ITPEC IP April 2025 Question 35
Topic: SecurityAlso asked in Spring 2021
Among descriptions A through D concerning how to conduct information security education to employees, which of the following contains all and only the appropriate descriptions?
AThe re-education of one who has committed an information security breach includes preventive actions to avoid the same fault being repeated.BOne way to conduct it is to incorporate it in a training program for new employees.CIt is restricted to employees in the information systems department.DIt is conducted after an incident or an accident concerning information security as well as on a regular basis.
Explanation
A, B and D — security education reaches every employee, starts at joining, and is repeated regularly and after incidents.
- •A: appropriate. Re-educating someone who caused a breach should teach how not to repeat it, not only reprimand.
- •B: appropriate. Training for new employees is a natural place to teach the security rules from the first day.
- •C: not appropriate. Every employee handles information and can cause a leak (a lost PC, a phishing mail, a misdirected e-mail), so education cannot be limited to the information systems department.
- •D: appropriate. Regular sessions keep awareness up, and sessions after an incident share its lessons.
Answer (a)
Why not others:
- •(b) A, C, D — includes C and leaves out B
- •(c) A, D — leaves out B, a valid occasion
- •(d) B, C — includes C and leaves out A and D
Key rule: People are the weakest link in information security, so education is for all staff, from joining onwards, repeated regularly and updated after each incident.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.