Cyber Security Quiz With Certificate Free
True / False
Select all that apply
True / False
Put in order
Put in order
Select all that apply
Put in order
Select all that apply
True / False
Disclaimer
This quiz is for educational purposes only. It does not replace official safety training, certification, or regulatory compliance programs.
Frequent NIST CSF Gaps Employees Miss in Day-to-Day Security
Credential and access control errors
Most real-world account takeovers start with small identity mistakes that weaken the Protect function of the NIST CSF.
- Password reuse across systems: One breach becomes many. Use unique credentials and your organization-approved password manager.
- MFA fatigue approvals: Approving “push” prompts you didn’t initiate can hand attackers the session. Deny unexpected prompts and report them immediately.
- Over-permissioned access: Keeping admin rights “just in case” expands blast radius. Request least-privilege access and time-bound elevation when needed.
Phishing and social engineering blind spots
- Trusting display names: Attackers spoof names and threads. Validate the actual sender address and the business context.
- Switching channels too late: If money, credentials, or sensitive data is involved, verify via a known channel (call a saved number, open a ticket) before acting.
- Misusing “Report Phish”: Forwarding suspicious messages to coworkers spreads risk. Use the official reporting path so security tools can quarantine and investigate.
Data handling and device hygiene mistakes
- Personal cloud/USB convenience: Moving files off managed storage breaks monitoring, encryption, retention, and incident response. Keep work data in approved repositories only.
- Deferring updates: Patch delays leave known vulnerabilities exposed. Follow change-control, but prioritize security updates within required timelines.
- Ignoring early indicators: Unusual login prompts, new inbox rules, and “sent mail you didn’t send” are Detect signals—treat them as incidents, not annoyances.
Workplace Cyber Scenarios Mapped to NIST CSF Decisions
Use these short drills to practice the same judgment calls the quiz targets across Protect, Detect, Respond, and Recover activities.
1) Executive wire request with urgency and secrecy
You receive an email “from the CEO” asking for a same-hour vendor payment and requesting confidentiality.
- Best action: Pause the transaction, verify via a trusted channel, and follow the finance approval workflow.
- Why it matters: Business email compromise succeeds when employees bypass controls under pressure.
2) Cloud document share from a “vendor” you don’t recognize
A file-sharing link claims you must “review the updated contract” and sign in to view it.
- Best action: Validate the sender independently, then access vendor files only through approved portals and accounts.
- Why it matters: Credential harvesting often hides behind legitimate-looking cloud services.
3) Unexpected MFA prompts while you’re not logging in
Your phone receives repeated authentication prompts for a system you aren’t using.
- Best action: Deny prompts, change your password from a known-good device, and notify IT/security.
- Why it matters: This is an early Detect signal of credential stuffing or session takeover attempts.
4) “Update required” pop-up during routine browsing
A browser pop-up says your device is “infected” and demands an immediate plug-in update.
- Best action: Close the page, don’t install, and request software only through approved channels (self-service portal or IT).
- Why it matters: Fake updates are a common malware delivery method.
5) Working from guest Wi‑Fi with internal files
You’re at a client site and need to send a spreadsheet containing internal data.
- Best action: Use the official guest network, connect through your company VPN, and avoid transmitting sensitive data if secure access isn’t available.
- Why it matters: Network exposure increases interception and credential risk.
6) Ransom note appears on a shared drive
Files suddenly become unreadable and a ransom note appears.
- Best action: Disconnect from the network if instructed by policy, alert the incident response channel immediately, and do not attempt “quick fixes” that destroy evidence.
- Why it matters: Fast, coordinated Respond actions reduce spread and improve recovery outcomes.
Five Actions That Most Reduce Breach and Ransomware Risk
- Verify high-risk requests out-of-band: Any request for payments, credentials, or sensitive files should trigger a second-channel confirmation before you proceed.
- Treat unexpected MFA prompts as an incident signal: Deny, then immediately escalate—those prompts often indicate stolen credentials being tested.
- Keep data in managed locations: Approved storage enables encryption, access logging, retention, and rapid containment during investigations.
- Patch with urgency and discipline: Apply security updates within your organization’s change-control rules, but don’t let convenience override remediation timelines.
- Report early, not after you’re “sure”: Security teams can correlate your single suspicious event with other telemetry to stop a campaign in progress.
Cybersecurity Terms Used in NIST-Aligned Workplace Training
- Multi-factor authentication (MFA)
- Authentication that requires two or more different factor types (for example, password + authenticator app). Example: “I entered my password and then approved a one-time code.”
- Phishing
- A deceptive message that tricks a user into revealing credentials, sending money, or running malware. Example: “The email asked me to re-login to view an ‘invoice.’”
- Business Email Compromise (BEC)
- A social-engineering attack that impersonates executives or vendors to redirect payments or obtain sensitive information. Example: “Accounts payable received ‘updated banking details’ from a spoofed vendor.”
- Least privilege
- Granting only the minimum access needed to perform a task, for the minimum time needed. Example: “I requested temporary admin rights for a single installation.”
- Patch (security update)
- A vendor-provided fix that closes known vulnerabilities in software or firmware. Example: “I installed the critical update before reconnecting to production systems.”
- Ransomware
- Malware that encrypts or disrupts systems and demands payment, often paired with data theft. Example: “Shared files became unreadable and a ransom note appeared.”
- Incident reporting
- Using your organization’s defined process to escalate suspected compromise for triage and response. Example: “I reported a suspicious inbox rule through the security hotline/ticket queue.”
Authoritative NIST and CISA References for Continued Study
- The NIST Cybersecurity Framework (CSF) 2.0 — Primary CSF reference for building and assessing cybersecurity outcomes across governance, risk, and operational controls.
- NIST Cybersecurity Framework program page — Official hub for CSF updates, quick-start guidance, and implementation resources.
- NIST SP 800-63B (Digital Identity Guidelines: Authentication and Lifecycle Management) — Detailed guidance on authentication controls, including password and authenticator lifecycle expectations.
- CISA: Recognize and Report Phishing — Practical indicators of phishing and recommended reporting behaviors for employees.
- CISA: #StopRansomware Guide — Prevention and response best practices for ransomware and data extortion incidents.
Cybersecurity Quiz + Certificate FAQs (NIST CSF-Aligned)
Which parts of the NIST Cybersecurity Framework does this quiz emphasize for everyday employees?
It focuses on behaviors that map cleanly to Protect (safe authentication, secure data handling, patch hygiene), Detect (spotting anomalies like unexpected MFA prompts or suspicious inbox rules), and Respond (using the correct internal reporting and containment steps). You’re practicing decisions that reduce breach likelihood, not just memorizing definitions.
What’s the most reliable way to handle “urgent” requests for money, credentials, or sensitive files?
Treat urgency as a risk signal. Verify the request using a separate, trusted channel (for example, calling a number from your directory rather than replying to the message) and follow the documented approval workflow. This prevents business email compromise where attackers rely on speed and secrecy to bypass controls.
If I accidentally clicked a suspicious link, what actions are usually expected immediately?
Stop interacting with the message, avoid entering credentials, and report it via your organization’s security reporting method. If you entered a password, change it right away from a known-good device and notify IT/security so they can check for session tokens, mailbox rules, or other persistence. The quiz scenarios reinforce early escalation over “waiting to see.”
Why do policies ban saving work files to personal email, personal cloud drives, or unmanaged USB devices?
Unmanaged storage typically bypasses corporate encryption, access logging, retention, backup, and legal hold controls. It also creates blind spots during incident response because investigators can’t reliably identify what data left the environment. If you want deeper practice on handling sensitive information, review the Data Protection Quiz.
How does the quiz treat passwords versus MFA—what’s considered “good enough” today?
Strong, unique passwords remain essential, but they’re not sufficient alone against phishing and credential stuffing. The expected baseline is unique credentials per system, use of an approved password manager when permitted, and MFA wherever available—plus refusing unexpected MFA prompts. The safest habit is to assume credentials can be exposed and rely on layered controls.
What does “reporting suspicious activity” mean in practice (beyond telling a coworker)?
It means using the official channel that creates a trackable record (security tool button, ticket queue, hotline, or SOC mailbox—whatever your organization defines). That enables quarantine, indicator correlation, and documentation for audits or regulatory response. For more targeted drills on email-based threats, see the Email Security And Compliance quiz.
Is a free certificate from this quiz a substitute for my employer’s required security training?
No. A quiz certificate typically documents that you completed an assessment, but it does not replace your organization’s mandatory training, policy attestations, or role-based requirements. Use the certificate as reinforcement evidence for personal development or manager review, while following your employer’s official training and compliance process.
