I have needed to do various kinds of training on aspects like the GDPR legislation, Health and Safety and Prevent for my work at the Open University and other universities. Although these aspects are important and it is vital that I know some of the content (the OU could face a very heavy fine if its staff, including myself, make serious mistakes in terms of the protection of data), I am struck by how trivial some of the assessment is. For example, I did a GDPR module at another university today (I am working on a presessional course) and one of the questions was about the organisation responsible's name and I needed to get this correct to pass the test where in the real world, I would need to know more than the name but how to contact them if there was really a problem.
These kinds of multiple choice questions are often very inappropriate for such areas of knowledge where the real issues are exercising good judgement in complex issues. Universities need to decide whether they really want to train and assess their employees' skills or whether their aim is just to put the responsibility on the employees if anything goes wrong.