One of the objectives of a bank is to instill a security awareness culture. Which of the following are techniques that could help to achieve this? (Choose two.)

Blue teaming is a defensive security operations function focused on detection and response, not an employee-facing awareness training technique.

Phishing simulations directly train employees by exposing them to realistic social engineering scenarios, reinforcing recognition skills and creating measurable awareness outcomes through repeated practice.

Lunch-and-learn sessions are informal, periodic training events that supplement awareness programs but are not classified as primary culture-building techniques in this context.

Random audits assess compliance with existing controls but do not actively engage or train employees in security-aware behaviors.

Continuous monitoring sustains security culture by providing persistent visibility into security events and behaviors, reinforcing that security is an ongoing organizational priority rather than a periodic compliance activity.

Separation of duties is an administrative access control that limits privilege escalation risk and is unrelated to building security awareness culture.