CompTIA Security+ (SY0-701) Exam Questions

Domain 1: General Security Concepts (12%)

---

A hospital encrypts patient records stored on its database servers so that even if an attacker steals the physical disks, the data cannot be read without the encryption key. Which principle of the CIA triad does this control primarily protect?

⬜ Availability
⬜ Confidentiality
⬜ Integrity
⬜ Non-repudiation

A company’s security policy requires that every login attempt, file access, and configuration change made by an administrator be recorded in a tamper-evident log for later review. Which element of the AAA (Authentication, Authorization, and Accounting) framework does this describe?

⬜ Authentication
⬜ Authorization
⬜ Accounting
⬜ Non-repudiation

An organization redesigns its network so that no user or device, whether inside or outside the corporate network perimeter, is automatically trusted, and every access request must be continuously authenticated, authorized, and validated based on all available data points before access is granted. Which security concept does this describe?

⬜ Defense in depth
⬜ Zero Trust
⬜ Security through obscurity
⬜ Least functionality

A contract is digitally signed by a vendor using their private key. Later, the vendor denies having agreed to the contract, but the customer is able to cryptographically prove, using the vendor’s corresponding public key, that only the vendor could have created that signature. Which security concept does this scenario demonstrate?

⬜ Confidentiality
⬜ Availability
⬜ Non-repudiation
⬜ Obfuscation

A retail store posts visible warning signs stating that all areas are under 24-hour video surveillance, primarily intending to discourage would-be shoplifters from attempting theft in the first place, rather than to catch them in the act. Which category of security control does this represent?

⬜ Detective control
⬜ Deterrent control
⬜ Corrective control
⬜ Compensating control

Before any modification, such as a firewall rule change or a server patch, is applied to a production system, it must be documented, reviewed by a change advisory board, tested, and scheduled for a defined maintenance window, with a documented rollback plan in case something goes wrong. Which practice does this describe?

⬜ Change management
⬜ Vulnerability management
⬜ Onboarding
⬜ Data retention

Which of the following AAA elements is applied immediately after a user has logged into a computer with their username and password?

⬜ Authentication
⬜ Authorization
⬜ Identification
⬜ Accounting

Logging events in an audit log is what part of the access control system?

⬜ Non-repudiation
⬜ Authorization
⬜ Authentication
⬜ Accounting

What is meant by “data at rest”?

⬜ Data present in volatile memory
⬜ Data being transmitted over a network
⬜ Data being actively processed by a computer
⬜ Data stored on a persistent storage media

A systems engineer wants to control access to critical data. Which of the following describes a security concern regarding storing and transferring data without authorization?

⬜ Integrity
⬜ Social engineering
⬜ Confidentiality
⬜ Availability

Confidentiality, integrity, and availability together form the foundational triad of information security objectives. Which of the following is NOT one of these core objectives?

⬜ Confidentiality
⬜ Integrity
⬜ Disposal
⬜ Availability

Domain 2: Threats, Vulnerabilities, and Mitigations (22%)

---

A well-funded and highly organized group, believed to be sponsored by a foreign government, spends over a year quietly infiltrating a defense contractor’s network, carefully avoiding detection while exfiltrating sensitive design documents. Which type of threat actor does this best describe?

⬜ Script kiddie
⬜ Hacktivist
⬜ Advanced persistent threat (APT) / nation-state actor
⬜ Insider threat

An employee who has legitimate administrative access to the company’s payroll system uses that access to secretly modify their own salary information for personal gain. Which type of threat actor does this represent?

⬜ External attacker
⬜ Insider threat
⬜ Hacktivist
⬜ Shadow IT

An attacker calls the IT help desk pretending to be a company executive who is “locked out and about to miss an important client call,” pressuring the technician into resetting a password without proper identity verification. Which social engineering technique is being used?

⬜ Phishing
⬜ Pretexting
⬜ Tailgating
⬜ Typosquatting

A finance clerk receives an email that appears to come from the company’s CEO, instructing her to urgently wire funds to a new vendor account before the end of the day. The sender’s email address is nearly identical to the real CEO’s but slightly altered. Which type of attack is this?

⬜ Business email compromise (BEC)
⬜ Distributed denial-of-service (DDoS)
⬜ On-path (man-in-the-middle) attack
⬜ Credential stuffing

A hospital’s files suddenly become encrypted and inaccessible, and a message demands payment in cryptocurrency to restore access, threatening to permanently delete the data if payment is not made within 72 hours. Which type of malware is responsible for this attack?

⬜ Spyware
⬜ Ransomware
⬜ Adware
⬜ Logic bomb

Security analysts discover malicious code on a compromised server that has modified the operating system’s kernel-level functions to hide its own files, processes, and network connections from standard system tools and antivirus scans. Which type of malware is this?

⬜ Rootkit
⬜ Worm
⬜ Keylogger
⬜ Trojan

A piece of malware spreads automatically from one vulnerable machine to another across a corporate network without any user having to open a file or click a link, exploiting an unpatched network service. Which type of malware best fits this description?

⬜ Virus
⬜ Worm
⬜ Trojan
⬜ Fileless malware

A web application allows users to enter a username directly into a login form field, and that input is concatenated into a database query without any validation or parameterization. An attacker enters a specially crafted string into the field that manipulates the underlying database query to bypass authentication entirely. Which vulnerability is being exploited?

⬜ Cross-site scripting (XSS)
⬜ SQL injection
⬜ Buffer overflow
⬜ Cross-site request forgery (CSRF)

Security researchers discover attackers actively exploiting a previously unknown flaw in a widely used piece of software, for which the vendor has not yet released a patch. Which term describes this type of vulnerability?

⬜ Zero-day vulnerability
⬜ Legacy vulnerability
⬜ Misconfiguration
⬜ Race condition

A programmer writes code that copies user-supplied input into a fixed-size memory buffer without checking the input’s length first. An attacker submits input longer than the buffer can hold, overwriting adjacent memory and potentially executing arbitrary code. Which vulnerability class does this describe?

⬜ Buffer overflow
⬜ Cross-site scripting
⬜ Directory traversal
⬜ Insecure deserialization

An organization ensures that a database administrator’s account only has the specific permissions needed to manage databases, and nothing more, with no access to unrelated systems like HR records or network device configuration. Which security principle is being applied?

⬜ Separation of duties
⬜ Least privilege
⬜ Job rotation
⬜ Mandatory vacation

A cybersecurity analyst for a medium-sized company needs to perform a vulnerability scan that provides an in-depth analysis of potential weaknesses in the company’s system, including misconfigured applications and security settings. The analyst is considering using a credentialed or non-credentialed scan.

Which type of scan is most appropriate for this situation?

⬜ A credentialed scan, because it provides login rights for a more thorough analysis of potential vulnerabilities.
⬜ A non-credentialed scan, because it provides login rights for a more thorough analysis of potential vulnerabilities.
⬜ Both a credentialed and non-credentialed scan would be equally effective in this scenario.
⬜ Neither a credentialed nor a non-credentialed scan would be effective in this scenario.

Considering common threat vectors and attack surfaces, which statement best describes the primary risk, from a cybersecurity perspective, of using unsupported systems and applications?

⬜ Unsupported systems no longer receive vendor updates or patches, making their attack surfaces more susceptible to known exploits.
⬜ Unsupported systems are inherently more complex, thus presenting a larger attack surface.
⬜ Unsupported systems often operate on obsolete hardware, increasing their vulnerability to physical threat vectors.
⬜ Unsupported systems usually have outdated security measures, broadening the threat vectors.

An organization has just completed an assessment of all the points where a threat actor might exploit a vulnerability in the network. This analysis includes its computer systems, network ports, applications, and user interactions. What is the term for this collection of potential points of exploitation?

⬜ Attack surface
⬜ Attack vector
⬜ Threat landscape
⬜ Threat vector

A group of hackers, exploiting vulnerabilities in a certain organization’s online platforms and using spear-phishing techniques, launches a series of attacks disrupting the organization’s services. These attack vectors target both software flaws and human elements of the organization. Driven by disdain for the organization’s practices, their primary objective is to raise awareness and bring about changes in the organization’s conduct. Based on this information, what is the primary motivation of these threat actors?

⬜ Financial gain
⬜ Espionage
⬜ Political change
⬜ Vandalism

A network administrator conducts an analysis on the company’s network in attempts to determine attack surface, with the intent of reducing exploitable vectors. When analyzing the potential attack surface, which layer model allows unauthorized hosts to obtain a valid network address, possibly by spoofing, and communicate with hosts in other zones?

⬜ Layer 4
⬜ Layer 1
⬜ Layer 3
⬜ Layer 7

A security engineer discovered that an active employee copied sensitive information from the company’s shared drive and sold it online. What kind of actor describes this employee?

⬜ Advanced persistent threat
⬜ Nation-state
⬜ Insider threat
⬜ Hacktivist

A company identifies that an external threat actor has penetrated system protections and likely exfiltrated company information. Upon investigation, you identify that the threat actor found a way to capture a password hash while it was being transmitted during a user’s authentication. Which type of password attack does this scenario describe?

⬜ Dictionary attack
⬜ Brute force attack
⬜ On-path attack
⬜ XSS attack

A business development team reports that files are missing from the database system and the server log-in screens are showing a lock symbol that requires users to contact an email address to access the system and data. Which of the following attacks is the company facing?

⬜ Rootkit
⬜ Ransomware
⬜ Spyware
⬜ Bloatware

An organization’s systems and networks include many exploitable components and entry points. The organization faces a cybersecurity threat from a group located outside the organization that has extensive funding and highly skilled members capable of creating advanced exploit techniques, but no internal access to the organization’s systems. Based on these attributes, which of the following best describes this threat actor?

⬜ An internal threat actor with high capability and low resources
⬜ An external threat actor with low capability and high resources
⬜ An external threat actor with high capability and high resources
⬜ An internal threat actor with low capability and low resources

A systems engineer hardens an internet-facing server specifically to reduce its exposure to unsolicited port scans and service probes arriving from the public internet. Which type of threat is the engineer primarily concerned about?

⬜ An internal threat
⬜ A zero-day threat
⬜ An isolated threat
⬜ An external threat

Domain 3: Security Architecture (18%)

---

A company places its public-facing web server in a separate network segment that is isolated from both the internet and the internal corporate network, with firewall rules strictly controlling traffic in and out of that segment. Which architecture concept is being applied?

⬜ Demilitarized zone (DMZ)
⬜ Virtual private network (VPN)
⬜ Network address translation (NAT)
⬜ Air gap

An organization implements an architecture in which every application, workload, and user is placed into small, tightly controlled network zones, and traffic between any two zones, even ones on the same physical network segment, must be explicitly authenticated and authorized rather than trusted based on which subnet it originates from. Which term best describes this approach?

⬜ Flat network design
⬜ Microsegmentation
⬜ Network address translation
⬜ Full-mesh VPN

---

A company migrates its application to a public cloud provider’s Infrastructure as a Service (IaaS) offering. Under the shared responsibility model, which of the following is the CUSTOMER responsible for securing?

⬜ The physical security of the cloud provider’s datacenters
⬜ The guest operating system, applications, and data running on the virtual machines
⬜ The physical network cabling between the provider’s datacenters
⬜ The virtualization hypervisor itself

A DevOps team defines its servers, networks, and security groups in version-controlled configuration files, which are used to automatically and consistently provision identical environments every time, rather than manually configuring each server by hand. Which concept does this describe?

⬜ Infrastructure as Code (IaC)
⬜ Shadow IT
⬜ Virtual desktop infrastructure (VDI)
⬜ Bare-metal provisioning

A company’s disaster recovery plan states that after a major outage, the order-processing system must be restored within 4 hours, and the maximum acceptable data loss is 15 minutes’ worth of transactions. Which two metrics are being defined here, respectively?

⬜ Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
⬜ Recovery Point Objective (RPO) and Recovery Time Objective (RTO)
⬜ Mean Time Between Failures (MTBF) and Mean Time To Repair (MTTR)
⬜ Service Level Agreement (SLA) and Service Level Objective (SLO)

A water treatment facility uses specialized equipment to monitor and control physical processes such as valves and pumps. These systems were originally designed for isolated, air-gapped environments and often cannot be patched without risking process downtime or safety issues, unlike typical enterprise IT systems. Which category of systems does this describe?

⬜ Internet of Things (IoT) devices
⬜ Operational Technology (OT) / Industrial Control Systems (ICS)
⬜ Software as a Service (SaaS) applications
⬜ Bring Your Own Device (BYOD) endpoints

A retail company wants its customer service representatives to view masked credit card numbers, such as “XXXX XXXX XXXX 1234”, in the support system, without those representatives ever having access to the actual, usable card numbers, which are stored separately in a highly secured vault and referenced only by a substitute value. Which data protection technique is being used?

⬜ Hashing
⬜ Tokenization
⬜ Steganography
⬜ Data compression

An organization wants to scan its container images for known vulnerabilities and misconfigurations before they are deployed to production, and also wants to ensure the container runtime environment is isolated from the underlying host operating system as much as possible. Which security architecture concept is most relevant to this requirement?

⬜ Container security
⬜ Virtual desktop infrastructure
⬜ Full-disk encryption
⬜ Software-defined networking

An organization documents the specific steps its critical business functions, not just its IT systems, will take to continue operating, potentially through manual workarounds or an alternate site, during and immediately after a disruptive event, until normal operations can be restored. Which type of plan does this describe?

⬜ Business continuity plan (BCP)
⬜ Incident response plan
⬜ Acceptable use policy
⬜ Data retention schedule

A software engineer is formulating an architectural plan. When evaluating the use of a particular architecture and selection of controls, what is NOT an architectural consideration?

⬜ Availability
⬜ Risk transference
⬜ Costs
⬜ Port security

Which of the following mitigation techniques refers to the process of protecting all information on a hard drive, including the programs responsible for booting an operating system?

⬜ Network segmentation
⬜ Patch management
⬜ Full-disk encryption
⬜ Device isolation

Which of the following describes the placement and role of a firewall in a network with a defense-in-depth strategy?

⬜ A firewall is typically on internal routers and serves as a corrective control to mitigate denial of service (DoS) attacks.
⬜ A firewall is typically inline behind the border firewall and serves as a preventive control to enforce access rules.
⬜ A firewall is typically at the network border and serves as a preventive control to enforce access rules for ingress and egress traffic.
⬜ A firewall is typically at the network border and serves as a detective control to identify malicious traffic.

An organization wants to ensure the security of its sensitive data stored on the company’s physical drives, with varying levels of access for different users. Which of the following encryption methods would best suit this requirement?

⬜ Volume encryption only
⬜ A combination of volume and file encryption
⬜ Full disk encryption (FDE) only
⬜ Partition encryption only

Domain 4: Security Operations (28%)

---

During enrollment for a new online banking application, a user is required to enter a password (something they know) and also insert a hardware security key into their laptop’s USB port (something they have) before being granted access. Which security concept is being applied?

⬜ Single-factor authentication
⬜ Multifactor authentication (MFA)
⬜ Federation
⬜ Role-based access control

---

After a critical vulnerability is publicly disclosed in a widely used web server software, an organization’s security team prioritizes testing and deploying the vendor’s released fix across all affected servers within days, following a documented process for evaluating, testing, and applying updates. Which security practice does this describe?

⬜ Patch management
⬜ Change management
⬜ Configuration management
⬜ Incident response

A network administrator disables Telnet access to all network switches and routers and requires administrators to use SSH instead for remote command-line management. What is the primary security benefit of this change?

⬜ SSH encrypts the session, including authentication credentials, while Telnet transmits everything in cleartext
⬜ SSH uses a faster transport protocol than Telnet
⬜ SSH does not require any authentication, simplifying access
⬜ Telnet only works over Wi-Fi networks, which is less secure

A systems administrator builds a new server image that has all unnecessary services, default accounts, and unused ports disabled or removed before the server is ever deployed into production. Which security practice does this represent?

⬜ Hardening
⬜ Patch management
⬜ Segmentation
⬜ Load balancing

A security team runs automated tools on a regular schedule to identify missing patches, outdated software versions, and insecure configurations across all servers on the network, generating a prioritized list of weaknesses to remediate. Which activity is being performed?

⬜ Penetration testing
⬜ Vulnerability scanning
⬜ Threat hunting
⬜ Digital forensics

A security operations center (SOC) uses a platform that aggregates log data from firewalls, servers, and endpoint agents across the enterprise, correlates events from multiple sources in near real time, and generates alerts when suspicious patterns are detected. Which type of tool is this?

⬜ Security Information and Event Management (SIEM)
⬜ Intrusion Prevention System (IPS) only
⬜ Vulnerability scanner
⬜ Configuration management database (CMDB)

After a SIEM generates an alert for a suspicious login, a connected platform automatically executes a predefined playbook: it disables the affected user account, isolates the affected endpoint from the network, and opens a ticket for analyst review, all without a human manually performing each step. Which type of technology enables this automated response?

⬜ Security Orchestration, Automation, and Response (SOAR)
⬜ Data Loss Prevention (DLP)
⬜ Network Access Control (NAC)
⬜ Public Key Infrastructure (PKI)

An organization requires that any use of a highly privileged domain administrator account go through a dedicated system that issues short-lived, just-in-time credentials, records a full session recording of everything the administrator does, and requires a second approver before access is granted. Which category of solution is being described?

⬜ Privileged Access Management (PAM)
⬜ Single sign-on (SSO)
⬜ Federation
⬜ Data loss prevention (DLP)

Before any security incident occurs, an organization develops and documents an incident response plan, trains its incident response team, deploys detection tools, and establishes communication procedures and contact lists to be ready to respond effectively. According to the NIST incident response lifecycle, which phase does this activity belong to?

⬜ Preparation
⬜ Detection and analysis
⬜ Containment, eradication, and recovery
⬜ Post-incident activity

During an active ransomware outbreak, the incident response team immediately disconnects the infected servers from the network and disables the compromised user accounts to stop the malware from spreading further, before beginning the process of removing the malware entirely. Which phase of incident response does this represent?

⬜ Preparation
⬜ Detection and analysis
⬜ Containment
⬜ Post-incident activity

During a forensic investigation into a data breach, an analyst carefully documents every person who handled a piece of digital evidence, such as a hard drive, when it was collected, and how it was stored and transferred, to ensure the evidence remains admissible and its integrity can be verified later. Which forensic concept does this describe?

⬜ Chain of custody
⬜ Data carving
⬜ Order of volatility
⬜ Legal hold

An organization maintains a continuously updated inventory of every server, laptop, and network device it owns, including its owner, location, software installed, and criticality to the business, so that security teams know exactly what needs to be protected and patched. Which foundational security operations practice does this represent?

⬜ Asset management
⬜ Change management
⬜ Threat modeling
⬜ Business impact analysis

Before decommissioned hard drives are removed from a secure facility for disposal, an organization uses a specialized process to overwrite or physically destroy the drives so that no residual data can be recovered by whoever receives the old hardware. Which practice does this describe?

⬜ Media sanitization
⬜ Data classification
⬜ Legal hold
⬜ Tokenization

After noticing unusual outbound traffic patterns, a security analyst proactively searches through endpoint and network logs for subtle indicators of compromise that automated detection tools may have missed, forming and testing hypotheses about how an attacker might have gained a foothold. Which activity does this describe?

⬜ Threat hunting
⬜ Vulnerability scanning
⬜ Business continuity planning
⬜ Change management

The company’s system has recently detected suspicious network activity, signaling a possible cybersecurity incident. The incident response team has assembled, and after going through the detection and analysis phases, the containment phase of the incident response process has started. In this phase, what is the primary objective?

⬜ Continuing the discovery of indicators of the threat actor activity
⬜ Removing the source of the threat and restoring the affected systems to a secure state
⬜ Limiting the scope and magnitude of the incident
⬜ Analyzing the incident and responses to identify whether procedures or systems could be improved

An organization’s automated scanner has just flagged a vulnerability with the identifier CVE-2023-0150. What are some initial steps the organization should take to understand and potentially address this vulnerability?

⬜ Look up the identifier in the vulnerability database and assess the vulnerability.
⬜ Modify the scanner settings to avoid detecting similar vulnerabilities in the future.
⬜ Consult the scanner’s manufacturer for advice on the vulnerability.
⬜ Ignore the identifier since it might not be significant.

At a healthcare technology company, a cybersecurity alert flagged an unusual pattern of data traffic from one of its key database servers. Initial analysis indicates a potential data breach that is not yet conclusively confirmed. The server contains sensitive patient data. If confirmed, it could have severe legal and reputational implications for the company. What steps should the incident response team take to better understand the situation?

⬜ Focus on other network abnormalities and wait for additional alerts before conducting a detailed analysis
⬜ Immediately shut down the server to prevent further data leaks
⬜ Announce the potential data breach to all stakeholders and the public to maintain transparency
⬜ Conduct a detailed analysis of the alert using threat intelligence and incident response playbooks

A member of the security operations team discovers a lost work phone while performing a scheduled control review. Based on verified need, evidence, and approved procedure, what is the most appropriate next action?

⬜ Continue business activities on a personal device until the phone is recovered
⬜ Attempt to locate the phone before notifying the support team
⬜ Use an alternative communication method and wait to see whether the device reconnects
⬜ Report the loss immediately and initiate approved device-protection and containment measures

A member of the security operations team notices customer account details still displayed on an unlocked screen while performing a scheduled control review. Based on verified need, evidence, and approved procedure, what is the most appropriate next action?

⬜ Continue working, since the information is only visible inside the branch
⬜ Wait until the current transaction completes before considering any action
⬜ Minimize the screen exposure immediately and ensure the information is only visible to authorized personnel
⬜ Ask a nearby colleague whether the exposure presents a concern

Domain 5: Security Program Management and Oversight (20%)

---

A security team implements automated tools and processes to continuously collect security-related metrics, assess the security posture of systems against a defined baseline, and report deviations to stakeholders on an ongoing basis, rather than relying only on periodic annual assessments. Which security operations practice does this describe?

⬜ Continuous monitoring
⬜ Annual penetration testing
⬜ Static code analysis
⬜ Disaster recovery testing

A risk management team documents each identified risk to the organization, along with its likelihood, potential impact, assigned owner, and current treatment status, in a centralized tracking document that is reviewed and updated regularly. Which risk management tool is being described?

⬜ Risk register
⬜ Business impact analysis
⬜ Data classification policy
⬜ Acceptable use policy

A risk analysis determines that a particular server has a single loss expectancy (SLE) of $50,000 for a specific threat, and that threat is expected to occur twice per year on average (an annualized rate of occurrence, or ARO, of 2). What is the Annualized Loss Expectancy (ALE) for this risk?

⬜ $25,000
⬜ $50,000
⬜ $100,000
⬜ $200,000

Before signing a contract with a new cloud service provider that will process sensitive customer data, an organization requires the vendor to complete a detailed security questionnaire, provide a recent independent audit report, and agree to specific contractual security obligations. Which practice does this represent?

⬜ Third-party (vendor) risk management
⬜ Change management
⬜ Job rotation
⬜ Continuous monitoring

A healthcare organization ensures that any system storing or transmitting patient health information implements specific administrative, physical, and technical safeguards required by federal law, and undergoes regular audits to demonstrate adherence to these mandatory requirements. Which term describes the organization’s obligation to meet these externally imposed legal requirements?

⬜ Compliance
⬜ Risk appetite
⬜ Due care
⬜ Vulnerability management

An organization requires every employee to complete annual training that teaches them how to recognize phishing emails, use strong passwords, and report suspicious activity, reinforced with periodic simulated phishing tests throughout the year. Which security program element does this represent?

⬜ Security awareness training
⬜ Penetration testing
⬜ Incident response
⬜ Business continuity planning

A company’s information security governance documents include a high-level, mandatory statement approved by executive leadership about protecting customer data, and a detailed, mandatory technical document specifying that all passwords must be at least 12 characters, and a voluntary, recommended document suggesting best practices for securing a home office. Which three types of governance documents does this describe, respectively?

⬜ Policy, standard, and guideline
⬜ Standard, guideline, and policy
⬜ Procedure, policy, and standard
⬜ Guideline, policy, and standard

An organization hires an independent third party to formally evaluate whether its security controls are designed and operating effectively against a recognized framework, producing a formal report with findings and an opinion that can be shared with customers and regulators. Which activity does this describe?

⬜ Security audit
⬜ Threat modeling
⬜ Vulnerability scanning
⬜ Tabletop exercise

An organization designates a specific senior business leader as being formally accountable for the accuracy, classification, and appropriate use of a particular dataset, such as customer records, even though a separate technical team handles day-to-day storage and backups of that data. Which role does this leader hold?

⬜ Data owner
⬜ Data custodian
⬜ Data processor
⬜ System administrator

A company that collects personal information from its customers publishes a document explaining what personal data it collects, why it is collected, how it is used and shared, and how individuals can exercise rights such as requesting deletion of their data. Which concept is this document primarily addressing?

⬜ Privacy notice / privacy considerations
⬜ Disaster recovery plan
⬜ Vulnerability disclosure policy
⬜ Network diagram

A software development company recognizes that some of its employees are vulnerable to phishing attacks. To address this, the company plans to set up a training program. What factors should the company primarily consider while defining such training programs?

⬜ The roles performed by the employees
⬜ The length of service of the employees
⬜ The job titles of the employees
⬜ The personal interests of the employees