nerdexam
Isaca

CISM · Question #156

Which of the following BEST enables the effectiveness of an information security training program for new employees?

The correct answer is D. The training is specific to new employees' job functions. An information security training program for new employees is most effective when the content is tailored to their specific job functions. This makes the training more relevant and applicable to their daily tasks, improving comprehension and retention.

Submitted by sofia.br· Apr 18, 2026Information Security Program Development and Management

Question

Which of the following BEST enables the effectiveness of an information security training program for new employees?

Options

  • ANew employees are required to acknowledge the information security policy.
  • BNew employees must complete a security assessment after training.
  • CInformation security training precedes all other onboarding training.
  • DThe training is specific to new employees' job functions.

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    11% (2)
  • C
    6% (1)
  • D
    78% (14)

Why each option

An information security training program for new employees is most effective when the content is tailored to their specific job functions. This makes the training more relevant and applicable to their daily tasks, improving comprehension and retention.

ANew employees are required to acknowledge the information security policy.

Acknowledging the policy ensures compliance but does not inherently guarantee understanding or effective application of security principles.

BNew employees must complete a security assessment after training.

A security assessment after training measures knowledge but does not enable the effectiveness of the training content itself; rather, it evaluates it.

CInformation security training precedes all other onboarding training.

While early training is beneficial, prioritizing it over all other onboarding training does not inherently make the content more effective if it is not relevant to their specific roles.

DThe training is specific to new employees' job functions.Correct

Training that is specific to new employees' job functions makes the information more relevant and immediately applicable to their daily tasks and responsibilities. This tailored approach improves engagement, comprehension, and the likelihood that employees will apply the security principles directly to their work, thereby enhancing overall program effectiveness.

Concept tested: Effective security awareness training design

Source: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr-security-awareness-training

Topics

#information security training#security awareness#training effectiveness#job-specific training

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISM Practice