SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Send one enterprise-wide warning email listing every phishing indicator the users should memorize.

  Why it's wrong here

  A single enterprise-wide warning email listing every generic indicator creates a passive, one-way communication that users are unlikely to read thoroughly or retain. It does not reference the specific social-engineering lure used in the simulation, so users cannot connect the warning to the actual near-miss behavior that occurred. This approach also lacks an integrated reporting mechanism, leaving users without a clear path to act on future suspicious messages.

• ✗

  Require all employees to retake the full annual security course immediately.

  Why it's wrong here

  Requiring every employee to immediately retake the full annual security course is a disproportionate response to a simulation that only affected a subset of users. The training is generic and not contextualized to the specific lure, so it fails to deliver the focused, applicable feedback needed to change behavior. It also disrupts operations across the entire organization and can create resentment, making employees less receptive to security messaging.

• ✓

  Use short, targeted awareness messages with screenshots of the actual lure and an easy reporting path.

  Why this is correct

  Short, targeted awareness messages that show the actual simulated lure give users a concrete, contextual example of what they encountered, which is far more memorable than abstract rules. By keeping the message brief, you respect the user's time and maximize attention, while an easy reporting path lowers the barrier to action in real future incidents. This just-in-time coaching turns the simulation into a constructive learning opportunity rather than a punitive test, promoting a positive security culture.

• ✗

  Remove email access for any user who clicked the simulation link.

  Why it's wrong here

  Removing email access for anyone who clicked the simulation link treats a training exercise as a security incident and punishes behavior that the simulation was designed to reveal. This punitive approach creates a culture of fear, causing users to hide mistakes and avoid reporting real phishing attempts, which defeats the purpose of security awareness. It also disrupts business operations for affected users and can damage trust in the security team, making the organization less safe overall.