Understanding Phishing Attacks

Which of the following best defines a phishing attack?

• An attempt to physically steal a computer

• A fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity

• A method of encrypting data for security

• A process of updating software

What is a common sign of a phishing email?

• The email comes from a known contact and contains no links

• The email asks for personal information and contains suspicious links

• The email is written in perfect grammar and style

• The email is sent from your own email address

Which of the following is NOT a typical goal of a phishing attack?

• To steal login credentials

• To install malware

• To improve network speed

• To obtain financial information

What should you do first if you suspect an email is a phishing attempt?

• Click on all links to verify their authenticity

• Delete the email without reading it

• Report the email to your IT department or security team

• Forward the email to your friends

Which action demonstrates applying knowledge to avoid phishing attacks?

• Ignoring all emails

• Hovering over links to check their actual URL before clicking

• Replying to every email to confirm its legitimacy

• Using the same password for all accounts

A user receives an email from their "bank" asking to verify their account by clicking a link. What is the best course of action?

• Click the link and enter the requested information

• Call the bank using the official phone number to verify the request

• Forward the email to coworkers

• Ignore the email and do nothing

Which of the following scenarios best illustrates a spear phishing attack?

• An email sent to thousands of random people

• An email personalized with your name and job title, referencing a recent project

• A pop-up ad on a website

• A phone call from an unknown number

You are responsible for training new employees about phishing. Which strategy would most effectively help them recognize phishing attempts?

• Telling them to never use email

• Providing real-world examples of phishing emails and discussing warning signs

• Asking them to memorize the definition of phishing

• Instructing them to delete all emails from unknown senders

A company experiences a data breach after an employee falls for a phishing scam. As a security analyst, how would you plan to prevent similar incidents in the future?

• Ignore the incident and hope it doesn't happen again

• Implement regular phishing awareness training and simulated phishing tests for employees

• Fire the employee who clicked the link

• Block all incoming emails

You receive an email that appears to be from your university’s IT department, asking you to reset your password using a provided link. What steps would you take to determine if this is a phishing attempt?

• Immediately click the link and reset your password

• Check the sender’s email address, hover over the link to inspect the URL, and contact the IT department directly to confirm the request

• Forward the email to your classmates

• Reply to the email asking for more information