nerdexam
EC-Council

312-50V10 · Question #394

How can a policy help improve an employee's security awareness?

The correct answer is A. By implementing written security procedures, enabling employee security training, and promoting. A security policy improves employee awareness by establishing written procedures, enabling formal security training, and promoting a culture of security throughout the organization.

Information Security and Ethical Hacking Fundamentals

Question

How can a policy help improve an employee's security awareness?

Options

  • ABy implementing written security procedures, enabling employee security training, and promoting
  • BBy using informal networks of communication, establishing secret passing procedures, and
  • CBy sharing security secrets with employees, enabling employees to share secrets, and
  • DBy decreasing an employee's vacation time, addressing ad-hoc employment clauses, and

How the community answered

(24 responses)
  • A
    88% (21)
  • B
    8% (2)
  • C
    4% (1)

Why each option

A security policy improves employee awareness by establishing written procedures, enabling formal security training, and promoting a culture of security throughout the organization.

ABy implementing written security procedures, enabling employee security training, and promotingCorrect

Written security policies provide clear, documented guidelines that employees can reference to understand expected behaviors and responsibilities. Mandatory training programs ensure those policies are understood and applied correctly, while promoting security as part of organizational culture reinforces consistent, proactive security behaviors across all staff.

BBy using informal networks of communication, establishing secret passing procedures, and

Using informal communication networks and secret-passing procedures undermines accountability and traceability, which are fundamental principles of an effective and auditable security awareness program.

CBy sharing security secrets with employees, enabling employees to share secrets, and

Sharing security secrets with employees and enabling employees to share secrets contradicts the need-to-know and least-privilege principles, increasing the risk of unauthorized information disclosure.

DBy decreasing an employee's vacation time, addressing ad-hoc employment clauses, and

Decreasing vacation time and addressing ad-hoc employment clauses have no direct relationship to building security knowledge, changing security behaviors, or improving employee awareness.

Concept tested: Security policy role in employee awareness training

Source: https://csrc.nist.gov/publications/detail/sp/800-50/final

Topics

#security awareness#security policy#employee training#security procedures

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice