CyberSecurity - SETA Quiz

1.
What is the SETA program designed to do?

• Reduce the occurrence of external attacks
• Reduce the occurrence of accidental security breaches
• Increase the efficiency of InfoSec staff
• Improve operations

 

 2.
A SETA program consists of three elements: security education, security training, and which of the following?

• Security accountability
• Security awareness
• Security authorization
• Security authentication

 

 3.
The purpose of SETA is to enhance security in all but which of the following ways?

• By building in-depth knowledge
• By developing skills
• By improving awareness
• By adding barriers

 

 4.
Which of the following is an advantage of the one-on-one method of training?

• Maximizes use of company resources
• Trainees can learn from each other
• Customized
• Very cost-effective

 

 5.
Which of the following is the most cost-effective method for disseminating security information and news to employees?

• Security-themed Web site
• Conference calls
• Distance learning seminars
• Security newsletter

 

 6.
Which of the following is a disadvantage of the one-on-one training method?

• Inflexible
• Content may not be customized to the needs of the organization
• May not be responsive to the needs of all the trainees
• Resource intensive, to the point of being inefficient

 

 7.
Which of the following is an advantage of the user support group form of training?

• Usually conducted in an informal social setting
• Formal training plan
• Can be live, or can by archived and viewed at the trainee's convenience
• Can be customized to the needs of the trainee

8.
What might be the financial consequences to an organization for not addressing SETA needs properly?

• Security breaches as a result of careless employee behavior
• Employees may receive training but not understand the security implications.
• Employees will be ill-informed about security best practices

9.
Why is it important to make the distinction between training, awareness, and education?

• Each has a different intended outcome. Failure to understand the desired outcome can result in poorly executed SETA efforts.
• Because each should be delivered through a different channel
• Because some are more important than others

 

 10.
Why are insider threats not part of typical SETA efforts?

• Bad internal actors cannot be re-trained by teaching the end user how to use technology in a security-compliant way
• Because SETA targets employees, contractors and other stakeholders
• Insider threats are not the concern of security professionals