Employee Cybersecurity Knowledge Test
True / False
True / False
Select all that apply
True / False
Select all that apply
Select all that apply
Put in order
Put in order
True / False
Select all that apply
Disclaimer
This quiz is for educational purposes only. It does not constitute professional advice. Consult a qualified professional for specific guidance.
Everyday Workplace Security Mistakes That Trigger Incidents (and How to Prevent Them)
Misreading “looks legit” signals in email
Attackers rely on realistic branding, familiar names, and urgent tone. A common error is trusting the display name (e.g., “Payroll Team”) instead of verifying the actual sender address, reply-to behavior, and whether the request matches a known process.
- Avoid it: Treat unexpected invoices, gift-card requests, password resets, and document-share invites as hostile until verified via a separate channel.
Approving MFA prompts you didn’t initiate
MFA “push fatigue” works because people tap Approve to stop the notifications. Approving an unsolicited prompt can complete an attacker’s login.
- Avoid it: Deny unexpected prompts and report them immediately; re-authenticate only after you start a login yourself.
Using weak, reused, or shared credentials
Reused passwords turn one breach into many. Shared accounts remove accountability and block meaningful auditing.
- Avoid it: Use an approved password manager for unique passphrases; request named access instead of borrowing credentials.
Deferring updates and restarts
Skipping patch prompts leaves known vulnerabilities exposed—often the same ones attackers mass-scan for.
- Avoid it: Schedule a weekly update window, restart promptly, and don’t disable endpoint protections without IT approval.
“Convenience” data handling that breaks policy
Forwarding work files to personal email, copying sensitive data into unmanaged notes apps, or uploading to unapproved cloud storage creates shadow IT and data leakage risk.
- Avoid it: Use approved sharing tools, label/classify data as required, and encrypt or restrict access when handling sensitive information.
Not reporting near-misses
People often report only after damage is obvious. Early reporting (even if you’re unsure) limits attacker dwell time.
- Avoid it: Report suspicious messages, accidental clicks, lost devices, or unusual pop-ups immediately—speed matters more than certainty.
Employee Cybersecurity Quick Reference (Printable): Email, Authentication, Devices, and Data
Printable note: Print this page section or save it as a PDF for quick review before taking the quiz and during periodic security refreshers.
Suspicious email/link checklist (60-second triage)
- Context: Were you expecting this message, attachment, or shared document?
- Sender: Check the full sender address and reply-to behavior; watch for subtle lookalikes.
- Request: Be skeptical of urgency, secrecy, payment changes, credential prompts, or “download to view.”
- Links: Hover/preview destinations; avoid logging in from email links—navigate via known bookmarks instead.
- Attachments: Treat unexpected files (especially “invoice,” “scan,” “secure document”) as risky; verify first.
Passwords + password managers
- Use unique passphrases for every account; length beats complexity tricks.
- Never reuse work passwords on personal sites (or vice versa).
- Prefer a manager to generate/store credentials; don’t keep passwords in spreadsheets or notes.
- Change passwords immediately if you suspect compromise or if IT directs you after an incident.
Multi-factor authentication (MFA)
- Deny unexpected prompts; repeated prompts are a red flag.
- Prefer stronger factors when available (authenticator app codes, number matching, hardware keys) over SMS.
- Never share one-time codes or approve sign-ins “to help IT” unless you initiated a verified support session.
Device and software hygiene
- Update promptly (OS, browser, apps, plugins) and restart when required.
- Lock your screen when stepping away; use approved auto-lock settings.
- Only install approved software; request exceptions through IT rather than self-installing tools.
Remote work, Wi‑Fi, and removable media
- Use VPN when required, especially on untrusted networks.
- Avoid unknown USB devices; only use organization-issued or approved media.
- Protect conversations in public: shoulder-surfing and speakerphone leakage count as data exposure.
Incident reporting: what to report immediately
- Clicked a suspicious link, opened an unexpected attachment, or entered credentials in a page you now distrust.
- Unexpected MFA prompts, account lockouts, or password reset emails you didn’t request.
- Lost/stolen devices, exposed documents, or sensitive data sent to the wrong recipient.
- Any unusual device behavior (new toolbars, persistent pop-ups, sudden encryption/ransom notes).
Phishing and Business Email Compromise Walkthrough: Verify, Contain, Report
Scenario
You receive an email that appears to be from a known vendor: “Updated banking details—please reprocess the attached invoice today.” It includes a PDF and asks you to reply confirming payment.
Step-by-step decision path
- Pause and classify the request. This is a high-risk pattern: payment change + urgency. Treat it as potential business email compromise (BEC), even if the vendor name looks correct.
- Verify the sender, not the display name. Check the full from-address for lookalike domains and whether the reply-to address differs. A mismatch is a strong indicator of spoofing or account takeover.
- Avoid using the email thread to validate. Don’t reply to the message to “confirm.” Use an out-of-band method: call a known vendor contact number from your records (not the email signature) or verify through your procurement system.
- Handle the attachment safely. Don’t open the PDF “just to look.” If policy allows, submit the email to your organization’s phishing-report process so security tools can analyze it.
- Contain if you interacted. If you opened the attachment or clicked anything, immediately report what happened, what device you used, and what credentials (if any) you entered. Follow IT guidance—do not “self-fix” by deleting evidence or running unapproved tools.
- Document the business impact. If any payment was initiated, notify the appropriate finance/management channel immediately; rapid escalation can reduce losses.
What the quiz is testing here
Whether you recognize high-risk social engineering patterns, use verification workflows, and prioritize fast reporting and containment over embarrassment or delay.
Employee Cybersecurity Knowledge Test FAQ: What “Good Security” Looks Like at Work
What’s the fastest way to tell a normal internal email from a phishing attempt?
Start with the process, not the branding. Legitimate requests usually match an established workflow (ticketing, approvals, known portals). Phishing often introduces a new process (“download this file to view,” “reply with codes,” “urgent payment change”) and pressures you to act outside normal channels. For deeper email-specific practice, see Email Security And Compliance.
If I clicked a suspicious link but didn’t type my password, do I still report it?
Yes. Clicking can trigger device fingerprinting, token theft attempts, drive-by downloads, or route you into a convincing credential capture flow later. Report quickly with the message details and what you clicked so security can block the destination, review logs, and validate your endpoint.
Why is approving an unexpected MFA push such a big deal?
An unsolicited MFA prompt can mean your password is already compromised. If you approve it, you may complete an attacker’s login in real time. The correct behavior is to deny the prompt, stop what you’re doing, and report it—especially if prompts repeat.
Should I change my password regularly “just in case”?
Follow your organization’s policy. In many environments, forced frequent rotation can lead to predictable patterns and weaker choices. What consistently helps is using unique long passphrases, a password manager, and MFA, and changing credentials immediately when compromise is suspected or confirmed.
Is public Wi‑Fi safe if I’m using a VPN?
A VPN reduces risk by encrypting traffic between your device and the VPN endpoint, but it doesn’t make unsafe behavior safe. You still need to avoid unknown USB devices, keep your OS/browser patched, and verify you’re connecting to the intended network. If a task involves highly sensitive data, use a trusted connection when possible.
How do I decide whether a file contains “sensitive data” that needs extra protection?
Use your organization’s data classification rules (examples: customer personal data, financial reports, credentials, internal-only strategy docs). When in doubt, treat it as sensitive: restrict sharing to named recipients, use approved storage, and avoid copying into unmanaged apps. For policy-focused practice, see Data Protection Quiz.
Five Non-Negotiable Cybersecurity Actions Employees Should Practice Daily
- Verify high-impact requests out of band. Payment changes, credential prompts, and access requests should be confirmed through known channels (ticketing system, directory, or a phone number from your records), not by replying to the email.
- Use a password manager + MFA as the default. Unique long passphrases stored in an approved manager, combined with MFA, reduces the blast radius of inevitable credential leaks.
- Deny and report unexpected MFA prompts immediately. Treat “I didn’t log in but got an MFA request” as a potential account-compromise signal, not a nuisance.
- Patch fast; restart when required. Delayed OS/browser/app updates are a primary path to compromise because attackers target known vulnerabilities that already have fixes.
- Report near-misses, not just confirmed breaches. A quick report of a suspicious email, accidental click, or lost device enables containment and protects coworkers from the same lure.
Workplace Cybersecurity Glossary: Terms You’ll See in the Quiz
- Phishing
- Social engineering that uses messages or websites to trick you into revealing credentials, opening malware, or approving access. Example: “Your mailbox is full—sign in to re-activate.”
- Business Email Compromise (BEC)
- A targeted scam that impersonates executives, vendors, or finance staff to redirect payments or obtain sensitive data. Example: “Use this new bank account for the next wire transfer.”
- MFA push fatigue
- An attack pattern where repeated MFA prompts pressure a user to approve one. Example: Multiple “Approve sign-in?” notifications appear while you’re in a meeting.
- Least privilege
- Granting only the access needed to do a job, no more, and removing it when it’s no longer needed. Example: A contractor gets read-only access to one folder, not the entire shared drive.
- Data classification
- Labeling information by sensitivity to determine required handling controls (sharing, storage, encryption, retention). Example: Marking a customer export as “Confidential” and restricting recipients.
- Patch management
- The process of applying updates to fix vulnerabilities in operating systems and applications. Example: Restarting promptly after a security update to ensure the patch is applied.
- VPN
- A secure tunnel that encrypts traffic between your device and an organizational network or gateway. Example: Using VPN before accessing internal tools from a hotel network.
- Incident reporting
- Notifying the correct internal team quickly when suspicious activity occurs so they can investigate and contain it. Example: Reporting that you entered credentials on a page you now suspect was fake.
Authoritative Cybersecurity Awareness References (CISA, NIST, FTC, FBI)
- CISA: Phishing Guidance — Stopping the Attack Cycle at Phase One (PDF) — Practical guidance on recognizing, preventing, and responding to phishing in organizations.
- FTC: Phishing — Clear indicators of phishing and steps organizations can take to reduce risk and respond.
- FBI: Spoofing and Phishing — Common phishing/spoofing tactics and official reporting guidance.
- NIST SP 800-63B: Authentication and Lifecycle Management — Digital identity guidance, including recommendations for memorized secrets (passwords) and authenticator types.
- NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide — Incident response lifecycle concepts that explain why rapid reporting and containment matter.
- NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization — Decision framework for securely disposing of or reusing storage media.
- CISA Alert: Phishing-Resistant and Number-Matching MFA Guidance — Overview of stronger MFA approaches that reduce real-world phishing bypasses.
