You receive an email from your bank asking you to verify your account by clicking a link. What do you do?

Phishing emails often impersonate trusted organisations to steal credentials. Always verify through official channels.

• A Check the sender address carefully and look for red flags before deciding.
• B Click the link and enter my details — it looks legitimate.
• C Forward it to a colleague to check if they got the same email.
• D Ignore the email, navigate to the bank website directly, and report the message.

A colleague sends you an unexpected email with an attachment labelled "Urgent — open immediately". What is your first action?

Attackers often compromise accounts and use urgency to pressure recipients into opening malicious attachments.

• A Contact the colleague through a different channel to verify they sent it.
• B Reply to the email asking what the attachment is about.
• C Open the attachment — it's from someone I know.
• D Do not open it, verify via phone or in person, and report to IT if unconfirmed.

How do you manage passwords across your different online accounts?

Password reuse is one of the top causes of account compromise. A password manager significantly reduces risk.

• A I use the same password for most of my accounts.
• B I use different passwords for important accounts and write them in a notebook.
• C I have a few variations of one password that I rotate.
• D I use a password manager to generate and store unique passwords for every account.

Do you use multi-factor authentication (MFA) on your personal accounts?

MFA adds a critical second layer of security. Even if your password is stolen, MFA can prevent unauthorised access.

• A I don't know what MFA is.
• B I use MFA on all accounts that support it, preferring authenticator apps over SMS.
• C I use it on some accounts like email and banking.
• D I've heard of it but haven't set it up.

Someone calls you claiming to be from IT support and asks for your login credentials to fix a problem. What do you do?

Legitimate IT departments will never ask for your password over the phone. This is a classic social engineering tactic.

• A Refuse to give credentials and tell them I'll call the IT helpdesk myself.
• B Give them my credentials — they sound professional and urgent.
• C Refuse, hang up, call IT through the official number to verify, and report it.
• D Ask them to explain the problem first, then decide.

You need to use public Wi-Fi at a coffee shop to check your work email. What precautions do you take?

Public Wi-Fi networks are easy to intercept. Using a VPN encrypts your traffic and prevents eavesdropping.

• A I connect and use it normally — Wi-Fi is Wi-Fi.
• B I use a VPN before accessing anything sensitive.
• C I avoid online banking but check email freely.
• D I use a VPN, avoid sensitive tasks, and use my mobile hotspot when possible.

How do you share sensitive documents with colleagues?

Email attachments can be intercepted. Encrypted file sharing and access-controlled platforms are safer alternatives.

• A I use a cloud drive link but don't restrict access.
• B I email them as attachments — it's the easiest way.
• C I share via a company-approved platform with access controls.
• D I use encrypted, access-controlled sharing and set expiry dates on links.

A colleague asks you to email them a spreadsheet containing customer personal data. What do you do?

Emailing personal data without encryption may violate data protection regulations like GDPR.

• A Password-protect the file and send the password separately.
• B Send it but put "Confidential" in the subject line.
• C Send it immediately — they need it for their work.
• D Share via a secure, access-controlled platform and verify they need it.

Do you lock your computer when you leave your desk, even briefly?

An unlocked computer gives anyone passing by full access to your files, email, and systems.

• A Sometimes, if I'm leaving for a long time.
• B Yes, I lock it manually most of the time.
• C Always — I use Win+L or Cmd+Ctrl+Q as a habit, and have auto-lock enabled.
• D No, I don't usually bother — I'll only be away for a moment.

Someone you don't recognise follows you through a secure door. What do you do?

Tailgating is one of the simplest ways to bypass physical security. Politely challenging unknown individuals protects everyone.

• A Let them through but feel uneasy about it.
• B Politely ask if they have a badge or are visiting someone.
• C Ask them to badge in separately and report the incident to security if they can't.
• D Hold the door open for them — it would be rude not to.