RANGER GAMEZ

CompTIA Security+ (SY0-701) · chapter 25 of 27

Month 8: The human firewall and the ransomware drill

In this chapter Objectives 5.6, 4.8

  1. Building the awareness program
  2. Chapter recap

Objective 5.6

Building the awareness program

Phishing

Three parts: campaigns send realistic simulated phishing emails to staff on a schedule and measure who clicks and who reports. Recognizing a phishing attempt: urgency, unexpected attachments, sender address mismatches, links whose real address differs from the text, requests for credentials or payments. Responding to reported suspicious messages: a one-click Report button, fast triage by the security team, removal of the message from all inboxes and thanks to the reporter.

Exam tip Exam tip: the goal metric is the report rate going up, not just the click rate going down.

Anomalous behavior recognition

Teach people to notice and report behavior that is out of place. Risky: actions that invite trouble (sharing passwords, disabling antivirus, plugging in a found USB). Unexpected: things that do not fit (a coworker logging in at 3 a.m., a "vendor" asking for the server room). Unintentional: honest mistakes (emailing the wrong person, a misconfigured share). Treat mistakes as chances to coach, so people keep reporting.

User guidance and training topics

CompTIA lists what to cover:

  • Policy/handbooks: the rules, written so staff can find them.
  • Situational awareness: noticing what is around you (tailgaters, shoulder surfers).
  • Insider threat: signs a trusted person may misuse access, and how to report it.
  • Password management: unique passphrases, password managers, MFA.
  • Removable media and cables: never plug in unknown USB drives or charging cables.
  • Social engineering: pretexting, vishing, smishing, impersonation.
  • Operational security: not leaking useful details (schedules, badge photos on social media).
  • Hybrid/remote work environments: secure home Wi-Fi, VPN, privacy in public places.

Reporting, monitoring, development, execution

Reporting and monitoring happen at two points: initial (a baseline measurement when the program starts) and recurring (regular measurements to show the trend). Development is creating the program: goals, audience, topics, materials and schedule. Execution is running it: delivering training, sending campaigns, tracking completion and adjusting based on results.

Check yourself 1An employee finds a USB drive labeled "Salaries 2026" in the parking lot. Which training topic covers what she should do?

  1. Operational security
  2. Removable media and cables
  3. Hybrid/remote work environments
  4. Password management
Show the answer

Answer: B. Removable media and cables

Found USB drives can carry malware; the removable media training says never plug them in and hand them to security.

Practice it in Ranger's Cyber PatrolThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.