CISM Information Security Programme Practice Question
A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Employee role and job function
Option B (Employee role and job function) is correct because employees in finance, HR, or executive roles face different phishing lures and risk levels, so simulations should be tailored to the specific threats and responsibilities of each role. Option C (Past phishing click rate trends) is correct because historical click-rate data reveals which users or departments are most susceptible, allowing frequency and difficulty to be adjusted upward or downward based on demonstrated performance. Option E (Current threat landscape and prevalent attack types) is correct because simulations must reflect real-world tactics such as credential harvesting, QR-code phishing, or business email compromise that are actively trending, ensuring training stays relevant. Option A (Employee's years of service) is not a reliable indicator of phishing susceptibility, since tenure does not correlate consistently with security awareness or behavior. Option D (Number of security incidents in the past year) is too broad and lagging an indicator; it does not directly inform the design of phishing simulation frequency or difficulty the way role, click trends, and threat landscape do.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employee's years of service
Why it's wrong here
Years of service does not predict phishing susceptibility; tenure is unrelated to whether an employee recognises a lure. It suits onboarding or role-based training assignment, not setting simulation frequency and difficulty, which should follow baseline click rates and risk exposure.
- ✓
Employee role and job function
Why this is correct
Role and job function determine exposure to targeted attacks, such as finance staff facing invoice fraud or executives facing spear phishing. Tailoring simulation difficulty by function ensures relevance and avoids over-testing low-risk roles, satisfying the stem's design factor requirement.
- ✓
Past phishing click rate trends
Why this is correct
Historical click-rate trends reveal which campaigns and templates already fool employees, allowing difficulty to increase progressively rather than plateau. This metric-driven adjustment satisfies the stem's requirement to consider frequency and difficulty based on demonstrated susceptibility.
- ✗
Number of security incidents in the past year
Why it's wrong here
Lagging indicator; not used to design simulations.
- ✓
Current threat landscape and prevalent attack types
Why this is correct
Aligning simulations with current threat landscape attack types, such as credential harvesting or QR-code phishing, ensures employees practise against realistic vectors. This satisfies the stem's requirement that frequency and difficulty reflect prevalent attacks rather than generic, outdated templates.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.