5.6 - Security awareness and insider threats
Security+ SY0-701 objective 5.6 covers building security awareness among people. A phishing simulation campaign sends fake phishing emails to staff to measure and improve their awareness, turning results into targeted training. When new hires keep falling for phishing, the most effective program-level fix is recurring awareness training, not a one-off session. An insider threat is an employee who abuses their legitimate access to harm the organisation, whether malicious or negligent. Recognising anomalous user behaviour - a colleague suddenly accessing systems unrelated to their role - is an early warning sign to investigate. Awareness programs also cover reporting suspicious activity, secure operational habits, and building a security culture. Expect scenario questions that describe a training method, a risky insider, or an unusual behaviour and ask which awareness concept or response is correct.
Fake phishing emails to test staff = phishing simulation. Best fix for repeat phishing victims = recurring awareness training. Employee abusing legitimate access = insider threat. Accessing unrelated systems = anomalous behaviour (investigate).
Practice questions
1. Sending fake phishing emails to staff to measure and improve awareness is a:
- Denial-of-service test
- Phishing simulation campaign (correct answer)
- Penetration test of firewalls
- Password crack
Phishing simulations train and measure user awareness; results guide targeted training. Awareness is a key layer since users are common targets.
2. An employee who abuses their legitimate access to harm the organization is a(n):
- An external hacktivist
- Insider threat (correct answer)
- A script kiddie
- A supply-chain vendor
An insider threat uses authorized access maliciously or negligently. Mitigate with least privilege, monitoring, separation of duties and awareness training.
3. Recognizing that a colleague suddenly accesses systems unrelated to their role is spotting:
- A routine access request
- Anomalous user behavior (correct answer)
- A normal role change
- A scheduled maintenance task
Anomalous behavior (unusual access, off-hours activity, data hoarding) can signal a compromised account or insider threat. Awareness programs teach staff to report it.
4. New hires keep falling for phishing. The MOST effective program-level fix is to:
- Buy faster office computers
- Run recurring awareness training (correct answer)
- Increase the internet bandwidth
- Disable all incoming email
Recurring security awareness training with phishing simulations builds a security culture and measurably lowers click rates over time — people are a primary attack surface.
5. A departing employee's manager submits a ticket the moment they resign. The MOST important security action is to:
- Archive their chat history
- Disable their accounts and access (correct answer)
- Reassign their office desk
- Update the org chart diagram
Offboarding must promptly disable/deprovision accounts, revoke access and tokens, and recover assets to prevent misuse, then preserve any data required by policy.
6. A staff member notices a colleague copying large amounts of data to a personal USB drive late at night. They should:
- Confront the colleague alone
- Report it through proper channels (correct answer)
- Copy the data themselves too
- Ignore it as none of their business
Anomalous behavior like off-hours mass data copying to removable media is a potential insider threat; report it via the proper channel so it can be investigated safely.