CISM Information Security Programme Practice Question

When designing phishing simulations, which approach best balances user learning and operational disruption?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Start with low-difficulty simulations, increase difficulty over time, and require remediation training for clickers

Progressive difficulty and remediation training for clickers helps users learn while minimizing negative impact on productivity.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Send high-difficulty simulations monthly without training
Why it's wrong here
May cause frustration and not improve skills.
✓
Start with low-difficulty simulations, increase difficulty over time, and require remediation training for clickers
Why this is correct
This approach educates users and improves detection skills gradually.
✗
Use low-difficulty simulations quarterly with no follow-up
Why it's wrong here
Lack of difficulty progression limits learning.
✗
Send random-difficulty simulations weekly and report clickers to management
Why it's wrong here
Too frequent and punitive; may reduce morale without effective learning.

Go deeper