SY0-701 Security Program Management and Oversight Practice Question
After a phishing simulation, many users still nearly entered credentials on the fake page. Security wants the fastest improvement without scheduling long training sessions. What is the best response?
⚠ Common exam trap
CompTIA often tests the misconception that immediate technical controls (like password resets) are the fastest fix, when in reality, behavioral reinforcement through targeted communication yields quicker and more sustainable improvement in user vigilance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Send a short targeted awareness message with examples, warning signs, and reporting steps.
A short targeted awareness message directly addresses the observed risky behavior with minimal time investment, providing immediate reinforcement of warning signs and reporting procedures. This approach leverages just-in-time training, which is proven to improve retention and behavior change more effectively than lengthy sessions, aligning with the goal of fastest improvement without disrupting operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require a full-day classroom course for every employee immediately.
Why it's wrong here
Requiring a full-day classroom course for every employee immediately is operationally disruptive and delayed, so it fails to provide the timely, focused reinforcement needed when click-through rates are high. A lengthy course also introduces training fatigue and removes staff from their duties, yet it doesn't specifically address the patterns observed in the simulation, such as which lure types succeeded. Because the goal is rapid risk reduction, a brief, targeted notice can be deployed within minutes, while a full-day course creates a window during which employees remain vulnerable.
- ✗
Ignore the results because no actual breach occurred.
Why it's wrong here
Ignoring the results because no actual breach occurred treats phishing simulations as breach detectors rather than as diagnostic tools for security awareness. Even when users only 'nearly entered' credentials, the high click rate reveals a gap in threat recognition that an attacker could exploit in a real campaign. Without corrective action, the same vulnerable behavior will persist, and the opportunity to use this near-miss data to strengthen the human layer of defense is lost.
- ✓
Send a short targeted awareness message with examples, warning signs, and reporting steps.
Why this is correct
This is the best option because it provides immediate reinforcement with minimal disruption. Targeted communication can quickly remind users what phishing looks like, what clues to watch for, and how to report suspicious messages. It is practical, timely, and easier to absorb than a long training event when the goal is rapid behavior improvement.
- ✗
Reset every employee password as the main way to prevent future clicks.
Why it's wrong here
Resetting every employee password as the primary response does not address the root cause, which is failure to recognize phishing indicators rather than compromised credentials. If the simulation did not capture passwords, a mass reset adds unnecessary friction, encourages weak or written-down passwords, and diverts resources from implementing effective controls like email filtering and user reporting. It also gives a false sense of security, as future phishing attempts would still be clicked with the new passwords.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.