Free Security Awareness Programs practice questions
10 free SY0-801 questions on Security Awareness Programs, each with a full explanation — no account needed. This section sits in the Program Management and Oversight part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
Ahead of the busy invoice season, a company assigns a deeper business email compromise module only to its accounts payable and payroll staff. Which type of training is this?
Training sent to a group chosen in advance for its role or risk, here the people who move money, is targeted training. Corrective training is the tempting choice when only some people receive a module, but it is triggered by a specific failure, and ongoing training follows the calendar for everyone.
A payroll specialist has failed four phishing simulations in six months despite completing every corrective module the LMS assigned. Which delivery method is the BEST next step?
One-to-one delivery changes an individual's behavior most effectively and costs the most, so programs reserve it for high-risk roles and repeat failures like this one. More LMS modules have already failed to change her behavior, a portal relies on her seeking help herself, and a webinar can't be tailored to her mistakes.
A company is about to launch a new phishing awareness curriculum and wants to be able to show later whether it changed behavior. What should it do FIRST?
An unannounced baseline campaign before new training begins gives later results something to compare against. Training first is the tempting order, but then there is no before picture to measure the change against, and announcing simulations in advance distorts what they measure.
A simulation team is choosing next month's phishing lure. Which lure should it rule out, however realistic it would be?
Lures that promise bonuses or raises, threaten layoffs or exploit health scares damage trust far more than they teach, as GoDaddy's 2020 holiday bonus simulation showed. Invoice, text-only BEC and QR code lures mirror threats organizations actually see and are appropriate, as long as the simulation doesn't capture real passwords.
An employee realizes she typed her password into a page linked from a suspicious email about ten minutes ago. What should she do?
The one rule everyone should know is to report anything suspicious right away, including something already clicked, because a report within minutes lets analysts contain the attack and purge other copies. Quietly deleting the email or forwarding it to coworkers never reaches the people who can protect everyone, and waiting gives the attacker time.
An accounts payable clerk receives an email from a long-time supplier saying its bank has changed and asking that Friday's payment go to a new account. What should she do?
Any change to payment details is verified by calling a number already on file, never one in the message, because a BEC message may come from a compromised or lookalike account. Replying to the email or calling the number in its signature can reach the attacker, and a familiar sender address isn't proof the request is genuine.
An employee finds a USB drive labeled Q4 Salaries in the office parking lot. What should she do with it?
Training says never to plug in a drive you found and to give it to security instead, since a USB device carries its payload straight past the firewall and the mail gateway. Plugging it in to find the owner is exactly what the attacker is counting on, whichever computer is used, and throwing it away skips the step training teaches.
After her inbox suddenly fills with hundreds of spam messages, a remote employee gets a Teams call from someone saying he is from the help desk. He offers to stop the spam if she opens Quick Assist and grants him access. What should she do?
In 2024, ransomware affiliates used exactly this pattern, flooding inboxes with spam and then posing as the help desk to get remote access through Quick Assist, so she should decline and verify through a contact she already knows. Asking for an employee ID is tempting, but the caller supplies the answer, so it verifies nothing.
An employee loses her personal phone, which holds work email in a managed app under the BYOD program. She hesitates to report it because she fears the company will erase her family photos. What should training have told her?
Under a typical BYOD arrangement the company manages only the work profile or container and can wipe only that, not personal photos, and training should say how quickly to report a lost phone because the selective wipe depends on it. Waiting gives whoever has the phone more time with company data, and a full wipe isn't needed to protect the work data.
As an employee badges into the office, a man without a visible badge walks up close behind her and says he left his at his desk. What does situational awareness training tell her to do?
Situational awareness means noticing what doesn't fit, such as someone following you through a badge door, and the behavior to train is notice and report. Employees aren't guards, so physically blocking or shadowing the man is wrong, and holding the door lets a possible intruder bypass the badge control.
Study this section
Every lesson that covers Security Awareness Programs on the SY0-801 exam.