hardMultiple SelectObjective-mapped
CISA Practice Question: Which THREE of the following are key components…
Which THREE of the following are key components of an effective information security awareness program? (Choose three.)
⚠ Common exam trap
A common mix-up: candidates confuse a reward program for reporting incidents as a core component of awareness, when in fact it is a supplementary measure, not a foundational element like management support or regular training.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Phishing simulation exercises
Phishing simulation exercises are a key component of an effective information security awareness program because they provide hands-on, practical experience in identifying and responding to real-world phishing attempts. By simulating attacks, organizations can measure employee susceptibility, reinforce training, and reduce the risk of successful social engineering attacks. This proactive approach helps build a security-conscious culture and directly addresses the human factor in cybersecurity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Phishing simulation exercises
Why this is correct
Simulations test and improve behavior.
- ✗
Reward program for reporting incidents
Why it's wrong here
Nice but not a key component.
- ✗
Annual one-time training for all employees
Why it's wrong here
Too infrequent; awareness declines.
- ✓
Support from top management
Why this is correct
Management support is critical for success.
- ✓
Regularly scheduled training sessions on security policies
Why this is correct
Ongoing training reinforces awareness.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.