Employees have been posting photos on social media that show their ID badges, the office layout, and screens in the background. Which awareness topic most directly addresses this behavior?

Operational security is the practice of protecting seemingly harmless details that, when combined, help an adversary plan an attack. Photos showing ID badges let attackers copy badge designs for physical intrusion, images of the office layout reveal entrances and security positions, and screens in the background can expose application names, internal URLs, or data. Awareness training on operational security teaches employees to check what is visible before posting, to keep badges out of sight in public, and to understand how attackers use social media for reconnaissance and pretexting. Password management training is valuable for protecting accounts, but the exposure here is information disclosed in images, not weak or reused credentials. Business email compromise training addresses fraudulent payment and data requests sent by email; the posts could later help an attacker craft such a lure, but the behavior to change is what employees publish. Removable media training addresses malware and data loss through USB devices and cables; it has no connection to social media posts. Exam caveat: situational awareness, also listed in the objective, focuses on noticing threats in one's surroundings, such as tailgaters, whereas operational security focuses on not leaking useful information. Operational check: review public posts tagged with the company's name or location, and include sanitized examples from them in the next training session.