SY0-701 · Objective 5.6 · Security Program Management and Oversight
5.6 Security awareness explained
The official objective: “Given a scenario, implement security awareness practices.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 5.6 covers
People are part of every security control, and objective 5.6 covers how an organisation helps them get it right. It is a scenario objective, so expect questions about which awareness practice fits a situation.
Phishing is the centrepiece. Phishing campaigns send simulated phishing messages to staff to see who clicks and who reports. The purpose is to measure behaviour and target training, not to punish people. Staff should learn to recognise a phishing attempt and to respond correctly, which usually means using a one-click report button or a known security mailbox rather than deleting the message quietly.
Anomalous behaviour recognition teaches people to notice when something is off. The objective splits it into risky behaviour (deliberately ignoring rules), unexpected behaviour (actions that don't fit someone's normal pattern) and unintentional behaviour (honest mistakes, such as emailing a file to the wrong address). Recognising these in colleagues, as well as in yourself, helps spot insider threats early.
User guidance and training covers the topics a programme should teach. Policy and handbooks. Situational awareness. Insider threat, including warning signs like unusual access or unexplained financial stress. Password management. Removable media and cables. Social engineering. Operational security, meaning not sharing details that help attackers. Hybrid and remote work, such as using a VPN on public Wi-Fi and keeping screens out of view in shared spaces.
Reporting and monitoring make the programme measurable. Initial results show where people start, and recurring measurement shows whether click rates fall and report rates rise. Those numbers guide where to spend training effort.
Development and execution is the last part. A programme is planned, delivered and repeated. Training happens at onboarding and then periodically, because threats change and people forget. Content should fit the audience; finance staff need more on payment fraud, and developers more on secure coding.
When you answer, look at what the scenario is trying to change. If the goal is to measure how staff respond to phishing, it is a phishing campaign. If the goal is to get suspicious messages to analysts quickly, it is reporting. If someone made an honest mistake, it is unintentional behaviour. If staff need to spot a colleague acting suspiciously, it is insider threat training.
What candidates mix up
- Phishing campaign versus phishing training: the campaign measures behaviour; the training changes it. A good programme uses both.
- Risky versus unintentional behaviour: risky is a choice to ignore rules; unintentional is an honest mistake.
- Awareness training is periodic, not one-time: onboarding alone isn't enough.
Practice questions for 5.6
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A company runs quarterly phishing simulations and tracks each department's click rate and report rate over time. What is the PRIMARY purpose of this program?
- AMeasure user behavior to target training and reinforce reporting
- BValidate that the email gateway blocks malicious attachments
- CCollect evidence to discipline employees who click on links
- DJustify removing technical email filtering in favor of user vigilance
Show answer and explanation
Answer: A) Measure user behavior to target training and reinforce reporting
Phishing simulations measure how users actually behave so the organization can target training where it's needed and encourage prompt reporting. They are a people-focused control that works alongside technical email defenses.
- ASimulations produce behavioral metrics (clicks, credential entry, reports). These show which users or departments need follow-up training and encourage staff to report suspicious messages.
- BSimulated phishing messages are deliberately delivered to users so their behavior can be measured. The exercise tests people, not the filtering effectiveness of the mail gateway.
- CAwareness programs are meant to educate and to build a culture where people report suspicious messages. Using results to punish people discourages reporting and undermines the program.
- DUser awareness is one layer of defense in depth. It complements technical controls such as filtering and email authentication and doesn't replace them.
Question 2
Security awareness training teaches staff to notice when a colleague suddenly accesses unusual systems, works odd hours and shows unexplained financial stress. Which training topic is this?
- AInsider threat recognition
- BPassword management
- CRemovable media handling
- DPhishing recognition
Show answer and explanation
Answer: A) Insider threat recognition
- ATraining staff to recognize unusual behavior helps detect insider threats early.
- BPassword management covers creating and protecting credentials.
- CThat covers safe use of USB drives and similar devices.
- DPhishing training focuses on suspicious messages, not colleagues' behavior.
Question 3
An employee accidentally emails a spreadsheet of customer data to the wrong external address. How should awareness training classify this kind of behavior?
- AUnintentional risky behavior
- BMalicious insider activity
- CA nation-state attack
- DPassive reconnaissance
Show answer and explanation
Answer: A) Unintentional risky behavior
- ATraining helps staff avoid honest mistakes and report them quickly when they happen.
- BNothing suggests the employee intended harm.
- CNo external attacker was involved.
- DReconnaissance is information gathering by attackers.
Other Security Program Management and Oversight objectives
Also: the Security Program Management and Oversight domain page (20% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.