SY0-701 Security Program Management and Oversight Practice Question
After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?
⚠ Common exam trap
CompTIA often tests the distinction between input metrics (e.g., training sent) and outcome metrics (e.g., user reporting), leading candidates to choose a metric that sounds related but does not measure actual behavioral improvement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The percentage of users who report simulated phishing emails to security.
The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The number of training emails sent to employees each month.
Why it's wrong here
Sending training emails is an input metric that captures program activity but not the outcome of improved security awareness. A high volume of emails does not guarantee employees read, understand, or change their behavior; many may archive or ignore them. Measuring awareness requires behavioral evidence, such as users actively reporting simulated phishing, rather than counting distribution messages.
- ✓
The percentage of users who report simulated phishing emails to security.
Why this is correct
Reporting suspicious messages is a strong behavioral indicator that users recognize phishing and know what to do with it. An increasing report rate is a practical metric for awareness improvement because it measures real user action, not just training attendance.
- ✗
The number of spam emails blocked by the mail gateway.
Why it's wrong here
The number of spam emails blocked by the mail gateway reflects the performance of automated email filtering, not the vigilance of employees. This technical control operates without user interaction, and even a blocked count says nothing about whether individuals can recognize social engineering indicators in messages that do appear. Phishing simulations are specifically delivered past the gateway to test human judgment, so gateway metrics are irrelevant to measuring awareness improvements.
- ✗
The number of help desk tickets closed within the month.
Why it's wrong here
Help desk ticket closure volume is an operational support metric that has no direct correlation with phishing recognition skills. Ticket counts are driven by a variety of unrelated issues such as password resets, application troubleshooting, and hardware failures, and they can even increase when users start reporting suspicious messages as they should. Closure time measures resolution efficiency, not whether staff have learned to identify malicious emails, making it an unreliable gauge for training effectiveness.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.