Cybersecurity Awareness for Employees Course: Spotting phishing: email, text, phone and QR codes

1. Vraag 1 van 19

   What is phishing?

   • AFake messages that pretend to come from someone you trust
   • BA program that speeds up a slow computer
   • CA filter in your email program that blocks unwanted advertising
   • DA safe way to send large files to people outside your company
   Toon antwoord

   Antwoord: A. Fake messages that pretend to come from someone you trust

   Phishing messages look legitimate so people will share information, click links, open attachments or send money.

2. Vraag 2 van 19

   What is "smishing"?

   • APhishing with QR codes
   • BPhishing by voice call
   • CPhishing by text message
   • DPhishing with fake social media ads
   Toon antwoord

   Antwoord: C. Phishing by text message

   Smishing is phishing carried out through SMS text messages.

3. Vraag 3 van 19

   What is "vishing"?

   • APhishing by phone call
   • BPhishing by text message
   • CPhishing inside video games
   • DPhishing with QR codes
   Toon antwoord

   Antwoord: A. Phishing by phone call

   Vishing (voice phishing) uses phone calls or voicemail to get people to share personal or sensitive information.

4. Vraag 4 van 19

   What is "quishing"?

   • APhishing that uses fake online quizzes
   • BPhishing by voice call
   • CPhishing by text message
   • DPhishing that uses QR codes
   Toon antwoord

   Antwoord: D. Phishing that uses QR codes

   Quishing uses QR codes that lead to malicious websites when scanned.

5. Vraag 5 van 19

   How is spear phishing different from ordinary phishing?

   • AIt targets a chosen person using personal details
   • BIt always arrives by regular mail instead of by email
   • CIt is only sent to people who work outdoors or on job sites
   • DIt never includes a link
   Toon antwoord

   Antwoord: A. It targets a chosen person using personal details

   Spear phishing is targeted. Attackers use personal or professional details, often from social media, to make the message convincing.

6. Vraag 6 van 19

   Read the email. Which detail is the strongest warning sign?

   From: IT Service Desk <support@brightwater-builders-help.example>

   Subject: URGENT: Your mailbox is 98% full

   Dear user,

   Your mailbox has reached its storage limit. To avoid losing incoming mail, you must sign in and confirm your account within 2 hours:

   https://brightwaterbuilders.example.mail-verify.example/login

   If you do not confirm, your account will be closed.

   IT Service Desk

   • AIt pushes you to sign in through a link within 2 hours
   • BIt is about the amount of storage space left in your mailbox
   • CIt has a subject line that is written partly in capital letters
   • DIt is signed by a department instead of a person
   Toon antwoord

   Antwoord: A. It pushes you to sign in through a link within 2 hours

   Urgent deadlines and requests to log in through a link are key phishing warning signs.

7. Vraag 7 van 19

   Read the email. What should you do next?

   From: IT Service Desk <support@brightwater-builders-help.example>

   Subject: URGENT: Your mailbox is 98% full

   Dear user,

   Your mailbox has reached its storage limit. To avoid losing incoming mail, you must sign in and confirm your account within 2 hours:

   https://brightwaterbuilders.example.mail-verify.example/login

   If you do not confirm, your account will be closed.

   IT Service Desk

   • AForward it to all your coworkers so they know to watch out for it
   • BReport it to IT or security without clicking the link
   • CReply to the sender and ask if it is real
   • DClick the link once, just to see whether the sign-in page looks real
   Toon antwoord

   Antwoord: B. Report it to IT or security without clicking the link

   The Cyber Centre says to report suspicious email to your IT and security teams and not to forward it to coworkers.

8. Vraag 8 van 19

   Before clicking a link in an email, what does the Cyber Centre suggest you do to check it?

   • AHover over it to see the real address
   • BCheck that the email has the company's logo at the top
   • CCount the links in the email
   • DReply to the sender and ask them what the link is for
   Toon antwoord

   Antwoord: A. Hover over it to see the real address

   Hovering shows the real address so you can look for misspellings or odd subdomains. Logos can be copied, so they prove nothing.

9. Vraag 9 van 19

   What is "typosquatting"?

   • ASending the same email to many people at the same time
   • BUsing a web address with a small misspelling
   • CLeaving a computer unlocked
   • DTyping your password slowly so no one can see it
   Toon antwoord

   Antwoord: B. Using a web address with a small misspelling

   Typosquatting uses misspelled domains that look like real ones so victims do not notice the difference.

10. Vraag 10 van 19

    An email attachment is named "Invoice_April.pdf.exe". What should this tell you?

    • AIt is a backup copy of an older invoice from the same supplier
    • BIt is an invoice that was already paid
    • CIt is a normal PDF file and is safe to open on a work computer
    • DThe double file extension is a malware warning sign
    Toon antwoord

    Antwoord: D. The double file extension is a malware warning sign

    The Cyber Centre warns about attachments with strange file names or more than one file extension.

11. Vraag 11 van 19

    An email from a coworker's real address asks you to open an unexpected file. Why should you still be careful?

    • AOnly managers' emails can be trusted
    • BCoworkers are not allowed to send each other attachments at work
    • CReal emails from coworkers never contain any attachments
    • DAddresses can be spoofed and accounts taken over
    Toon antwoord

    Antwoord: D. Addresses can be spoofed and accounts taken over

    A known sender is not automatically safe. Addresses can be spoofed, and attackers use stolen accounts to phish the victim's contacts.

12. Vraag 12 van 19

    An unexpected email has perfect spelling and grammar. What does that tell you?

    • AIt has already been checked and cleared by your spam filter
    • BIt is safe, because scammers always make spelling mistakes
    • CIt must have come from someone inside your own organization
    • DNothing on its own, because AI can write phishing with no errors
    Toon antwoord

    Antwoord: D. Nothing on its own, because AI can write phishing with no errors

    Poor grammar can be a warning sign, but its absence does not prove a message is real. AI-written phishing may have no errors.

13. Vraag 13 van 19

    Read the text message. What is the best response?

    Text message from +1 403-555-0187:

    "QuickShip Couriers: Your parcel is on hold because of an unpaid delivery fee of $1.95. Pay now at http://quickship-redelivery.example/pay or the parcel will be returned to the sender today."

    • ADon't tap the link; forward it to 7726 and delete it
    • BTap the link to check it, but do not enter any card details
    • CReply STOP so the sender takes your number off their list
    • DPay the fee, since it is only $1.95 and the parcel may be real
    Toon antwoord

    Antwoord: A. Don't tap the link; forward it to 7726 and delete it

    Do not click links in suspicious texts. Forwarding to 7726 lets your phone provider investigate and block the scam.

14. Vraag 14 van 19

    Why should you not reply "STOP" to a scam text?

    • AIt automatically reports you to the police for spam
    • BIt shows the scammer your number is active
    • CIt costs a large fee to reply to a short code number
    • DIt deletes all the other text messages on your phone
    Toon antwoord

    Antwoord: B. It shows the scammer your number is active

    Get Cyber Safe says replying, even with STOP or NO, shows your number is active and can lead to more scam messages.

15. Vraag 15 van 19

    In Canada, which number can you forward spam and scam text messages to?

    • A311
    • B1-888-495-8501
    • C7726
    • D911
    Toon antwoord

    Antwoord: C. 7726

    7726 spells SPAM on most keypads. Forwarding a scam text there is free and alerts your cellular provider.

16. Vraag 16 van 19

    Read the call. What should you do next?

    Your phone rings. The caller ID shows "Harbour Bank", where you have an account.

    Caller: "Hello, this is the Harbour Bank fraud team. We have blocked a suspicious $940 charge on your card. To cancel it, please read me the 6-digit code we just sent to your phone. Please hurry, the charge goes through in five minutes."

    • ARead out the code, since the caller ID shows the bank's name
    • BAsk the caller for a call-back number, then call them back on it
    • CGive only the last three digits of the code to be safe
    • DHang up and call the bank using the number on your bank card
    Toon antwoord

    Antwoord: D. Hang up and call the bank using the number on your bank card

    Hang up and call back using a known, trusted number, not one the caller gives you. Scammers target one-time codes and can spoof caller ID.

17. Vraag 17 van 19

    Read the situation. What is the safest choice?

    At the staff parking lot, the pay sign has a printed QR code. Someone has stuck a new QR code sticker over it. The sticker says: "NEW! Scan here to pay for parking. Card payments only."

    • AScan the sticker, but pay with a debit card instead of a credit card
    • BDon't scan the sticker; ask staff or pay another way
    • CScan the sticker, since it says it is the new way to pay
    • DPeel off the sticker and scan the printed code underneath
    Toon antwoord

    Antwoord: B. Don't scan the sticker; ask staff or pay another way

    The Cyber Centre warns against scanning a code on a label that may cover another code. Ask staff to verify it first.

18. Vraag 18 van 19

    You scan a QR code on a poster and the page asks for your work email and password. What should you do?

    • AScan the code again
    • BEnter your password, but leave the email address box empty
    • CCheck the web address; don't sign in if unsure
    • DSign in quickly before the page times out and you lose your place
    Toon antwoord

    Antwoord: C. Check the web address; don't sign in if unsure

    Being asked to log in after scanning a QR code is a warning sign. Verify the website address before entering anything.

19. Vraag 19 van 19

    A call shows a trusted company name on caller ID. Why is that not proof the call is real?

    • ACaller ID only works for government numbers
    • BReal companies are not allowed to call their own customers
    • CCaller ID is off for business calls
    • DScammers can make caller ID show any name or number
    Toon antwoord

    Antwoord: D. Scammers can make caller ID show any name or number

    Scammers can spoof caller ID so a call seems to come from a trusted company, phone number or internal extension.

Toetsenbord: 1–4 om te antwoorden, Enter voor de volgende vraag.