NEW
Font size
WorksheetsCyber Security Awareness 2025
Total questions: 40
Worksheet time: 20mins
1. What is phishing?
a) A method of catching fish
b) A tactic to distribute malware or steal personal information
c) A process of encrypting data
d) A type of software for email filtering
2. What is the main difference between phishing and spear phishing?
a) Phishing is targeted, while spear phishing is random
b) Spear phishing targets specific individuals, while phishing is broad
c) Phishing requires social media, spear phishing does not
d) Spear phishing is more common than phishing
3. Which of the following is a common sign of a phishing email?
a) Perfect grammar and spelling
b) A familiar sender name with an unfamiliar email address
c) Random emojis in the email
d) No links in the email
4. What should you do if you receive a suspicious email with a link?
a) Click it to check if it's real
b) Forward it to everyone in your office
c) Delete it immediately without checking
d) Manually type the website’s URL in your browser
5. Which of the following is NOT a best practice to avoid phishing?
a) Checking the email sender's domain
b) Mouse-hovering over links before clicking
c) Immediately downloading all attachments
d) Contacting IT security if unsure
6. Why are email attachments a common way for malware to spread?
a) They often look like harmless files but contain malicious code
b) They can automatically execute malware upon opening
c) Attackers can use them to steal information
d) All of the above
7. What should you do if you receive an unexpected email attachment?
a) Open it immediately to check its contents
b) Verify with the sender if they sent it
c) Delete it without checking
d) Save it for later
8. What is a possible sign that an email attachment is malicious?
a) The sender has an official company email
b) It has an urgent message asking you to open it
c) It’s in PDF format
d) It comes from a co-worker
9. What happens when you open a spam email?
a) It confirms your email address is active to spammers
b) It immediately infects your computer with a virus
c) It deletes your inbox messages
d) It encrypts your files
10. Which is the best way to handle spam emails?
a) Respond and ask to be removed from the mailing list
b) Mark them as spam and delete them
c) Forward them to your friends
d) Click any links to check their content
11. Why is using real answers for security questions risky?
a) They are too easy to remember
b) They are often available on social media
c) They are required for password recovery
d) They make accounts more secure
12. What is the best practice when answering security questions?
a) Use your real information
b) Choose unique, false answers
c) Always use the same answer
d) Leave them blank
13. Which of the following is an example of poor password hygiene?
a) Using a unique password for each account
b) Writing passwords on a sticky note under your keyboard
c) Using a password manager
d) Enabling two-factor authentication
14. Why is changing passwords every 90 days important?
a) It improves typing speed
b) It helps prevent unauthorized access if a password is stolen
c) It confuses hackers
d) It makes passwords easier to remember
15. What does two-factor authentication (2FA) require?
a) Two different passwords
b) A password plus a second verification method
c) A backup email
d) A physical token
16. Why is SMS-based 2FA less secure than app-based 2FA?
a) Text messages can be intercepted
b) Apps are harder to install
c) Texts are more convenient
d) SMS messages cost money
17. Which of the following is NOT a type of malware?
a) Ransomware
b) Trojan
c) Firewall
d) Spyware
18. What is ransomware?
a) A virus that steals banking information
b) Malware that locks files and demands payment
c) Software that speeds up your computer
d) A security tool
19. Why is public Wi-Fi considered dangerous?
a) Hackers can set up fake networks
b) Data sent over public Wi-Fi can be intercepted
c) Attackers can steal login credentials
d) All of the above
20. How can you securely use the internet in public places?
a) Use a VPN
b) Connect to any available Wi-Fi
c) Disable your antivirus
d) Click on all pop-ups
21. What is an IoT device?
a) A traditional desktop computer
b) A device like a smart thermostat or doorbell
c) A USB drive
d) A regular landline phone
22. Why should you change the default password on IoT devices?
a) The default password is often known to hackers
b) It makes logging in easier
c) It prevents software updates
d) It helps share access with others
23. What does HTTPS ensure?
a) The website is safe to use
b) The connection between you and the website is encrypted
c) The website is free from malware
d) Your device is updated
24. Where should you check if a website is secure?
a) The website’s footer
b) The browser’s address bar
c) The website’s background color
d) The webpage’s text
25. What is social engineering?
a) A social networking feature
b) A tactic used to manipulate people into giving out information
c) A cybersecurity tool
d) A type of firewall
26. How can you prevent social engineering attacks?
a) Verify caller identities before sharing information
b) Always trust emails from your CEO
c) Give out information if someone insists
d) Ignore security policies
27. What is an insider threat?
a) An attack from a hacker
b) A threat from someone within an organization
c) A phishing attempt
d) A spam email
28. What is the primary goal of a firewall?
a) To physically block unauthorized users
b) To filter incoming and outgoing network traffic
c) To create strong passwords
d) To back up your data
29. What should you do if your device is infected with malware?
a) Ignore it and keep working
b) Immediately inform your IT department
c) Click on random pop-ups offering a solution
d) Disable antivirus software
30. How can you protect your personal and work devices from malware?
a) Install antivirus and update software regularly
b) Click on all pop-up advertisements
c) Use public Wi-Fi whenever possible
d) Disable security updates
31. What is the best way to create a strong password?
a) Use a mix of letters, numbers, and symbols
b) Use your name and birthdate for easy recall
c) Use "password123" as it is commonly accepted
d) Use the same password for all accounts
32. Which of the following is NOT a sign of a phishing attempt?
a) Urgent language demanding immediate action
b) Links to a website that looks slightly different from a real one
c) A personal email from a colleague you regularly communicate with
d) Unexpected attachments from unknown senders
33. Why should employees follow the company’s Acceptable Use Policy (AUP)?
a) To ensure compliance with cybersecurity best practices
b) To avoid workplace productivity
c) To freely share information with third parties
d) To use personal social media on company devices
34. What is an effective way to protect sensitive company data?
a) Use encrypted communication and access controls
b) Share passwords with trusted coworkers
c) Print out all sensitive documents for safekeeping
d) Keep confidential data stored on USB drives without encryption
35. How can you recognize a fake website?
a) It contains poor spelling and grammar
b) The URL is slightly misspelled
c) It lacks HTTPS in the address bar
d) All of the above
36. Why should you avoid downloading software from unknown sources?
a) It may contain hidden malware
b) It will always be expensive
c) It requires a fast internet connection
d) It may not install correctly
37. What is one major risk of using weak passwords?
a) They can be easily guessed by attackers
b) They help you log in faster
c) They are easy to remember
d) They improve cybersecurity
38. How can employees contribute to reducing cybersecurity risks?
a) Ignoring IT security updates
b) Following security policies and reporting suspicious activity
c) Using the same password for all work accounts
d) Clicking on unknown links in emails
39. What is the safest way to store passwords?
a) Writing them in a notebook
b) Saving them in a password manager
c) Keeping them on a sticky note under your keyboard
d) Sharing them with a trusted colleague
40. What should you do if you suspect your company is experiencing a cybersecurity breach?
a) Keep working and wait for someone else to report it
b) Inform the IT security team immediately
c) Ignore the issue if your computer is working fine
d) Post about it on social media to warn others
