Which of the following is NOT a type of learning activity used in Security Awareness? 28/326

The widely accepted framework for security learning programs consists of three distinct activities: Awareness, Training, and Education (ATE). Awareness focuses on making individuals conscious of security concerns ("what" and "why"). Training is skill-based, teaching individuals "how" to perform specific tasks securely. Education provides in-depth, foundational knowledge and understanding. A "tutorial" is a specific method or format of instruction (e.g., a video tutorial) that can be used within a training or education activity, but it is not considered a primary, distinct type of learning activity within the established ATE model.

A. Education: This is a core component of the ATE model, providing in-depth knowledge and understanding of security principles.

B. Awareness: This is the foundational level of the ATE model, intended to change behavior by raising consciousness about security risks.

D. Training: This is a fundamental component of the ATE model, focused on building specific skills and competencies required for a job role.

1. National Institute of Standards and Technology (NIST) Special Publication 800-50

Building an Information Technology Security Awareness and Training Program. Section 2.2

"The Building Blocks: Awareness

Training

and Education

" explicitly defines these three components as the distinct pillars of a security learning program. It states

"IT security awareness

training

and education are not the same... Awareness is not training; training is not education; and education is not awareness." The document does not list "tutorial" as a primary category.

2. (ISC)² Certified in Cybersecurity (CC) Certification Exam Outline (Effective August 1

2022). Domain 1: Security Principles

Objective 1.4 is "Understand security awareness

training

and education." This shows that the certifying body itself defines the program around these three specific components.

3. Wilson

M.

& Hash

J. (2003). Building an Information Technology Security Awareness and Training Program (NIST Special Publication 800-50). National Institute of Standards and Technology. Page 4

Section 2.2. Available at: https://csrc.nist.gov/publications/detail/sp/800-50/final