Cybersecurity Awareness for Employees Course：Spotting phishing: email, text, phone and QR codes

1. 第1题，共19题

   What is phishing?

   • AFake messages that pretend to come from someone you trust
   • BA program that speeds up a slow computer
   • CA filter in your email program that blocks unwanted advertising
   • DA safe way to send large files to people outside your company
   显示答案

   答案: A. Fake messages that pretend to come from someone you trust

   Phishing messages look legitimate so people will share information, click links, open attachments or send money.

2. 第2题，共19题

   What is "smishing"?

   • APhishing with QR codes
   • BPhishing by voice call
   • CPhishing by text message
   • DPhishing with fake social media ads
   显示答案

   答案: C. Phishing by text message

   Smishing is phishing carried out through SMS text messages.

3. 第3题，共19题

   What is "vishing"?

   • APhishing by phone call
   • BPhishing by text message
   • CPhishing inside video games
   • DPhishing with QR codes
   显示答案

   答案: A. Phishing by phone call

   Vishing (voice phishing) uses phone calls or voicemail to get people to share personal or sensitive information.

4. 第4题，共19题

   What is "quishing"?

   • APhishing that uses fake online quizzes
   • BPhishing by voice call
   • CPhishing by text message
   • DPhishing that uses QR codes
   显示答案

   答案: D. Phishing that uses QR codes

   Quishing uses QR codes that lead to malicious websites when scanned.

5. 第5题，共19题

   How is spear phishing different from ordinary phishing?

   • AIt targets a chosen person using personal details
   • BIt always arrives by regular mail instead of by email
   • CIt is only sent to people who work outdoors or on job sites
   • DIt never includes a link
   显示答案

   答案: A. It targets a chosen person using personal details

   Spear phishing is targeted. Attackers use personal or professional details, often from social media, to make the message convincing.

6. 第6题，共19题

   Read the email. Which detail is the strongest warning sign?

   From: IT Service Desk <support@brightwater-builders-help.example>

   Subject: URGENT: Your mailbox is 98% full

   Dear user,

   Your mailbox has reached its storage limit. To avoid losing incoming mail, you must sign in and confirm your account within 2 hours:

   https://brightwaterbuilders.example.mail-verify.example/login

   If you do not confirm, your account will be closed.

   IT Service Desk

   • AIt pushes you to sign in through a link within 2 hours
   • BIt is about the amount of storage space left in your mailbox
   • CIt has a subject line that is written partly in capital letters
   • DIt is signed by a department instead of a person
   显示答案

   答案: A. It pushes you to sign in through a link within 2 hours

   Urgent deadlines and requests to log in through a link are key phishing warning signs.

7. 第7题，共19题

   Read the email. What should you do next?

   From: IT Service Desk <support@brightwater-builders-help.example>

   Subject: URGENT: Your mailbox is 98% full

   Dear user,

   Your mailbox has reached its storage limit. To avoid losing incoming mail, you must sign in and confirm your account within 2 hours:

   https://brightwaterbuilders.example.mail-verify.example/login

   If you do not confirm, your account will be closed.

   IT Service Desk

   • AForward it to all your coworkers so they know to watch out for it
   • BReport it to IT or security without clicking the link
   • CReply to the sender and ask if it is real
   • DClick the link once, just to see whether the sign-in page looks real
   显示答案

   答案: B. Report it to IT or security without clicking the link

   The Cyber Centre says to report suspicious email to your IT and security teams and not to forward it to coworkers.

8. 第8题，共19题

   Before clicking a link in an email, what does the Cyber Centre suggest you do to check it?

   • AHover over it to see the real address
   • BCheck that the email has the company's logo at the top
   • CCount the links in the email
   • DReply to the sender and ask them what the link is for
   显示答案

   答案: A. Hover over it to see the real address

   Hovering shows the real address so you can look for misspellings or odd subdomains. Logos can be copied, so they prove nothing.

9. 第9题，共19题

   What is "typosquatting"?

   • ASending the same email to many people at the same time
   • BUsing a web address with a small misspelling
   • CLeaving a computer unlocked
   • DTyping your password slowly so no one can see it
   显示答案

   答案: B. Using a web address with a small misspelling

   Typosquatting uses misspelled domains that look like real ones so victims do not notice the difference.

10. 第10题，共19题

    An email attachment is named "Invoice_April.pdf.exe". What should this tell you?

    • AIt is a backup copy of an older invoice from the same supplier
    • BIt is an invoice that was already paid
    • CIt is a normal PDF file and is safe to open on a work computer
    • DThe double file extension is a malware warning sign
    显示答案

    答案: D. The double file extension is a malware warning sign

    The Cyber Centre warns about attachments with strange file names or more than one file extension.

11. 第11题，共19题

    An email from a coworker's real address asks you to open an unexpected file. Why should you still be careful?

    • AOnly managers' emails can be trusted
    • BCoworkers are not allowed to send each other attachments at work
    • CReal emails from coworkers never contain any attachments
    • DAddresses can be spoofed and accounts taken over
    显示答案

    答案: D. Addresses can be spoofed and accounts taken over

    A known sender is not automatically safe. Addresses can be spoofed, and attackers use stolen accounts to phish the victim's contacts.

12. 第12题，共19题

    An unexpected email has perfect spelling and grammar. What does that tell you?

    • AIt has already been checked and cleared by your spam filter
    • BIt is safe, because scammers always make spelling mistakes
    • CIt must have come from someone inside your own organization
    • DNothing on its own, because AI can write phishing with no errors
    显示答案

    答案: D. Nothing on its own, because AI can write phishing with no errors

    Poor grammar can be a warning sign, but its absence does not prove a message is real. AI-written phishing may have no errors.

13. 第13题，共19题

    Read the text message. What is the best response?

    Text message from +1 403-555-0187:

    "QuickShip Couriers: Your parcel is on hold because of an unpaid delivery fee of $1.95. Pay now at http://quickship-redelivery.example/pay or the parcel will be returned to the sender today."

    • ADon't tap the link; forward it to 7726 and delete it
    • BTap the link to check it, but do not enter any card details
    • CReply STOP so the sender takes your number off their list
    • DPay the fee, since it is only $1.95 and the parcel may be real
    显示答案

    答案: A. Don't tap the link; forward it to 7726 and delete it

    Do not click links in suspicious texts. Forwarding to 7726 lets your phone provider investigate and block the scam.

14. 第14题，共19题

    Why should you not reply "STOP" to a scam text?

    • AIt automatically reports you to the police for spam
    • BIt shows the scammer your number is active
    • CIt costs a large fee to reply to a short code number
    • DIt deletes all the other text messages on your phone
    显示答案

    答案: B. It shows the scammer your number is active

    Get Cyber Safe says replying, even with STOP or NO, shows your number is active and can lead to more scam messages.

15. 第15题，共19题

    In Canada, which number can you forward spam and scam text messages to?

    • A311
    • B1-888-495-8501
    • C7726
    • D911
    显示答案

    答案: C. 7726

    7726 spells SPAM on most keypads. Forwarding a scam text there is free and alerts your cellular provider.

16. 第16题，共19题

    Read the call. What should you do next?

    Your phone rings. The caller ID shows "Harbour Bank", where you have an account.

    Caller: "Hello, this is the Harbour Bank fraud team. We have blocked a suspicious $940 charge on your card. To cancel it, please read me the 6-digit code we just sent to your phone. Please hurry, the charge goes through in five minutes."

    • ARead out the code, since the caller ID shows the bank's name
    • BAsk the caller for a call-back number, then call them back on it
    • CGive only the last three digits of the code to be safe
    • DHang up and call the bank using the number on your bank card
    显示答案

    答案: D. Hang up and call the bank using the number on your bank card

    Hang up and call back using a known, trusted number, not one the caller gives you. Scammers target one-time codes and can spoof caller ID.

17. 第17题，共19题

    Read the situation. What is the safest choice?

    At the staff parking lot, the pay sign has a printed QR code. Someone has stuck a new QR code sticker over it. The sticker says: "NEW! Scan here to pay for parking. Card payments only."

    • AScan the sticker, but pay with a debit card instead of a credit card
    • BDon't scan the sticker; ask staff or pay another way
    • CScan the sticker, since it says it is the new way to pay
    • DPeel off the sticker and scan the printed code underneath
    显示答案

    答案: B. Don't scan the sticker; ask staff or pay another way

    The Cyber Centre warns against scanning a code on a label that may cover another code. Ask staff to verify it first.

18. 第18题，共19题

    You scan a QR code on a poster and the page asks for your work email and password. What should you do?

    • AScan the code again
    • BEnter your password, but leave the email address box empty
    • CCheck the web address; don't sign in if unsure
    • DSign in quickly before the page times out and you lose your place
    显示答案

    答案: C. Check the web address; don't sign in if unsure

    Being asked to log in after scanning a QR code is a warning sign. Verify the website address before entering anything.

19. 第19题，共19题

    A call shows a trusted company name on caller ID. Why is that not proof the call is real?

    • ACaller ID only works for government numbers
    • BReal companies are not allowed to call their own customers
    • CCaller ID is off for business calls
    • DScammers can make caller ID show any name or number
    显示答案

    答案: D. Scammers can make caller ID show any name or number

    Scammers can spoof caller ID so a call seems to come from a trusted company, phone number or internal extension.

键盘：按1–4作答，按 Enter 进入下一题。