CompTIA Security+ Practice Test of the Day 260410

Question 1

The CISO of a regional hospital system wants to measure staff susceptibility to phishing attacks before deploying a mandatory awareness training program. The security team is authorized to design and send realistic simulated phishing emails to all employees, track click rates, and report findings to hospital leadership. The exercise will serve as a baseline for measuring future training effectiveness. Which security awareness practice does this describe?

A. Anomalous behavior recognition B. Phishing campaign C. Reporting and monitoring D. Situational awareness training

Question 2

A security awareness trainer at a financial services firm is building course material to help employees identify fraudulent emails before clicking links or opening attachments. The module includes examples of spoofed sender addresses, mismatched hover-over URLs, urgent language designed to bypass rational judgment, and unexpected file attachment types. Which security awareness topic does this training module BEST address?

A. Responding to reported suspicious messages B. Operational security C. Recognizing a phishing attempt D. Social engineering

Question 3

A logistics company deploys a security awareness program that includes a clearly defined process for employees to forward suspicious emails to a dedicated security team inbox. The program specifies what information to include in the report, guarantees employees will not face retaliation for reporting a message that turns out to be legitimate, and provides a confirmation response so staff know their report was received. Which component of a phishing awareness program does this BEST describe?

A. Phishing campaign execution B. Anomalous behavior recognition C. Responding to reported suspicious messages D. Initial reporting and monitoring

Question 4

An analyst reviewing user activity logs at a defense contractor notices that a long-tenured engineer has recently begun accessing classified project files outside normal working hours, downloading significantly larger volumes of data than in any prior month, and querying systems unrelated to assigned projects. All permissions are technically valid and no automated alerts have triggered. Which type of anomalous behavior does this scenario BEST illustrate?

A. Risky behavior B. Unintentional behavior C. Unexpected behavior D. Policy violation

Question 5

A compliance officer at a healthcare organization discovers that the security awareness program relies entirely on verbal onboarding briefings with no written documentation employees can reference afterward. There is no standardized content across departments, and staff have no formal guide on acceptable use, data handling, or reporting obligations. The officer wants employees to have a consistent, authoritative written reference they can consult throughout the year. Which security awareness element should be implemented to address this gap?

A. Recurring phishing campaigns B. Situational awareness exercises C. Policy/handbooks D. Development phase planning

Question 6

A corporate security team implements a program that monitors user behavior analytics for data exfiltration patterns, trains managers to recognize behavioral warning signs in subordinates — such as expressions of grievance, unusual access requests, or sudden changes in work habits — and conducts exit interviews with departing employees to assess potential data risks. The program targets individuals who may misuse their legitimate access, whether deliberately or inadvertently. Which security awareness topic does this program BEST address?

A. Social engineering B. Removable media and cables C. Insider threat D. Anomalous behavior recognition

Question 7

During a security awareness audit at a manufacturing plant, an assessor finds that employees routinely plug personal USB drives into production workstations to transfer files because the approved cloud sharing tool performs poorly on the plant floor network. No policy prohibits this practice and no training covers the associated risks. The CISO wants to add a topic to the awareness curriculum to address this gap. Which training topic should be added?

A. Password management B. Operational security C. Hybrid/remote work environments D. Removable media and cables

Question 8

A security awareness coordinator at a professional services firm is building a training module covering how employees should handle their credentials. The content addresses the dangers of reusing the same password across multiple work and personal accounts, the organization's prohibition on sharing credentials with colleagues, and the proper use of approved password manager tools to maintain strong, unique credentials per system. Which security awareness topic does this module BEST address?

A. Insider threat B. Operational security C. Password management D. Policy/handbooks

Question 9

A technology consulting firm expands its security awareness program after determining that employees who work from home face a distinct set of risks not covered in existing training. The new module covers risks from using personal devices for corporate work, the dangers of connecting to unsecured public Wi-Fi networks, and proper screen privacy practices when working from coffee shops or shared spaces. Which security awareness topic is the firm adding to its program?

A. Social engineering B. Operational security C. Hybrid/remote work environments D. Anomalous behavior recognition

Question 10

A security manager at a retail company initially deploys a security awareness program as a one-time onboarding requirement for new hires. After a phishing simulation six months later reveals that click rates have risen sharply among employees hired more than a year ago, the manager restructures the program to include quarterly phishing simulations and mandatory annual refresher training for all staff. Which aspect of the awareness program's reporting and monitoring structure does this change represent?

A. Development B. Execution C. Initial reporting and monitoring D. Recurring reporting and monitoring

CompTIA Security+ Practice Test of the Day 260410

ByThe Test Master

Related Post

CompTIA Security+ Practice Test of the Day 260409

CompTIA Security+ Practice Test of the Day 260408

CompTIA Security+ Practice Test of the Day 260407

Leave a Reply Cancel reply

You missed

CEH v13 Domain 2.2 Practice Test 002

CEH v13 Domain 2.1 Practice Test 002

CEH v13 Domain 1.1 Practice Test 002

CEH v13 Domain 9.1 Practice Test 001