ISC2 Certified in Cybersecurity (CC)Security OperationsMedium
A new employee is being onboarded at an organization. As part of their initial training, they are required to complete an interactive online module that covers topics such as phishing awareness, password best practices, and the company's data handling policies. This module concludes with a short quiz to ensure understanding. This activity is a core component of which security operation?
- ALog management
- BConfiguration management
- CSecurity awareness training
- DPersonnel security
Show answer & explanationAnswer & explanation
Correct answer: C. Security awareness training
The scenario explicitly describes training employees on security topics like phishing and data handling, with a quiz to verify understanding. This is the definition of security awareness training.
Why the other options are wrong
- A. Log management involves collecting and analyzing event logs, unrelated to employee education.
- B. Configuration management maintains system settings, not educates staff.
- D. Personnel security includes background checks and role-based access, but the training itself is a distinct activity.
Security Awareness Training
An ongoing educational program designed to inform and train employees about cybersecurity threats, organizational security policies, and best practices to protect information assets.
- Aims to reduce human error in security
- Covers topics like phishing, social engineering, password hygiene
- Should be mandatory and recurring for all staff
Memory trick: People are the strongest or weakest link.