and it uses private discipline rather than coaching — converting a learning opportunity into a punitive action that discourages reporting future mistakes. Study tip: On security ethics questions, watch for answers that solve one problem while creating another — like A eliminating long-term storage but still collecting dangerous data. The best answer avoids harm at the source, not just downstream.

Question 8

Employees frequently hold a badge-controlled door open for people they recognize from other floors. One person who entered this way was a former contractor whose access had already been revoked.

Which awareness guidance BEST addresses the weakness without requiring employees to perform security officers' duties?

  1. Permit recognized personnel to follow through secure doors, but require unknown visitors to display identification.
  2. Require each person to use authorized access or an escort, and direct concerns through the approved reporting process. (correct answer)
  3. Ask employees to physically prevent anyone without a visible badge from entering until security personnel arrive.
  4. Allow coworkers to share access when the door system is slow, provided they record the person's name afterward.
Explanation: When a question involves physical access control and employee behavior, you should immediately think about two competing risks: being too permissive (letting threats in) and being too burdensome (turning employees into security guards). The best guidance threads that needle by reinforcing policy without overloading staff. B is the correct choice because it does exactly this. It reminds employees of the existing access control policy — each person must use their own credentials or be formally escorted — and channels any concerns through an established reporting process. This keeps employees compliant and vigilant without requiring them to confront, investigate, or physically detain anyone. The former contractor scenario is precisely why individual authentication matters: familiarity is not the same as current authorization. A is flawed because it creates a two-tier system based on recognition. The scenario proves this fails — the former contractor was recognized, yet their access had been revoked. Familiarity does not equal authorization, so permitting "known" people through bypasses the entire access control system. C places employees in a physically confrontational role, which is dangerous and outside their responsibility. Asking non-security staff to physically block someone escalates risk and exposes both the employee and the organization to harm or liability. D normalizes credential sharing, which is a direct violation of access control principles. Recording a name afterward provides no real-time security — it just creates an audit trail of a policy breach that already occurred. The study tip here: when answer choices involve employees taking on security enforcement roles (blocking, interrogating, or sharing credentials), they are almost always wrong. Good security awareness empowers employees to report, not to enforce.

Question 9

The first simulated phishing campaign produced a high link-selection rate and a low reporting rate. After training, a second campaign produced fewer selections and substantially more reports, but the second message also contained an unusually obvious external-sender warning.

What is the BEST next step for evaluating the training program's effectiveness?

  1. Declare the program effective because both measured behaviors improved after employees completed the assigned training.
  2. Declare the results invalid and stop simulations because message difficulty can never be made perfectly identical.
  3. Run a comparable follow-up exercise and assess selections, reporting speed, and real-world incident trends together. (correct answer)
  4. Evaluate effectiveness only through completion rates because behavioral simulations contain unavoidable environmental differences.
Explanation: When evaluating any security awareness program, you need to think like a scientist: a single post-training result with a confounding variable isn't a conclusion — it's a hypothesis that needs further testing. The core issue here is that the second phishing simulation introduced an obvious external-sender warning, which means you can't cleanly attribute the improved behavior to the training itself. The warning alone may have driven both the lower click rate and higher reporting rate. That's exactly why C is the best next step. Running a comparable follow-up exercise — one that controls for message difficulty — and measuring multiple behavioral indicators (selections, reporting speed, and real-world incident trends) gives you a cleaner, more complete picture. No single data point tells the whole story; triangulating across metrics and over time is how you establish genuine program effectiveness. A is tempting because both metrics did improve, but it ignores the confounding variable. Declaring success without ruling out alternative explanations is a classic measurement trap — correlation after training doesn't equal causation by training. B overcorrects in the opposite direction. Perfect experimental control is rarely achievable in real organizational environments, but that doesn't invalidate simulation-based assessments entirely. Abandoning the methodology because conditions aren't perfectly identical would leave you with no behavioral data at all. D is flawed because completion rates measure exposure, not behavior change. An employee can finish training and still click every phishing link they ever see. Behavioral outcomes are what actually matter for security posture. Your study takeaway: on questions about program evaluation, always ask whether the evidence isolates the variable being tested — if a confound exists, the answer is almost always "gather more controlled data."

Question 10

A growing company currently assigns identical awareness training to every employee. Recent incidents include fraudulent supplier bank-change requests sent to accounts payable and source-code secrets accidentally placed in a public repository by developers.

Which training design would MOST effectively respond to these incidents?

  1. Replace general awareness training with one advanced course covering every department's specialized security risks.
  2. Provide common foundational training, then assign role-specific modules to finance and development personnel. (correct answer)
  3. Limit additional training to employees directly involved in the two incidents to avoid unnecessary instruction.
  4. Continue uniform training but increase its frequency equally for employees in every organizational role.
Explanation: When you see a question about security awareness training design, think in terms of layered training architecture: what does everyone need, and what does each specific role need beyond that? The two incidents here are distinct — a social engineering attack targeting finance (fraudulent bank-change requests) and a data handling failure in development (secrets in public repositories). These aren't general awareness gaps; they're role-specific vulnerabilities requiring targeted instruction. B is correct because it mirrors real-world best practice: a foundational layer establishes universal security literacy (phishing awareness, password hygiene, acceptable use), while role-specific modules address the precise threat surfaces each team faces. Finance personnel learn to verify supplier payment changes through out-of-band confirmation; developers learn secrets management, .gitignore discipline, and repository hygiene. This approach is both efficient and proportional. A sounds thorough but is actually counterproductive — cramming every department's specialized risks into one course creates information overload and dilutes relevance. A developer sitting through accounts-payable fraud scenarios, and vice versa, wastes attention and reduces retention for what actually matters to each person. C is a reactive, punitive approach that ignores systemic risk. If these incidents happened once, they can happen again — to other employees in the same roles. Limiting training only to those already involved leaves the broader population exposed. D addresses frequency, not content. Repeating the same generic training more often doesn't close role-specific skill gaps; it just increases training fatigue without improving outcomes where it counts. Study tip: On security exam questions, "one-size-fits-all" training solutions are almost always wrong. Look for answers that balance universal baselines with targeted, role-relevant content.