Question 60 Annual awareness training has 100% attendance but recurring credential disclosure. What evaluation should security adopt? Use segmented effectiveness metrics and targeted interventions without punitive public ranking Measure actual behavior with ethical simulations and targeted follow-up coaching Tailor role-based education to agent permissions, untrusted inputs and data protection Review content periodically using incidents, risk trends and updated job responsibilities Explanation Correct Answer B:Completion counts are activity measures, not proof that staff can resist risky interactions. Incorrect Answers A:Different risk patterns call for focused training that encourages reporting rather than concealment; it is relevant where a few departments repeatedly fail security simulations while others improve, whereas the current facts require measure actual behavior with ethical simulations and targeted follow-up coaching to address the stated problem. C:This option fits a different fact pattern where a new engineering team builds AI agents but generic awareness materials omit prompt-injection risks: risk-specific instruction gives developers practical behaviors for emerging technology use; the current case instead requires measure actual behavior with ethical simulations and targeted follow-up coaching. D:Awareness programs must adapt as the threat landscape and workforce change; although this helps when a training course is unchanged despite repeated incident lessons over three years, it leaves the current case's need to measure actual behavior with ethical simulations and targeted follow-up coaching unresolved.
Question 61 Staff receive phishing examples but do not know how to report suspicious messages. What program element is needed? Tailor role-based education to agent permissions, untrusted inputs and data protection Measure actual behavior with ethical simulations and targeted follow-up coaching Review content periodically using incidents, risk trends and updated job responsibilities Teach and exercise an accessible reporting path with prompt feedback Explanation Correct Answer D:Security awareness should lead to timely detection and escalation, not only recognition. Incorrect Answers A:For the separate situation in which a new engineering team builds AI agents but generic awareness materials omit prompt-injection risks, risk-specific instruction gives developers practical behaviors for emerging technology use; here the stated problem requires teach and exercise an accessible reporting path with prompt feedback. B:For the separate situation in which annual awareness training has 100% attendance but recurring credential disclosure, completion counts are activity measures, not proof that staff can resist risky interactions; here the stated problem requires teach and exercise an accessible reporting path with prompt feedback. C:The other scenario states that a training course is unchanged despite repeated incident lessons over three years, where awareness programs must adapt as the threat landscape and workforce change; by contrast, the present case requires teach and exercise an accessible reporting path with prompt feedback.
Question 62 A new engineering team builds AI agents but generic awareness materials omit prompt-injection risks. What should change? Teach and exercise an accessible reporting path with prompt feedback Tailor role-based education to agent permissions, untrusted inputs and data protection Use segmented effectiveness metrics and targeted interventions without punitive public ranking Measure actual behavior with ethical simulations and targeted follow-up coaching Explanation Correct Answer B:Risk-specific instruction gives developers practical behaviors for emerging technology use. Incorrect Answers A:For the separate situation in which staff receive phishing examples but do not know how to report suspicious messages, security awareness should lead to timely detection and escalation, not only recognition; here the stated problem requires tailor role-based education to agent permissions, untrusted inputs and data protection. C:This option fits a different fact pattern where a few departments repeatedly fail security simulations while others improve: different risk patterns call for focused training that encourages reporting rather than concealment; the current case instead requires tailor role-based education to agent permissions, untrusted inputs and data protection. D:Completion counts are activity measures, not proof that staff can resist risky interactions; this responds to the different circumstance in which annual awareness training has 100% attendance but recurring credential disclosure, while the current case states that a new engineering team builds AI agents but generic awareness materials omit prompt-injection risks, calling for tailor role-based education to agent permissions, untrusted inputs and data protection.
Question 63 A training course is unchanged despite repeated incident lessons over three years. What governance should be added? Measure actual behavior with ethical simulations and targeted follow-up coaching Review content periodically using incidents, risk trends and updated job responsibilities Teach and exercise an accessible reporting path with prompt feedback Use segmented effectiveness metrics and targeted interventions without punitive public ranking Explanation Correct Answer B:Awareness programs must adapt as the threat landscape and workforce change. Incorrect Answers A:This option fits a different fact pattern where annual awareness training has 100% attendance but recurring credential disclosure: completion counts are activity measures, not proof that staff can resist risky interactions; the current case instead requires review content periodically using incidents, risk trends and updated job responsibilities. C:Security awareness should lead to timely detection and escalation, not only recognition; this responds to the different circumstance in which staff receive phishing examples but do not know how to report suspicious messages, while the current case states that a training course is unchanged despite repeated incident lessons over three years, calling for review content periodically using incidents, risk trends and updated job responsibilities. D:The other scenario states that a few departments repeatedly fail security simulations while others improve, where different risk patterns call for focused training that encourages reporting rather than concealment; by contrast, the present case requires review content periodically using incidents, risk trends and updated job responsibilities.
Question 64 A few departments repeatedly fail security simulations while others improve. How should the CISO respond? Repeat the identical annual course for every department and treat completion as the sole measure of success Use segmented effectiveness metrics and targeted interventions without punitive public ranking Publish a ranking that identifies individual employees who failed simulated phishing exercises Remove security simulations from departments with lower scores to improve company-wide statistics Explanation Correct Answer B:Different risk patterns call for focused training that encourages reporting rather than concealment. Incorrect Answers A:Repeating uniform training without investigating which groups struggle does not address the observed concentration of failures or measure safer behavior. C:Shaming individuals can discourage reporting, while the problem calls for supportive, role-specific improvements informed by group outcomes. D:Stopping tests hides persistent risk and manipulates the metric; targeted coaching and follow-up measurements are necessary.
Question 65 A research lab stores genome records and public brochures in the same repository. Which decision should precede selecting encryption or sharing controls? Apply the highest confidential classification to the entire repository without any owner-led assessment Choose encryption products first, then let project developers decide the labels later Treat all records as public because brochures share the repository with genome data Have the data owner classify each dataset by sensitivity and impact of disclosure Explanation Correct Answer D:Classification establishes protection requirements before implementing particular tools. Incorrect Answers A:Blanket classification ignores important sensitivity differences and does not establish the data owner’s authorized requirements for each information type. B:Selecting controls before understanding required sensitivity and ownership reverses the classification-driven design process. C:Physical or logical co-location does not remove the privacy and confidentiality impact of sensitive genomic records.
Question 66 A company labels everything confidential, making it impossible to prioritize controls. What change is appropriate? Have the data owner classify each dataset by sensitivity and impact of disclosure Create meaningful classification categories with documented criteria and business ownership Inventory information types and processing paths to apply the appropriate labels Require the accountable data owner to assess and authorize reclassification Explanation Correct Answer B:Undifferentiated labels hide relative harm and impair proportionate handling. Incorrect Answers A:The other scenario states that a research lab stores genome records and public brochures in the same repository, where classification establishes protection requirements before implementing particular tools; by contrast, the present case requires create meaningful classification categories with documented criteria and business ownership. C:Flow awareness determines where protective handling requirements follow the data; it is relevant where a team discovers that a system transmits highly sensitive reports but has no mapped data flows, whereas the current facts require create meaningful classification categories with documented criteria and business ownership to address the stated problem. D:Classification decisions are based on business sensitivity and delegated data ownership; although this helps when a project manager wants to lower a dataset's classification for convenience, it leaves the current case's need to create meaningful classification categories with documented criteria and business ownership unresolved.
Question 67 An inventory tracks servers but misses proprietary algorithms deployed in containers. What asset-management correction is needed? Require the accountable data owner to assess and authorize reclassification Include intangible software and intellectual property in the asset classification inventory Create meaningful classification categories with documented criteria and business ownership Classify model artifacts according to their business sensitivity and misuse impact Explanation Correct Answer B:Security-relevant assets include code, models and information, not only physical devices. Incorrect Answers A:Classification decisions are based on business sensitivity and delegated data ownership; it is relevant where a project manager wants to lower a dataset's classification for convenience, whereas the current facts require include intangible software and intellectual property in the asset classification inventory to address the stated problem. C:Undifferentiated labels hide relative harm and impair proportionate handling; it is relevant where a company labels everything confidential, making it impossible to prioritize controls, whereas the current facts require include intangible software and intellectual property in the asset classification inventory to address the stated problem. D:Model weights can be valuable protected assets independent of personal-data content; although this helps when a model vendor calls training weights 'non-data' and proposes public storage despite trade-secret value, it leaves the current case's need to include intangible software and intellectual property in the asset classification inventory unresolved.
Question 68 A project manager wants to lower a dataset's classification for convenience. Who should approve the change? Create meaningful classification categories with documented criteria and business ownership Require the accountable data owner to assess and authorize reclassification Inventory information types and processing paths to apply the appropriate labels Include intangible software and intellectual property in the asset classification inventory Explanation Correct Answer B:Classification decisions are based on business sensitivity and delegated data ownership. Incorrect Answers A:The other scenario states that a company labels everything confidential, making it impossible to prioritize controls, where undifferentiated labels hide relative harm and impair proportionate handling; by contrast, the present case requires require the accountable data owner to assess and authorize reclassification. C:For the separate situation in which a team discovers that a system transmits highly sensitive reports but has no mapped data flows, flow awareness determines where protective handling requirements follow the data; here the stated problem requires require the accountable data owner to assess and authorize reclassification. D:Security-relevant assets include code, models and information, not only physical devices; this responds to the different circumstance in which an inventory tracks servers but misses proprietary algorithms deployed in containers, while the current case states that a project manager wants to lower a dataset's classification for convenience, calling for require the accountable data owner to assess and authorize reclassification.
Question 69 A team discovers that a system transmits highly sensitive reports but has no mapped data flows. What should be documented first? Require the accountable data owner to assess and authorize reclassification Create meaningful classification categories with documented criteria and business ownership Classify model artifacts according to their business sensitivity and misuse impact Inventory information types and processing paths to apply the appropriate labels Explanation Correct Answer D:Flow awareness determines where protective handling requirements follow the data. Incorrect Answers A:This option fits a different fact pattern where a project manager wants to lower a dataset's classification for convenience: classification decisions are based on business sensitivity and delegated data ownership; the current case instead requires inventory information types and processing paths to apply the appropriate labels. B:Undifferentiated labels hide relative harm and impair proportionate handling; it is relevant where a company labels everything confidential, making it impossible to prioritize controls, whereas the current facts require inventory information types and processing paths to apply the appropriate labels to address the stated problem. C:Model weights can be valuable protected assets independent of personal-data content; it is relevant where a model vendor calls training weights 'non-data' and proposes public storage despite trade-secret value, whereas the current facts require inventory information types and processing paths to apply the appropriate labels to address the stated problem.
Question 70 An acquired company's customer database has unknown sensitivity markings. What should integration planning do? Have the data owner classify each dataset by sensitivity and impact of disclosure Classify model artifacts according to their business sensitivity and misuse impact Perform classification and ownership reconciliation before broad cross-company access Require the accountable data owner to assess and authorize reclassification Explanation Correct Answer C:Unverified legacy labels should not be assumed equivalent to the acquiring organization's scheme. Incorrect Answers A:Classification establishes protection requirements before implementing particular tools; it is relevant where a research lab stores genome records and public brochures in the same repository, whereas the current facts require perform classification and ownership reconciliation before broad cross-company access to address the stated problem. B:This option fits a different fact pattern where a model vendor calls training weights 'non-data' and proposes public storage despite trade-secret value: model weights can be valuable protected assets independent of personal-data content; the current case instead requires perform classification and ownership reconciliation before broad cross-company access. D:This option fits a different fact pattern where a project manager wants to lower a dataset's classification for convenience: classification decisions are based on business sensitivity and delegated data ownership; the current case instead requires perform classification and ownership reconciliation before broad cross-company access.
