- Welcome to lesson 28, Deep Dive Quiz.
This is our last quiz together.
Now, lesson 28 was about given a scenario,
implement security awareness practices.
And we had one lesson 28.1
where we focused on education, training, and awareness.
So let's do five questions together.
You know how to do this,
but I'm gonna give you one last reminder,
pen or pencil, paper at the ready,
and then put me on pause as often as you need to.
All right, let's get started.
All right, question one,
we're gonna complete the sentence
by dragging and dropping the words.
In the SETA model, education is all about blank,
and the best teaching method is blank.
Training focuses on blank,
and the best assessment method is blank.
And awareness is sharing of blank
with the objective of influencing blank.
That's a lot of blanks, isn't it?
And our words are information, behavior,
short-term, skills development, insight
intermediate, problem solving, and discussion.
Go ahead and put me on pause
while you work on filling in those blanks.
Right, in SETA model,
education is gonna be all about insight,
and the best teaching method of our choices given here
is going to be discussion.
Training focuses on skills development,
it's what you and I have been doing.
And the best assessment method
is going to be problem solving.
And lastly, awareness is the sharing of information
with the objective of influencing behavior.
All right, let's read the whole thing and see if we agree.
In the SETA model, education is about insight,
and the best teaching method is discussion.
Training focuses on skills development,
and the best assessment method is problem solving.
And awareness is the sharing of information
with the objective of influencing behavior.
Do you agree?
All right, let's check.
And we are correct, awesome.
All right, question two.
Which technique is not appropriate
for a board of directors briefing?
Use business language, reference compliance requirements,
cover a wide range of topics,
or provide pre-reading materials.
So which technique would not be appropriate
for a board of directors briefing,
or for executive management?
What are you gonna choose?
Well, we do wanna use business language,
so that would be appropriate.
We really should reference compliance requirements,
so that would be appropriate.
They love having pre-reading materials
so they come prepared, so that's appropriate.
How about this one?
We don't wanna mean meander,
we don't wanna cover a wide range of topics.
We'll probably only have a short period of time,
we wanna be concise, we wanna stay focused,
and only cover a couple of topics.
What we really, really need to be sharing with them.
Do you agree?
All right, let's check.
And that's correct.
All right, question three.
The best way to build management support
for social engineering training and simulations is to,
share anecdotal stories,
require that they go to training,
quantify the value to the organization,
or provide industry statistics.
So we're trying to build management support
to have social engineering training and simulations.
We tell stories about, "Oh, this happened at this place,
"and this happened at that place."
Or say, "Well, you're gonna have to go."
Or provide industry statistics about, you know,
how other industries or other companies in our industry
have been perhaps social engineered,
or do we quantify the value to the organization?
What do you think?
Put me on pause if you wanna think about it.
Well, whenever we're trying to build management support,
could be for social engineering training and simulation,
really could be for almost anything,
we always wanna quantify the value to the organization.
Agree, all right.
And that's correct.
All right, question four,
we are going to order the set of maturity model
from the lowest number one, to the highest number five.
So we've got measurable and reportable, integrated,
compliance driven, non-existent, or ad hoc.
Go ahead and put me on pause so you can put these in order.
All right, well, I'm gonna start
with the lowest and number one, non-existent.
We don't have a security education training
and awareness program.
Next would probably be ad hoc,
we do it when we need it, we do what we think we should.
Maybe it's in response to an attack,
maybe it's a response to a regulatory exam comment.
All right, well, what do we do after that?
Well, it becomes compliance-driven,
that the only reason we're doing it, right?
Might be, we're doing it on a regular basis,
but the only reason we're doing it
is because we have a compliance requirement.
If we didn't have the compliance requirement,
forget about it, we would never do it.
Next it becomes integrated,
it becomes part and parcel of our organization,
of our DNA, it's expected.
And lastly, it is measurable and reportable,
and it's metric-driven.
So we can assess how well our set of program
is actually working.
So non-existent, ad hoc, compliance driven,
integrated, measurable, and reportable,
Agree? Let's check.
And we are correct.
Okay, here's our very last question together.
What is the secret to impactful training?
I want you to choose all that apply.
Interactive, comfortable,
welcoming, personalized, and engaging.
What do you think? Choose all that apply.
Well, hopefully you said every single one of those,
that impactful training is interactive, it's comfortable,
it's welcoming, it's personalized, and it's engaging.
Should we check?
I don't even think we need to
'cause we know it's right,
but let's go ahead and check anyway.
And there we go, it's correct.
Congratulations, a great job.
Now don't go away yet
'cause we still have one more lesson.
We're going to do lesson 29,
which is preparing for the SYO-701 exam.
There won't be any quiz,
but we do have some really important topics to discuss.
So I'll see you there.