Security+ topic 5.6
Security Awareness
People are often the easiest way in, so training matters. Security awareness programs teach staff to spot phishing, report suspicious activity, handle passwords and data correctly, and work securely from home. Phishing campaigns send safe, simulated phishing emails to measure who clicks and to give extra training. Training should cover insider threats, social engineering, removable media, and operational security. Good programs are ongoing, include everyone, and measure results, such as fewer clicks and more reports over time.
Security Awareness vocabulary
- Security awareness training: Teaching staff to recognize and report threats and follow security practices.
- Phishing simulation: A safe, fake phishing email sent to staff to measure and improve awareness.
- Operational security (OPSEC): Protecting small pieces of information that attackers could combine.
- Reporting culture: An environment where people feel safe reporting mistakes and suspicious activity.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A company sends staff a fake phishing email and gives extra training to people who click the link. Which of the following is this?
- (A) A phishing simulation
- (B) A watering hole attack
- (C) A penetration test of the firewall
- (D) Business email compromise
Show answer
(A) A phishing simulation Safe, simulated phishing measures and improves awareness.
2. Which of the following is the best measure that a security awareness program is working?
- (A) More employees report suspicious emails and fewer click simulated phishing links
- (B) Employees finish the training faster
- (C) The training video is longer
- (D) Fewer people attend
Show answer
(A) More employees report suspicious emails and fewer click simulated phishing links Behavior change, such as more reports and fewer clicks, shows the program works.
3. An employee posts a photo of their desk that shows a sticky note with a password. Which training topic would best address this?
- (A) Operational security
- (B) Load balancing
- (C) Key escrow
- (D) Data sovereignty
Show answer
(A) Operational security OPSEC training teaches people not to reveal small details attackers can use.
4. An employee realizes they clicked a phishing link. Which of the following should they do first?
- (A) Hide it and hope nothing happens
- (B) Report it to the security team right away
- (C) Restart the computer and keep working
- (D) Forward the email to coworkers
Show answer
(B) Report it to the security team right away Fast reporting lets the team contain the problem; a good reporting culture encourages this.