-
1What is phishing?
- AA technique for testing network speed
- BA cyberattack that uses deceptive emails or websites to trick users into revealing sensitive informationCorrect
- CA method for encrypting data during transmission
- DA type of malware that monitors keyboard input
Why: Phishing is a social-engineering attack in which someone impersonates a trusted person or organization through email, messages, calls, or websites to obtain information or prompt a harmful action. Warning signs can include unusual urgency, a mismatched sender or domain, and unexpected requests for credentials or payment, but polished messages can lack obvious errors.
-
2Why is reusing the same password across multiple accounts dangerous?
- AIt makes passwords easier to guess through brute force
- BIf one account is breached, attackers can use that password to access all your other accountsCorrect
- CIt violates most websites' terms of service
- DIt makes it harder for password managers to function correctly
Why: Password reuse enables credential-stuffing attacks. After credentials are exposed, attackers can automatically try the same username and password on other services. A unique password for each account limits that reuse pathway; a password manager can generate and store those passwords. Unique passwords reduce this risk but do not prevent phishing, malware, or every form of account compromise.
-
3What does two-factor authentication (2FA) add to the login process?
- AA second password that must be entered after the first
- BA second verification step requiring something you have or are, in addition to your passwordCorrect
- CA requirement to log in from two different devices
- DAn automatic security scan of your device before granting access
Why: Two-factor authentication combines evidence from two different factor types: something you know, have, or are. It makes a stolen password alone insufficient for that login flow, but it is not an absolute guarantee: attackers may phish some one-time codes or exploit account-recovery and session weaknesses. NIST identifies cryptographic authenticators such as properly configured WebAuthn security keys as phishing-resistant; manually entered codes are not.
Source National Institute of Standards and Technology (NIST)
-
4What is the purpose of HTTPS in web browsing?
- ATo make websites load faster
- BTo encrypt data transmitted between your browser and the websiteCorrect
- CTo verify that a website is legitimate and not a scam
- DTo block malicious scripts from running on web pages
Why: HTTPS (HyperText Transfer Protocol Secure) encrypts the data transmitted between your browser and a website using TLS (Transport Layer Security). This prevents attackers on the same network from intercepting and reading your data — a technique called a 'man-in-the-middle attack.' While HTTPS confirms that your connection is encrypted, it does not guarantee the website itself is trustworthy or legitimate.
-
5Which description best fits a 'zero-day vulnerability'?
- AA security flaw that has been known for zero days and is therefore not dangerous
- BA newly discovered vulnerability for which a broadly available fix is not yet in placeCorrect
- CA vulnerability that can only be exploited within the first day of a software release
- DA security flaw that requires zero technical skill to exploit
Why: 'Zero-day' is commonly used for a newly discovered vulnerability that defenders or the vendor have had little or no time to fix, especially when it is being exploited before a patch is broadly available. Usage varies, so it does not always mean the vendor is completely unaware. A missing patch also does not mean there are no defenses: configuration changes, access controls, detection, or temporary mitigations may reduce exposure.
-
6What is ransomware?
- ASoftware that displays unwanted advertisements
- BMalware that blocks access to systems or data and demands payment, often after encryption or data theftCorrect
- CA tool that tests the strength of your passwords
- DA type of firewall that blocks ransom demands
Why: Ransomware is malware used to deny access to systems or data and demand payment. Some incidents encrypt files; others also steal data and threaten disclosure. Paying does not guarantee recovery. CISA recommends measures including maintained and tested offline backups, prompt patching, phishing resistance, and an incident-response plan, but no single control prevents every incident.
Source Cybersecurity and Infrastructure Security Agency (CISA)
-
7Why is it important to install software and operating system updates promptly?
- AUpdates always make devices run faster
- BUpdates frequently patch security vulnerabilities that attackers actively exploitCorrect
- CUpdates are legally required in most countries
- DUpdates free up storage space on your device
Why: Software updates often contain fixes for known security vulnerabilities. Installing supported updates promptly reduces the time a device remains exposed to flaws addressed by the vendor; automatic updates can help where they are appropriate and available. Updates do not always improve speed, and patching is one layer of security rather than a guarantee against compromise.
-
8Which statement about sensitive browsing on public Wi-Fi is most accurate?
- AEvery banking session is readable by others, even when HTTPS is working correctly
- BUnencrypted traffic may be intercepted, while HTTPS protects the connection but does not prove a site is honestCorrect
- CA public network prevents phishing because every site is verified by the Wi-Fi provider
- DUsing any VPN guarantees that the website and device are safe
Why: Traffic sent without transport encryption can be read or altered by someone in a position to observe the network. HTTPS protects the connection between the browser and the site, including on public Wi-Fi, but you still need to verify the correct domain and heed certificate warnings because an encrypted phishing site can still be malicious. A VPN changes which provider carries your traffic; it is not a substitute for HTTPS, updated software, or careful account security.
-
9What is the main benefit of using a password manager?
- AIt lets you safely use the same password everywhere
- BIt generates and stores a unique, strong password for every account so you do not have to remember themCorrect
- CIt makes two-factor authentication unnecessary
- DIt automatically blocks all phishing attacks
Why: A password manager can generate and store long, unique passwords so one exposed credential is not automatically reusable elsewhere. How a vault is unlocked and synchronized varies by product, so users should follow the provider's recovery and security guidance. A password manager complements multifactor authentication; it does not make MFA unnecessary or block every phishing attempt.
-
10Which of these generally makes a password hardest to crack?
- AReplacing letters with similar-looking numbers, like 'P@ssw0rd'
- BGreater length and unpredictability, such as a long random passphraseCorrect
- CAdding a single exclamation mark to a common word
- DUsing your birthdate so it is easy to remember
Why: For a password chosen by a person, greater length and unpredictability generally resist guessing better than common substitutions or personal facts. NIST guidance emphasizes minimum length, blocklists of commonly used or compromised values, and allowing password managers and long passwords rather than forcing predictable composition rules. A password manager can generate a random value when a memorable passphrase is not needed.
Source National Institute of Standards and Technology (NIST)
