One purpose of a security awareness program is to modify:

Question

Options

• Aemployee's attitudes and behaviors towards enterprise's security posture
• Bmanagement's approach towards enterprise's security posture
• Cattitudes of employees with sensitive data
• Dcorporate attitudes about safeguarding data

• A
  89% (51)
• B
  2% (1)
• C
  5% (3)
• D
  4% (2)

Explanation

Security awareness programs target all employees across the organization, aiming to shift their attitudes and behaviors so security becomes ingrained in daily work habits - making A the correct and most complete answer.

Why the distractors fail:

• B is too narrow - security awareness programs aren't limited to management; they apply organization-wide.
• C is too narrow - restricting the audience to only employees who handle sensitive data misses the broader goal of building a security culture across everyone.
• D is partially right in spirit but vague - "corporate attitudes" implies a top-down or organizational-level focus, whereas the program's measurable outcome is individual employee behavior change.

Memory tip: Think of the acronym ABCs - Awareness programs change Attitudes and Behaviors, Company-wide (all employees, not just specific groups or management). When you see a narrowing qualifier like "management only" or "employees with sensitive data," it's almost always a trap.

No community discussion yet for this question.