Recognizing Phishing and Scams Course: Phishing emails, links, QR codes and fake websites

1. Vraag 1 van 17

   In the web address https://portal.maplecu.example/login, which part shows who really owns the site?

   • Aportal
   • Bmaplecu.example
   • Chttps://portal
   • Dlogin
   Toon antwoord

   Antwoord: B. maplecu.example

   The owner is the name just before the first single slash, with its ending. "portal" is only a part of that site.

2. Vraag 2 van 17

   Which web address really belongs to maplecu.example?

   • Ahttps://help.example/maplecu
   • Bhttps://maplecu-example.help/reset
   • Chttps://maplecu.example.reset-help.example/
   • Dhttps://help.maplecu.example/reset
   Toon antwoord

   Antwoord: D. https://help.maplecu.example/reset

   Only the first ends in maplecu.example right before the first single slash. The others belong to other domains.

3. Vraag 3 van 17

   What does the Cyber Centre suggest instead of clicking links in messages to reach a website?

   • ACopy the link into a new browser tab
   • BUse a bookmark or a search engine
   • CClick the link but only on a phone
   • DAsk the sender to send the link again
   Toon antwoord

   Antwoord: B. Use a bookmark or a search engine

   Using bookmarks or a search engine takes you to the real site instead of where the message wants you to go.

4. Vraag 4 van 17

   What is "pharming"?

   • ASending people to fake look-alike websites
   • BBuying fake followers to make an account look popular
   • CSaving cookies so a website loads faster
   • DSharing a file through a cloud storage folder
   Toon antwoord

   Antwoord: A. Sending people to fake look-alike websites

   The Cyber Centre describes pharming as redirecting users to fake websites that look identical to legitimate ones.

5. Vraag 5 van 17

   A shopping site shows a padlock icon and its address starts with https. What does this prove?

   • AThat someone has checked the site's prices
   • BThat the government has approved and listed the site
   • CThat the business behind the site is real and trustworthy
   • DNot enough on its own; fake sites can have these too
   Toon antwoord

   Antwoord: D. Not enough on its own; fake sites can have these too

   The Cyber Centre says not to rely on padlock icons or how a site looks to decide whether it is legitimate.

6. Vraag 6 van 17

   Which is a warning sign of a fake online store, according to the CAFC?

   • AA clear returns policy
   • BPrices close to those in local stores
   • CNo customer phone number or email on the site
   • DSeveral payment choices at checkout
   Toon antwoord

   Antwoord: C. No customer phone number or email on the site

   The CAFC lists missing contact details, huge discounts and a different name on your card statement as red flags.

7. Vraag 7 van 17

   At checkout, a seller asks you to skip the website's checkout and pay by e-transfer for a "bigger discount". What does the Cyber Centre say?

   • AIt is safe as long as the total is under $100
   • BIt is a normal way for small online sellers to avoid paying card fees
   • CMoving payment outside the official checkout is a red flag
   • DIt is safer than paying by credit card
   Toon antwoord

   Antwoord: C. Moving payment outside the official checkout is a red flag

   The Cyber Centre warns about requests to move payments outside the official checkout process, such as paying by e-transfer.

8. Vraag 8 van 17

   Which payment method does the Cyber Centre suggest for online shopping because it may offer fraud protection or a chargeback?

   • AA gift card bought at a store
   • BA cryptocurrency transfer
   • CA credit card from a major financial institution
   • DCash sent by mail
   Toon antwoord

   Antwoord: C. A credit card from a major financial institution

   Credit cards from major financial institutions may offer fraud protection or chargeback options.

9. Vraag 9 van 17

   The Cyber Centre says not to open attachments from unknown senders, or attachments with which feature?

   • AFiles smaller than 1 MB
   • BShort file names with no spaces
   • CFiles sent on a weekday
   • DStrange file names or more than one file extension
   Toon antwoord

   Antwoord: D. Strange file names or more than one file extension

   Strange names and multiple extensions can hide what a file really is.

10. Vraag 10 van 17

    What is "thread hijacking"?

    • ACutting the cable that links an office computer to the network
    • BUsing a taken-over email account to join a real conversation
    • CPosting fake comments under a news story
    • DCopying a company's logo onto a fake website
    Toon antwoord

    Antwoord: B. Using a taken-over email account to join a real conversation

    The Cyber Centre says thread hijacking makes a request look trustworthy because it appears in an existing conversation.

11. Vraag 11 van 17

    After you click an email link, a request appears: "Allow DocuViewer to access your mailbox and files?" You have never used this app. What attack could this be?

    • ATailgating
    • BA watering hole attack
    • CConsent phishing
    • DTyposquatting
    Toon antwoord

    Antwoord: C. Consent phishing

    In consent phishing, approving a fake app request lets the attacker reach your account without your password.

12. Vraag 12 van 17

    Read the email. Who really owns the link?

    From: Northbank Security <alerts@northbank-secure.example>

    Subject: Unusual sign-in blocked

    We blocked a sign-in to your account from Winnipeg. If this wasn't you, verify your identity now:

    https://northbank.example.verify-id.example/secure

    Accounts not verified within 12 hours will be locked.

    Northbank Security Team

    • Anorthbank.example
    • Bverify-id.example
    • Csecure
    • Dnorthbank-secure.example
    Toon antwoord

    Antwoord: B. verify-id.example

    The name just before the first single slash is verify-id.example. "northbank.example" at the front is a disguise.

13. Vraag 13 van 17

    Read the email. What is the safest way to check whether there is a problem with your account?

    From: Northbank Security <alerts@northbank-secure.example>

    Subject: Unusual sign-in blocked

    We blocked a sign-in to your account from Winnipeg. If this wasn't you, verify your identity now:

    https://northbank.example.verify-id.example/secure

    Accounts not verified within 12 hours will be locked.

    Northbank Security Team

    • AClick the link, but close the page before you type your password
    • BCall the phone number in the email's signature
    • COpen the bank's site from a bookmark or by typing the address
    • DReply to the email and ask for proof
    Toon antwoord

    Antwoord: C. Open the bank's site from a bookmark or by typing the address

    Reach the bank through a channel you choose yourself, not through anything in the message.

14. Vraag 14 van 17

    At a café, a QR code on your table says "Scan to order and pay". It looks like a sticker placed over another code. What does the Cyber Centre advise?

    • APeel it off and scan the code underneath
    • BScan it, but pay with a gift card
    • CScan it, since many cafés use QR menus
    • DAsk a staff member to check it before you scan
    Toon antwoord

    Antwoord: D. Ask a staff member to check it before you scan

    A label that could be covering another QR code is a warning sign; ask staff to verify it first.

15. Vraag 15 van 17

    Which phone setting does the Cyber Centre suggest for QR codes?

    • AOpen QR code links automatically to save time at the till
    • BAsk for permission before opening a QR code action
    • CTurn off the screen lock while scanning
    • DLet QR apps read your text messages
    Toon antwoord

    Antwoord: B. Ask for permission before opening a QR code action

    Setting your device to ask before it launches a QR action gives you a chance to check the address first.

16. Vraag 16 van 17

    Read the email. Why should Sam still be careful?

    Sam and Dana Ruiz, a client contact, have emailed for weeks about shipping rates. Today this reply arrives in the same thread, from Dana's real address, dana.ruiz@lakeshorelogistics.example:

    Re: Q3 shipping rates

    Hi Sam, as discussed, please review the updated rate sheet before our call. Open the shared file here and sign in with your work email to view it.

    Thanks, Dana

    • ADana usually signs her emails with her full name and title
    • BShared files can never contain anything harmful, so there is no risk
    • CRate sheets are always sent by fax
    • DDana's account may be hacked and used to reply in the thread
    Toon antwoord

    Antwoord: D. Dana's account may be hacked and used to reply in the thread

    With thread hijacking, a real address and a real conversation do not prove the request is safe, especially one asking you to sign in.

17. Vraag 17 van 17

    Read the email. What should Sam do?

    Sam and Dana Ruiz, a client contact, have emailed for weeks about shipping rates. Today this reply arrives in the same thread, from Dana's real address, dana.ruiz@lakeshorelogistics.example:

    Re: Q3 shipping rates

    Hi Sam, as discussed, please review the updated rate sheet before our call. Open the shared file here and sign in with your work email to view it.

    Thanks, Dana

    • ACheck with Dana by phone, using a number he already has
    • BReply in the thread and ask if it is real
    • CSign in quickly, since the call with Dana is starting soon
    • DForward the email to the whole team so they can check it
    Toon antwoord

    Antwoord: A. Check with Dana by phone, using a number he already has

    Confirm through a separate channel. A reply in the same thread could go to the attacker.

Toetsenbord: 1–4 om te antwoorden, Enter voor de volgende vraag.