MENU
An organization recently implemented a cybersecurity awareness program that includes phishing simulation exercises for all employees. What type of control is being utilized?
Suggested Answer: C
Get Premium CRISC Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Phishing simulations serve as a deterrent by highlighting the consequences of risky behavior and reinforcing secure practices, reducing the likelihood of successful attacks. This supports Behavioral Risk Management.
28 comments · newest first
RO
Rossana
10 months ago
Compensating? Nah, that's not it.
JA
Janella
11 months ago
Surprised to see this as preventive, seems more like training.
MA
Matilda
11 months ago
Totally agree, preventive all the way!
AM
Ammie
11 months ago
Really? I thought it was more of a detective measure.
KR
Kristian
11 months ago
It's definitely a preventive control!
DA
Dante
12 months ago
I’m leaning towards preventive as well, but I wonder if it could also be seen as compensating since it’s a response to potential threats.
LA
Latrice
12 months ago
I feel like it could be detective too, since it helps identify who might fall for phishing, but that doesn't seem right for the main purpose.
EL
Ellsworth
12 months ago
I remember practicing a question about this, and I think phishing simulations are more about training, so maybe it's a deterrent control?
AB
Abraham
1 year ago
I think this is a preventive control since the goal is to stop phishing before it happens, but I'm not entirely sure.
RO
Ronnie
1 year ago
Okay, let me think this through. The phishing simulations are designed to detect and prevent employees from falling for real phishing attempts, so I'm going to go with Detective control.
SH
Shantell
1 year ago
I'm a bit confused on the differences between the control types. Is a Compensating control the right answer since the phishing simulations are an additional measure to address the risk of phishing?
CO
Corrie
1 year ago
Hmm, I'm not sure about this one. Is it a Deterrent control since the phishing simulations are meant to discourage employees from falling for real phishing attacks?
BR
Brynn
1 year ago
This seems like a straightforward question. The organization is using phishing simulations to raise cybersecurity awareness, so I think the answer is Preventive control.
CH
Cheryl
2 years ago
I believe it could also be a detective control, as it helps in detecting potential vulnerabilities.
CE
Ceola
2 years ago
This question is a bit 'phishy' if you ask me, but I'm going to have to go with A) Preventive. Gotta stay ahead of those cybercriminals, you know?
CO
Corinne
2 years ago
I think so too. It's better to prevent the attacks rather than just detect them after the fact.
YA
Yan
2 years ago
I agree, A) Preventive sounds like the right choice. It's important to proactively protect against phishing attacks.
WI
Winifred
2 years ago
I'm feeling a bit like a 'phish' out of water here, but I'll go with B) Compensating. The exercises help compensate for the potential weaknesses in the organization's cybersecurity measures.
MO
Mona
2 years ago
I agree with Julio, phishing simulation exercises are meant to prevent cyber attacks.
AL
Alishia
2 years ago
Hmm, I'm going with C) Deterrent. The phishing simulations are meant to deter employees from engaging in risky online behavior.
KA
Kati
2 years ago
I think it could also be A) Preventive, since the goal is to prevent security incidents by raising awareness.
FA
Fallon
2 years ago
I agree, C) Deterrent makes sense. It's all about preventing employees from falling for phishing attacks.
HA
Haydee
2 years ago
D) Detective makes more sense to me. The exercises are designed to detect which employees need more cybersecurity training.
JU
Julio
2 years ago
I think the control being utilized is preventive.
AY
Ayesha
2 years ago
I think the correct answer is A) Preventive. The phishing simulation exercises are designed to prevent employees from falling for real phishing attacks.
TI
Timothy
2 years ago
I'm leaning towards A) Preventive as well. It's better to be safe than sorry when it comes to cybersecurity.
EL
Eladia
2 years ago
I think it could also be C) Deterrent, to scare employees into being more cautious.
KE
Kenneth
2 years ago
I agree, A) Preventive makes sense. It's all about stopping the attacks before they happen.