What is a phishing simulation exercise, and how does it support security awareness?

• A. A plan to update software licenses.
• B. A tool for measuring network throughput.
• C. A method for evaluating vendor performance.
• D. A controlled test of employees' susceptibility to phishing; raises awareness and strengthens training.

Answer: (C)

A phishing simulation exercise is a controlled test of employees' ability to recognize phishing attempts. It raises awareness and strengthens training by presenting realistic phishing scenarios, providing immediate feedback, and guiding targeted education based on how individuals respond. By tracking who clicks, reports, or ignores the messages, it helps identify gaps in knowledge, measure progress over time, and reinforce secure habits across the organization.

It isn’t about updating software licenses, measuring network throughput, or evaluating vendor performance, so those options don’t fit the purpose of a phishing simulation.