Cybersecurity Basics Everyone Needs

• A. password123
• B. Summer2023!
• C. v7#Kq9mPz2$wLx ✓
• D. johnsmith1985

Why: A strong password is long, random, and mixes letters, numbers, and symbols. Option C is random and long, so it is much harder to guess or crack than common words, dates, or names combined with simple numbers.

• A. It makes your password unnecessary
• B. It requires a second form of verification, so a stolen password alone is not enough to log in ✓
• C. It automatically changes your password every week
• D. It encrypts all the files stored in your account

Why: Two-factor authentication adds a second verification step, such as a code from your phone. Even if an attacker learns your password, they still cannot access the account without that second factor.

• A. Different passwords load websites faster
• B. If one service is breached, attackers cannot reuse the stolen password on your other accounts ✓
• C. Websites require a new password every time you log in
• D. Reusing passwords automatically locks your accounts

Why: Attackers often try leaked username and password pairs on many other sites, a technique called credential stuffing. Unique passwords limit the damage from any single breach.

• A. A tool that stores and generates strong, unique passwords for your accounts so you do not have to remember them all ✓
• B. A website that sells passwords to other users
• C. A type of malware that steals passwords
• D. A paper notebook that the government requires you to keep

Why: A password manager securely stores your credentials and can generate strong random passwords. You only need to remember one strong master password to unlock it.

• A. Click the link quickly to avoid losing access to your money
• B. Reply to the email with your password to verify your identity
• C. Ignore the link and contact your bank directly using a phone number or website you already know is genuine ✓
• D. Forward the email to all your contacts so they can be warned

Why: This is a classic phishing attempt that uses urgency to pressure you. Legitimate banks will not ask for your password by email. Contact the bank through a trusted channel you find independently.

• A. The bank is performing routine security maintenance
• B. It is a phishing attempt designed to steal your credentials ✓
• C. Your bank account has been automatically upgraded
• D. The email is a legitimate customer satisfaction survey

Why: Urgency and threats of account closure are classic phishing tactics. Banks rarely ask customers to verify credentials through email links, and the best response is to contact the bank directly using a phone number you already trust.

• A. The email is written in a formal tone
• B. The email includes your name in the greeting
• C. The sender's address domain does not match the organization it claims to represent ✓
• D. The email contains a company logo

Why: Attackers can easily copy logos and formatting, but the sender's domain is harder to fake convincingly. A mismatch such as 'support@paypal-secure-login.net' instead of 'paypal.com' is a strong warning sign.

• A. Click the link and pay the small fee since the amount is low
• B. Reply to the message asking for more details
• C. Ignore the message and delete it without clicking any links ✓
• D. Forward the message to all your contacts so they can also claim the prize

Why: Unsolicited prize notifications that require payment are scams. Clicking links or paying fees exposes you to fraud, and replying confirms your number is active. Deleting the message is the safest response.

• A. Using the same strong password for all your accounts
• B. Writing your passwords down and keeping them near your computer
• C. Enabling multi-factor authentication on your accounts ✓
• D. Changing your password only when a company forces you to

Why: Multi-factor authentication means that even if an attacker steals your password through phishing, they still need a second factor, such as a code from your phone, to access your account.

• A. Read out the code quickly to get the problem solved
• B. Share the code only if the caller knows your name
• C. Hang up and contact your IT department using a number you already know is correct ✓
• D. Read out only the first half of the code to be safe

Why: Verification codes should never be shared with anyone, including people claiming to be support staff. This is a common vishing (voice phishing) tactic. Independently contacting the organization through a trusted channel is the safe approach.

• A. The page loads quickly on your phone
• B. The address begins with https:// and shows a padlock icon ✓
• C. The site has a lot of colorful advertisements
• D. The site asks you to accept a pop-up notification

Why: HTTPS indicates that data sent between your browser and the website is encrypted, and the padlock icon shows the connection is secure. It does not guarantee the site is trustworthy, but it is an important baseline check.

• A. Click the link quickly to avoid losing access to your account
• B. Reply to the email with your login details to confirm your identity
• C. Go directly to your bank's official website or app by typing the address yourself ✓
• D. Forward the email to all your contacts so they can check it too

Why: Phishing emails often create urgency and include links to fake login pages. Navigating to the bank through a address you type yourself or its official app avoids the fake link entirely.

• A. Confirm you are downloading from the official developer's website or a trusted app store ✓
• B. Check that the download button is the largest one on the page
• C. Make sure the file size is larger than 500 MB
• D. Download it on a public Wi-Fi network to save data

Why: Malware is often disguised as free software on unofficial download sites. Getting software from the official source or a reputable app store greatly reduces the risk of installing something harmful.

• A. Call the number immediately to get the problem fixed
• B. Close the browser tab or window without clicking anything in the pop-up ✓
• C. Click 'OK' to dismiss the message and then call the number
• D. Download the cleaning tool the pop-up recommends

Why: This is a common scam called tech support fraud. Legitimate companies do not warn you about infections through browser pop-ups. Closing the tab, or force-quitting the browser if needed, is the safest option.

• A. Open it right away so you can see what it contains
• B. Scan the file with up-to-date antivirus software before opening it ✓
• C. Rename the file extension so it cannot run automatically
• D. Send it to a friend first to see if it works on their computer

Why: Antivirus software can detect many known threats before they run. Scanning a file before opening it is a simple, effective precaution, especially for files from unfamiliar sources.

• A. Leave the default administrator password unchanged so you don't forget it
• B. Change the default administrator password to a strong, unique one ✓
• C. Turn off the router's firewall to improve speed
• D. Broadcast the network name as a hidden SSID to prevent others from finding it

Why: Routers ship with default administrator passwords that are widely published online. Changing this password to a strong, unique one prevents attackers on your network or remotely from easily gaining control of your router's settings.

• A. WEP
• B. WPA
• C. WPA2 or WPA3 ✓
• D. Open network with no password

Why: WEP is outdated and easily cracked, and the original WPA has known weaknesses. WPA2 is widely supported and secure when configured properly, and WPA3 offers stronger protections where supported by your devices.

• A. It doubles your internet speed automatically
• B. It isolates less trusted devices from your primary devices and personal files ✓
• C. It removes the need for a router password
• D. It allows your ISP to monitor all traffic more easily

Why: Network segmentation limits the damage if a guest device or an insecure smart device is compromised. Keeping these devices on a separate network prevents attackers from moving laterally to your computers and personal data.

• A. To change the Wi-Fi network name automatically
• B. To remove the need for antivirus software on your computer
• C. To patch known security vulnerabilities in the router's software ✓
• D. To increase the number of devices that can connect at once

Why: Manufacturers release firmware updates to fix security flaws that attackers could exploit. Regularly installing these updates helps keep your router protected against newly discovered threats.

• A. Enabling remote administration from any internet address
• B. Using the default port for all remote connections
• C. Disabling remote management unless you specifically need it ✓
• D. Sharing the router's admin login with all household members

Why: Remote management exposes your router's login page to the internet, giving attackers another entry point. Disabling it when not needed removes this unnecessary risk.

• A. Use the same password across all your accounts so it is easy to remember
• B. Enable multi-factor authentication alongside a unique, strong password ✓
• C. Write your password on a sticky note near your computer
• D. Change your password only after a breach has been announced

Why: Multi-factor authentication adds a second verification step, so even if a password is stolen, attackers cannot easily access the account. Unique passwords also prevent one breach from compromising all of your accounts.

• A. Websites will charge higher fees for account access
• B. A breach of one site can expose your password to attackers who try it on other sites ✓
• C. Your browser will stop saving passwords automatically
• D. Search engines will rank your accounts lower in results

Why: Attackers often use credential stuffing, where leaked username and password pairs from one breach are tested on many other services. Reusing passwords lets a single compromise open multiple accounts.

• A. It is addressed to you by your full name and includes your employer's logo
• B. It creates urgency, such as threatening account closure unless you click a link immediately ✓
• C. It comes from an address you have emailed before
• D. It includes a plain-text message with no attachments

Why: Phishing messages pressure victims to act quickly before they think. Legitimate organizations rarely demand immediate action through an email link, so urgency is a major red flag.

• A. Social media platforms do not store any user data at all
• B. Details like your birthday, pet names, or schools can be used to guess passwords or answer security questions ✓
• C. Sharing photos automatically lowers the security of your device
• D. Only celebrities are targeted by identity thieves

Why: Attackers gather publicly posted details to answer security questions or build convincing scams. Limiting what is public reduces the information available for identity theft and account takeover.

• A. Connect to any open public network since it is always convenient
• B. Use a trusted network or a reputable VPN, and avoid logging into sensitive accounts on unsecured public Wi-Fi ✓
• C. Turn off all encryption on your device to speed up the connection
• D. Share your login details with the network administrator for verification

Why: Public Wi-Fi networks can be intercepted by attackers on the same network. Using a trusted connection or a reputable VPN encrypts your traffic and reduces the chance that your data is captured.

• A. Links sent to you by unknown contacts via text message
• B. The official app store for your device, such as Google Play or the Apple App Store ✓
• C. Third-party websites offering free paid apps
• D. File-sharing sites recommended in online forums

Why: Official app stores review apps for malicious behavior and provide update and reporting mechanisms. Apps from unofficial sources are far more likely to contain malware or spyware.

• A. To improve battery performance
• B. To make the phone run faster
• C. To prevent unauthorized people from accessing your data if the device is lost or stolen ✓
• D. To block advertisements from appearing on the screen

Why: A screen lock is the first line of defense against physical access. Without one, anyone who finds or steals your phone can potentially read your messages, access accounts, and extract personal data.

• A. It has a clear privacy policy
• B. It requests permissions unrelated to its function, such as a flashlight app asking for access to your contacts ✓
• C. It was published by a well-known company
• D. It has regular security updates

Why: Excessive or unrelated permission requests are a red flag. A flashlight app has no legitimate need for your contacts, so such a request may indicate data harvesting or spyware.

• A. Click the link quickly to avoid losing access to your account
• B. Reply to the message with your account number to confirm your identity
• C. Do not click the link; contact your bank directly using a phone number from its official website or your card ✓
• D. Forward the message to all your contacts so they are aware

Why: This is a typical smishing (SMS phishing) attack. Legitimate institutions rarely request sensitive information via unsolicited links, so verifying through an independently sourced contact method protects you.

• A. Updates always add new games and features
• B. Updates often include security patches that fix vulnerabilities attackers could exploit ✓
• C. Updates remove the need for passwords
• D. Updates automatically delete old files to free up space

Why: Software updates frequently patch security flaws that have been discovered. Delaying updates leaves known vulnerabilities open for attackers to exploit.

• A. Immediately delete any suspicious files you find
• B. Disconnect the device from the network to limit further damage ✓
• C. Restart the computer to see if the problem goes away
• D. Post about the incident on social media to warn others

Why: Disconnecting the affected device from the network (containment) helps stop malware from spreading and prevents attackers from continuing to access your systems or data. Deleting files or restarting can destroy evidence needed to understand what happened.

• A. It makes the computer run faster after the incident
• B. It helps determine how the attack happened and what was affected ✓
• C. It is required to reinstall the operating system
• D. It prevents employees from reporting the incident later

Why: Logs, files, and system state provide the information needed to investigate the root cause, scope of the damage, and what data may have been stolen. Clearing these artifacts too early can make it impossible to fully understand or fix the problem.

• A. The screen has a slightly different color than usual
• B. The computer runs noticeably slower or shows unexpected pop-ups and programs ✓
• C. The keyboard makes a clicking sound when typing
• D. The date and time on the computer are one minute off

Why: Unexplained slowdowns, unexpected pop-ups, and programs you did not install or open are classic indicators of malware activity. Minor display or timing differences are usually harmless.

• A. Keep using the same password since it worked before
• B. Change the password immediately and on any other accounts where it was reused ✓
• C. Wait a month to see if any unusual activity occurs
• D. Share the password with IT so they can handle it

Why: Changing a compromised password right away stops the attacker from using it, and changing it on any other accounts where you reused it prevents the attacker from moving to those accounts too. Never share passwords with anyone.

• A. Only your closest coworker so they can help you fix it quietly
• B. Your IT or security team as soon as possible ✓
• C. No one, as long as the problem seems small
• D. Only after you have finished investigating it yourself

Why: Prompt reporting to IT or the security team allows trained responders to contain the threat, assess its impact, and meet any legal or policy requirements. Waiting or handling it alone can allow damage to grow.