[ SIX QUESTIONS ]
How much of this already makes sense?
Pick an answer and the reasoning appears, whether you got it right or not — the explanations are the point, not the score. Nothing is submitted, nothing is stored, and there is no way for anyone including us to see how you did.
01You get a text saying a parcel could not be delivered, with a link to pay a $2 fee. What is the giveaway?
Right. A tiny fee is the point. It feels too trivial to be a scam, and it is really there to capture your card details, not to collect $2.
Not quite. Plenty of real services text you. The problem is the link and the payment, not the medium.
Not quite. Timing proves nothing either way. Automated systems send at all hours.
02Which of these actually stops most account takeovers?
Not quite. Forced rotation mostly produces predictable variations. Modern guidance moved away from it years ago.
Right. Phishing-resistant by design: the credential is bound to the real site, so a fake login page cannot use it even if you are fooled.
Not quite. Better than nothing, and much weaker than it looks. Codes can be phished in real time or intercepted by SIM swap.
03Ransomware has encrypted a laptop. You have good backups. Is that the end of it?
Not quite. Backups solve availability only. Most current campaigns copy data out before encrypting anything.
Right. Exfiltration usually happens first, so a clean restore can still leave you with a disclosure to deal with.
Not quite. Backups work, and they are essential. They just answer a different question than "who now has my data".
04A "free" file scanner says it will check an attachment for you. What should you assume?
Right. Several well-known services publish submissions to subscribers and researchers. Uploading a client contract or a payroll file can be a disclosure in itself.
Not quite. Being a security tool says nothing about what it does with your file afterwards.
Not quite. The scan happens on their infrastructure, which means the file goes to them.
05What does most malware actually want?
Not quite. Purely destructive malware exists but is rare. Vandalism does not pay.
Right. Almost all of it is commercial. That is also why the defences that break the business model work so well.
Not quite. A symptom sometimes, never the goal.
06You think you have clicked something bad at work. What is the best first move?
Not quite. The most common and most expensive choice. Deleting it destroys the evidence and the clock keeps running.
Not quite. A scan may find nothing even when something is wrong, and waiting costs the only advantage you have.
Right. Speed matters more than certainty, and being wrong costs nothing. Nobody has ever been disciplined for a false alarm at a well-run organisation.
right so far, out of 6.
Whatever you scored, the useful next step is the same: turn on a passkey where you can, and tell someone quickly when something looks wrong. Start with phishing-resistant MFA or the malware families.