BCS CISMP-V9 Exam - Topic 5 Question 93 Discussion

Actual exam question for BCS's CISMP-V9 exam

Question #: 93
Topic #: 5

[All CISMP-V9 Questions]

How might the effectiveness of a security awareness program be effectively measured?

1) Employees are required to take an online multiple choice exam on security principles.

2) Employees are tested with social engineering techniques by an approved penetration tester.

3) Employees practice ethical hacking techniques on organisation systems.

4) No security vulnerabilities are reported during an audit.

5) Open source intelligence gathering is undertaken on staff social media profiles.

A3, 4 and 5.

B2, 4 and 5.

C1, 2 and 3.

D1, 2 and 5.

Show Suggested Answer

Suggested Answer: A

When selecting a third-party digital forensics service provider, it is crucial to ensure that the company has the appropriate accreditations and the staff hold relevant certifications. This ensures that the service provider adheres to recognized standards and best practices in digital forensics, which is essential for the integrity and admissibility of evidence. Company accreditation provides assurance that the organization follows industry-recognized quality standards, while staff certification demonstrates that the individuals handling the forensic process are qualified and competent. This combination is vital for maintaining the credibility of the forensic investigation and the security of the data handled.

by Socorro at Jan 25, 2025, 05:59 AM

Limited Time Offer

25%

Off

Get Premium CISMP-V9 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Zachary

3 months ago

I’d pick option B, seems the most comprehensive.

upvoted 0 times

...

Jovita

3 months ago

No vulnerabilities during an audit is a solid measure!

upvoted 0 times

...

Lenita

3 months ago

Wait, practicing ethical hacking? Isn't that risky?

upvoted 0 times

...

Ruth

4 months ago

Totally agree, social engineering is a big threat!

upvoted 0 times

...

Ty

4 months ago

I think option 2 is crucial for real-world testing.

upvoted 0 times

...

Keneth

4 months ago

I feel like measuring effectiveness through audits is a bit indirect; it doesn't really reflect employee awareness directly.

upvoted 0 times

...

Elenora

4 months ago

I think option 2 is definitely important, but I also feel like the online exam in option 1 could be useful too.

upvoted 0 times

...

Linn

4 months ago

I'm not sure if practicing ethical hacking is a good measure; it seems risky for the organization.

upvoted 0 times

...

Alishia

5 months ago

I remember discussing how social engineering tests can really show if employees are aware of security threats.

upvoted 0 times

...

Floyd

5 months ago

Yeah, I agree with Edna. The combination of written tests, social engineering, and practical exercises seems like the most comprehensive way to evaluate the security awareness program.

upvoted 0 times

...

Edna

5 months ago

Okay, I think I've got it. The best approach is to test employees' security knowledge, then see how they apply it in real-world scenarios like social engineering and ethical hacking. That should give a good overall picture of the program's effectiveness.

upvoted 0 times

...

Glory

5 months ago

Hmm, I'm a bit confused. Do we really need to do open-source intelligence gathering on employees' social media? That seems a bit invasive to me.

upvoted 0 times

...

Lisha

5 months ago

I think the key is to look for a combination of methods that assess both the employees' understanding and their real-world actions. A mix of testing and practical exercises seems like the way to go.

upvoted 0 times

...

Gwenn

5 months ago

This is a tricky one. I'm not sure if I should focus on testing employees' knowledge or their actual security behavior.

upvoted 0 times

...

Aaron

10 months ago

Option B looks good to me. Testing with social engineering techniques is the most realistic way to see if the security awareness program is working.

upvoted 0 times

...

Nana

10 months ago

Open source intelligence gathering on social media profiles? That's a bit creepy, don't you think? I'll stick with options 1 and 2 to keep it professional.

upvoted 0 times

Ilene

9 months ago

Yeah, options 1 and 2 are more traditional methods of measuring effectiveness.

upvoted 0 times

...

Lina

9 months ago

I think sticking with options 1 and 2 is a good idea to maintain professionalism.

upvoted 0 times

...

Portia

9 months ago

I agree, open source intelligence gathering does seem invasive.

upvoted 0 times

...

Gladys

10 months ago

Haha, practicing ethical hacking? That sounds like a lot of fun! I'd go with option C just to get a chance to try that out.

upvoted 0 times

Nida

9 months ago

User 3: Yeah, option C seems like a good choice to measure the effectiveness of the security awareness program.

upvoted 0 times

...

Cecil

9 months ago

User 2: I agree, it would be interesting to try out. I think option C is the way to go.

upvoted 0 times

...

Alyce

9 months ago

User 1: Practicing ethical hacking does sound like fun!

upvoted 0 times

...

Judy

10 months ago

I don't know, option 4 sounds a bit unrealistic. Just because no vulnerabilities are reported doesn't mean the program is effective. You need to actually test the employees' behavior.

upvoted 0 times

...

Yaeko

10 months ago

Option C seems the most comprehensive approach to measuring the effectiveness of a security awareness program. Testing employees' knowledge and skills is crucial.

upvoted 0 times