Drag a concept onto its matching description — or click a concept then click the description.
Concepts
Matches
Improved phishing resistance
Better escalation culture
Faster detection and triage
Targeted refresher coaching needed
SY0-701 Security Program Management and Oversight Practice Question
Match each awareness-program metric or pattern to the best interpretation. Use each interpretation once.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Phishing click rate: Susceptibility
Phishing click rate measures susceptibility, reporting rate indicates vigilance, training completion rate shows participation, repeat offender rate identifies high-risk users, time to report reflects responsiveness, and knowledge assessment score measures understanding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Phishing click rate: Susceptibility
Why this is correct
Phishing click rate directly measures the percentage of simulated phishing emails that a user clicks on during a controlled campaign. This metric captures real user behavior in a safe environment, quantifying the likelihood that the user will fall for a genuine phishing attack. Because it isolates the act of clicking, it is a direct indicator of susceptibility rather than a proxy for knowledge or intention.
- ✓
Reporting rate: Vigilance
Why this is correct
Reporting rate tracks how frequently users proactively forward or flag suspicious emails to the security team, often via an integrated reporting button. This metric demonstrates that users are not only recognizing potential threats but also taking appropriate action to alert the organization. High reporting rates correlate with a watchful security culture, making reporting rate the standard measure of vigilance.
- ✓
Repeat offender rate: High-risk users
Why this is correct
Repeat offender rate identifies users who repeatedly fail simulated phishing tests by clicking or providing credentials across multiple campaigns. These users represent a persistent vulnerability that general awareness training has not remediated, requiring targeted one-on-one coaching or additional controls. By flagging this subgroup, the metric enables security teams to focus limited resources on the highest-risk individuals.
- ✗
Training completion rate: Responsiveness
Why it's wrong here
Training completion rate measures the percentage of users who finish assigned security awareness modules, which reflects participation and program rollout, not responsiveness. Responsiveness is concerned with the speed and appropriateness of actions during an actual or simulated threat, such as the time taken to report a phishing email. A user could complete all training but still be slow to react, so completion rate does not capture response behavior.
- ✗
Time to report: Understanding
Why it's wrong here
Time to report measures the elapsed time between a user receiving a simulated phishing email and reporting it, which gauges responsiveness and alertness. Understanding, in contrast, is about the depth of knowledge a user possesses, such as being able to identify phishing indicators or explain security policies. A quick report could be habitual or automated, and it does not necessarily indicate that the user comprehends the underlying threat, so time to report is not a valid measure of understanding.
- ✗
Knowledge assessment score: Participation
Why it's wrong here
Knowledge assessment score is obtained from quizzes or tests that evaluate a user's comprehension of security concepts, directly measuring understanding. Participation, on the other hand, is simply whether a user attended or completed training activities, which is tracked by completion or attendance records. A user might score high on an assessment without participating in voluntary sessions, or participate fully yet score poorly, so this metric does not reflect participation.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Match each awareness-program metric to the interpretation the security team should use. 1. 8% of users clicked the simulated phishing link. 2. 34% of users reported the simulation using the report-phish button. 3. The median time from message delivery to first user report was 12 minutes. 4. 96% of staff completed the annual awareness module.
medium- ✓ A.8% of users clicked: Indicates user susceptibility to phishing.
- ✓ B.34% of users reported: Reflects security culture and reporting behavior.
- ✓ C.Median report time of 12 minutes: Measures responsiveness to phishing.
- ✓ D.96% staff completed training: Shows training adoption and awareness.
- E.8% of users clicked: Demonstrates strong security culture.
- F.34% of users reported: Measures susceptibility to phishing.
Why A: Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.
Variation 2. A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?
medium- A.95% of employees completed the training within the deadline.
- B.The number of employees reporting phishing attempts to the SOC increased by 40%.
- ✓ C.The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.
- D.The number of helpdesk tickets related to password resets decreased by 10%.
Why C: Directly measures the reduction in risky behavior (clicking phishing links) after training, which is the core goal of security awareness training. A drop from 18% to 6% demonstrates a measurable behavior change, not just knowledge acquisition. This aligns with the Kirkpatrick Model's 'Behavior' level of evaluation, which is the strongest indicator of training effectiveness.
Variation 3. Which four of the following are key components of a successful security awareness and training program within an organization? (Choose four.)
medium- ✓ .Executive-level sponsorship and support for the program
- ✓ .Metrics to measure effectiveness, such as click rates on simulated phishing emails
- ✓ .Phishing simulations to reinforce practical skills
- ✓ .Role-based training tailored to specific job functions
- .Outsourcing all training content development to a single vendor without internal review
- .Annual one-time training with no follow-up assessments
Why : Role-based training is correct because it ensures that employees receive security education relevant to their specific job functions, such as data handling for finance or system access for IT, which increases the practical applicability and retention of security principles. Phishing simulations are correct as they provide hands-on reinforcement of skills, allowing employees to practice identifying and reporting malicious emails in a controlled environment, which directly reduces real-world risk. Metrics like click rates on simulated phishing emails are correct because they provide quantifiable data to measure program effectiveness, identify high-risk groups, and guide continuous improvement. Executive-level sponsorship is correct because it provides the necessary authority, resources, and organizational commitment to prioritize security awareness, ensuring the program is taken seriously across all departments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.