SY0-701 Security Program Management and Oversight Practice Question
Exhibit
Awareness dashboard -------------------------------------------------- Quarter 1 -> Quarter 2 Phish click rate: 14% -> 9% Phish report rate: 21% -> 34% Median time to report: 16 min -> 7 min Training completion: 98% -> 99%
Based on the exhibit, which metric best indicates improved phishing resistance?
⚠ Common exam trap
CompTIA often tests the misconception that training completion rate (Option A) is the best indicator of security awareness, but the exam emphasizes that behavioral metrics like phish report rate are more meaningful because they measure actual user response to threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Phish report rate.
The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Training completion rate.
Why it's wrong here
Training completion rate tracks how many employees finish assigned security awareness modules. While high completion shows the organization delivered training, it measures attendance—not whether learners can actually identify a phishing attempt. An employee can click through every module without internalizing the signals, so completion alone cannot indicate improved phishing resistance.
- ✗
Number of phishing emails sent by attackers.
Why it's wrong here
The number of phishing emails sent by attackers is an external threat-intel metric, not a human-performance metric. It depends on attacker campaigns and distribution lists, not on employees' detection ability. Even if volumes fall, attackers may have shifted to more targeted attacks; if volumes rise, employee reporting could be excellent or poor, so this number is not an outcome measure of training.
- ✓
Phish report rate.
Why this is correct
Phish report rate measures the proportion of simulated or real phishing deliveries that users report through the designated reporting mechanism. It directly reflects whether employees are not only recognizing suspicious messages but also taking the correct security action, making it a leading indicator of phishing resistance. Higher report rates typically correlate with lower engagement with malicious emails and better SOC visibility.
- ✗
Total number of help desk tickets.
Why it's wrong here
Total help desk tickets aggregate every support request, including password resets, hardware failures, and software connectivity issues. It is a noisy operational metric that can climb because of an unrelated system outage or a new application rollout, so it does not isolate phishing-detection behavior. Users may report phishing to help desk, but nothing in total volume reveals those are phishing-related, making it unsuitable for measuring improvement.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.