easyMultiple SelectObjective-mapped
Key Indicators of Effective Security Awareness Training: CISSP Practice
Which TWO of the following are key indicators that a security awareness training program is effective? (Choose two.)
Quick Answer
The answer is a measurable increase in employees reporting suspicious emails and a reduction in the number of successful phishing attacks. These two indicators are correct because they directly measure behavioral change and risk reduction: reporting shows that employees can recognize phishing indicators like mismatched URLs or urgent language, while a drop in successful attacks confirms that this recognition is preventing actual compromises. On the CISSP exam, this tests your understanding of the Security and Risk Management domain, specifically how to evaluate security awareness program metrics using leading versus lagging indicators. A common trap is to confuse completion rates or test scores with effectiveness—those measure participation, not behavior change. Remember the mnemonic “Report to Reduce”: if reporting goes up and successful attacks go down, your training is working.
⚠ Common exam trap
It's easy for candidates to confuse activity metrics (e.g., more help desk calls) with effectiveness metrics, or mistakenly think that fewer policies indicate simpler, more effective training, when in fact the CISSP emphasizes behavioral outcomes like reporting and reduced incident success rates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An increase in employees reporting suspicious emails to the security team.
A measurable increase in employees reporting suspicious emails directly indicates that the training has improved their ability to recognize phishing indicators (e.g., mismatched URLs, spoofed sender domains, urgent language) and has instilled the desired reporting behavior. This is a leading indicator of security awareness effectiveness, as it demonstrates proactive threat identification before a compromise occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
More instances of employees bypassing security controls to improve productivity.
Why it's wrong here
Bypassing controls is a security risk, indicating training failure.
- ✗
An increase in help desk calls for password resets.
Why it's wrong here
More password reset calls may indicate confusion, not effective training.
- ✓
An increase in employees reporting suspicious emails to the security team.
Why this is correct
Reporting suspicious emails shows that employees are applying their training.
- ✗
Fewer security policies are being issued.
Why it's wrong here
Policy count is not a measure of training effectiveness.
- ✓
A reduction in the number of successful phishing attacks.
Why this is correct
Successful phishing attacks decline when employees are trained to recognize them.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security awareness
Security awareness is the ongoing practice of educating people within an organization about cybersecurity risks, safe behaviors, and their individual responsibilities to protect information assets.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization is implementing a security awareness program. Which topic should be emphasized most?
medium- A.Social media usage
- ✓ B.Phishing recognition
- C.Password policy
- D.Clean desk policy
Why B: Phishing recognition is the most critical topic because phishing attacks are the primary vector for initial access in over 90% of security breaches, according to Verizon's DBIR. Unlike other topics, phishing directly exploits human psychology to bypass technical controls like email filters and MFA, making user detection the last line of defense. Emphasizing this topic reduces the risk of credential theft, malware installation, and ransomware deployment more effectively than any other single awareness area.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.