5.6 User Training

Question 1

What is a best practice for providing security training?

Answer 1

Provide security training for users before they connect to the network for the first time

Question 2

Why is specialized security training important?

Answer 2

Different security requirements exist for different departments, such as accounting and shipping

Question 3

Who else should receive security training besides employees?

Answer 3

Third parties such as contractors, partners, and suppliers

Question 4

What should be tracked regarding security training?

Answer 4

Who has been trained and who has yet to be trained

Question 5

Why is it important to document security policies?

Answer 5

To ensure they can be referenced by every user in the company

Question 6

How can security policies be made accessible?

Answer 6

By having online access as part of the intranet and including them in employee handbooks

Question 7

What does situational awareness entail for users?

Answer 7

Always looking for threats while performing their job

Question 8

What should users be cautious of regarding email?

Answer 8

Email links or attachments that might be associated with phishing

Question 9

What physical security threat should users be aware of?

Answer 9

Receiving suspicious envelopes that contain USB drives

Question 10

What are insider threats?

Answer 10

Difficult-to-identify threats that come from within the organization

Question 11

What approach should be taken to identify insider threats?

Answer 11

A multi-factored approach with multiple approvals and active file monitoring

Question 12

What should be done if there are changes in critical processes?

Answer 12

Be informed immediately of any changes

Question 13

What is important for password management?

Answer 13

Implementing secure password strategies and standard requirements

Question 14

What can be used in a Windows environment to enforce password policies?

Answer 14

Group policy to enforce password length and complexity

Question 15

What should user training include regarding removable media?

Answer 15

Awareness of security concerns related to unknown USB drives

Question 16

What is a risk when users are not in the office?

Answer 16

Using unknown cables to charge mobile devices

Question 17

What technique do attackers often use to gather information?

Answer 17

Social engineering

Question 18

What should users learn about social engineering?

Answer 18

Common techniques and how to report them to the IT security team

Question 19

What is operational security from the attacker’s perspective?

Answer 19

Understanding security threats by interpreting them as an attacker would

Question 20

What type of data should users be aware of?

Answer 20

Sensitive data that requires additional security

Question 21

What security concern arises for users working from home?

Answer 21

Preventing family or friends from accessing work systems

Question 22

What additional security measures may be needed for remote work?

Answer 22

Endpoint security and increased security for VPN access