Objective 5.6: Given a scenario, implement security awareness practices

1.Which behavior by an employee MOST strongly indicates anomalous behavior that should be reported to the security team?

2.An employee receives an email appearing to be from the company's CEO urgently requesting a wire transfer. The email uses the CEO's name but comes from an external domain. Which technique does this BEST represent?

3.A security awareness program manager reviews the results of the organization's annual phishing simulation campaign. The overall click rate was 23%, meaning nearly one in four employees clicked a simulated phishing link. The manager notices that click rates vary dramatically by department: the finance department clicked at 41%, the engineering department at 8%, and the executive team at 31%. The program manager wants to improve the program's effectiveness based on these results. Which approach to security awareness training most precisely addresses what the data reveals, and why is the current annual training model insufficient given these findings?

4.During a security awareness training session on situational awareness, employees are taught to be alert to strangers in secure areas, unusual packages, and visitors without escort badges. Which threat vector does this training PRIMARILY address?

5.A company trains remote workers to use VPNs on public Wi-Fi, lock screens when stepping away, and use only company-approved collaboration tools. Which security awareness area does this PRIMARILY address?