ISC2 CC Security Operations Practice Question
An organization is planning to implement a security awareness program. Which TWO topics should be included to address common social engineering attacks?
⚠ Common exam trap
The trap is selecting technical topics (encryption, firewall rules) because they sound security-related, but the question specifically asks for social engineering topics—candidates must distinguish between technical controls and human-focused awareness.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recognizing phishing emails
Option A (Recognizing phishing emails) is correct because phishing is one of the most common social engineering attacks, and training users to identify suspicious senders, spoofed domains, urgent language, and malicious links or attachments directly reduces the risk of credential theft and malware infection. Option B (Awareness of tailgating and piggybacking) is correct because these are physical social engineering techniques in which an attacker follows an authorized person into a restricted area, so awareness training helps employees enforce badge checks and challenge unknown individuals. Option C is not a social engineering topic; understanding encryption algorithms is a technical cryptographic concept rather than a human-focused attack vector. Option D is also technical rather than social engineering, since configuring firewall rules is an administrative network security task performed by IT staff. Option E, while valuable for overall security, addresses credential hygiene rather than the manipulation tactics that define social engineering attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Recognizing phishing emails
Why this is correct
Phishing recognition teaches staff to spot fraudulent emails, the most common social-engineering vector, satisfying the stem's requirement to address common attacks. It covers spoofed senders, urgent lures, and malicious links, reducing credential theft and payload execution.
- ✓
Awareness of tailgating and piggybacking
Why this is correct
Tailgating and piggybacking are physical social engineering techniques where an attacker follows an authorised person through a secured door. Including this topic satisfies the stem's requirement to address common social engineering attacks, since these bypass badge controls without technical exploitation, and staff awareness is the primary mitigation.
- ✗
Understanding encryption algorithms
Why it's wrong here
Encryption algorithms address data confidentiality at rest and in transit, not the human manipulation tactics — phishing, pretexting, baiting — that security awareness must counter. Encryption training would be correct for staff handling cryptographic keys or configuring TLS.
- ✗
Configuring firewall rules
Why it's wrong here
Firewall rules filter network traffic by port, protocol and address; they cannot influence whether an employee discloses credentials to a pretexting caller. Awareness programmes target human behaviour, whereas firewall configuration belongs to perimeter hardening. It would be the right control when the requirement is to restrict inbound or outbound traffic between network segments.
- ✗
Proper password management using a password manager
Why it's wrong here
Password managers generate and store credentials, but social engineering manipulates trust to obtain access or data directly, bypassing password reuse entirely. Password management addresses credential hygiene and breach reuse, so it fits an authentication-strengthening programme rather than one covering pretexting, phishing and tailgating tactics.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Terminal Access Controller Access Control System Plus
TACACS+ is a network security protocol that separates authentication, authorization, and accounting to control who can access network devices and what they can do.
Key term
Security awareness
Security awareness is the ongoing practice of educating people within an organization about cybersecurity risks, safe behaviors, and their individual responsibilities to protect information assets.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.