mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Needs to ensure that its employees understand…
An organization needs to ensure that its employees understand their responsibilities regarding information security. Which of the following is the MOST effective way to achieve this?
⚠ Common exam trap
The trap here is that candidates often mistake a one-time annual briefing (Option B) as sufficient due to its common use in compliance checklists, but the CISSP emphasizes continuous, behavior-changing programs over periodic, passive activities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a security awareness program with regular training and assessments.
A security awareness program with regular training and assessments is the most effective way to ensure employees understand their responsibilities because it establishes a continuous learning cycle. Unlike one-time events, it reinforces secure behaviors through repetition, real-world scenarios, and measurable assessments, aligning with the NIST SP 800-50 framework for building a security-conscious culture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Distribute a security policy document and require a signature.
Why it's wrong here
While requiring a signature confirms receipt and acknowledgment of a security policy, it does not inherently ensure comprehension or retention of its detailed contents. Employees might sign without fully reading or understanding the implications of each clause, leading to non-compliance due to ignorance rather than malicious intent. This approach lacks mechanisms to verify actual knowledge transfer or behavioral change.
- ✗
Conduct a one-time annual security briefing.
Why it's wrong here
A single annual security briefing, while providing initial information, is generally insufficient for long-term knowledge retention and sustained behavioral modification. Human memory naturally fades over time, and new threats or policy updates may emerge throughout the year. Without regular reinforcement and updated content, employees are likely to forget critical security details, significantly diminishing the effectiveness of the training.
- ✗
Display security posters in common areas.
Why it's wrong here
Security posters serve primarily as a passive awareness tool, offering visual reminders of general security principles or specific threats. While they can help reinforce existing knowledge and keep security top-of-mind, they inherently lack the interactive depth and detailed instruction necessary to teach complex security concepts or specific procedural requirements. Posters alone cannot build foundational understanding or assess comprehension effectively.
- ✓
Implement a security awareness program with regular training and assessments.
Why this is correct
An effective security awareness program incorporates regular, ongoing training sessions to reinforce critical concepts, adapt to evolving threats, and address new vulnerabilities. Crucially, it includes assessments (e.g., quizzes, simulated phishing exercises) to objectively measure employee comprehension and identify knowledge gaps. This continuous cycle of education, reinforcement, and evaluation ensures employees not only receive information but also understand, retain, and consistently apply security best practices, thereby measurably improving the organization's human firewall.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security awareness
Security awareness is the ongoing practice of educating people within an organization about cybersecurity risks, safe behaviors, and their individual responsibilities to protect information assets.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.