Cybersecurity quiz: Test your knowledge with 15 questions

B) Phishing.

Phishing consistently ranks as the most widespread cyber threat targeting individuals. According to NordVPN’s analysis on cybersecurity statistics, phishing was the most common initial entry point for threat actors in 2025, serving as the attack vector in 38.3% of all cyberattacks.

What makes phishing so effective is how adaptable it is. Attackers use email, text messages, phone calls, and fake websites. The goal is always the same — to get you to hand over credentials, personal information, or money.

B) Call or message your friend through a different channel to verify their request.

This is a classic example of smishing — phishing carried out through text messages. In this scenario, your friend’s phone or account may have been compromised, or the number may be spoofed entirely. Option C sounds reasonable, but a scammer who has access to your friend’s account may already know enough personal details to answer it convincingly.

If you receive a message like this, contact your friend through a separate channel — call them directly, reach out on a different platform, or contact a mutual contact who can verify their whereabouts. Don’t send money until you’ve confirmed the request is genuine. You should also block and report the number that sent the message. If you’ve clicked on a phishing link, change your passwords immediately and monitor your accounts for unusual activity.

B) Hang up and call your bank using the number on the back of your card.

This is a vishing attack — voice phishing. Scammers impersonate bank staff, government agencies, and tech support teams to commit data theft over the phone. They can also spoof phone numbers to make calls appear to come from a trusted source.

Your bank will never ask you to confirm your full card number, PIN, or password over an unsolicited call. If you receive a call like this, hang up and call your bank directly using the number on the back of your card or on the bank’s official website.

B) Antivirus protects against viruses only, while anti-malware protects against all types of malicious software.

Traditionally, antivirus software focused on well-established threats — viruses, worms, and trojans — while anti-malware was built to catch newer, faster-evolving threats like ransomware, spyware, and adware.

In practice, the line between the two has blurred. Most current antivirus products now cover the full spectrum of malicious software, and many anti-malware tools handle classic virus threats too.

The label matters less than the capability. For up-to-date, broad-spectrum protection, consider a next-gen antivirus solution, which combines scam, phishing, and malware protection in one tool. It goes beyond traditional signature-based detection by using behavioral analysis and machine learning to spot threats it hasn’t seen before, which means it can catch new and evolving malware that slips past older tools.

C) Two-factor authentication (2FA).

The clue is in the riddle: “after you type your password” and “one more way to prove.” That’s the two-factor principle — combining something you know (your password) with something you have (a one-time code, an authentication app approval, a fingerprint, or a hardware key).

A CAPTCHA checks that you’re human, but it doesn’t add a second login factor. A biometric scanner can serve as one type of second factor, but it’s just one method of achieving 2A — not 2FA itself. Single sign-on lets you use one set of credentials across multiple services — useful, but the opposite of adding extra verification layers.

Two-factor authentication is one of the simplest and most effective steps you can take to secure your accounts. Even if your password is exposed in a breach, an attacker can’t log in without that second verification step.

C) It enhances your privacy and security by encrypting your internet traffic.

VPN stands for virtual private network — a tool that encrypts your internet connection and routes your traffic through a secure server, masking your IP address in the process. It doesn’t block all traffic or speed up your connection, and it doesn’t replace antivirus software. The two serve different purposes and work best together.

Beyond privacy, a VPN has practical uses: it protects your data on public Wi-Fi networks, prevents your internet provider from monitoring your activity, and lets you access your paid home subscriptions when you’re temporarily abroad.

C) False — Macs can get malware, though they’ve historically been targeted less than Windows devices.

This is one of the most common cybersecurity myths. Macs have always been capable of getting malware — they were simply targeted less often because Windows had a far larger market share, making Windows a more attractive target for attackers.

Mac adoption has grown significantly in recent years, and Mac-specific threats have grown with it, including spyware, adware, and ransomware designed specifically for macOS. It does include strong built-in security features, such as Gatekeeper and XProtect, but no operating system is immune.

True.

Your data has real monetary value — and a surprisingly specific price tag. Stolen personal information is actively traded on dark web marketplaces, often with detailed price lists.

According to NordVPN’s analysis of how much of your data is on the dark web market, personal email accounts sell for as little as $1. A single stolen credit card costs around $10 on average. Full identity packages — known as “fullz,” which include your name, Social Security number, date of birth, address, and bank details — start at around $37. Hacked social media accounts sell for about $40.

B) Change the password on the breached account and any other account where you used the same password.

When your email appears in a data breach, the most urgent risk is credential reuse — if you used the same password on other accounts, attackers can try it across multiple services in what’s called a credential stuffing attack. Changing the password on the breached account is the first step, but updating every account that shared that password is just as important.

Deleting the account won’t undo the exposure — your data is already out there. After updating your passwords, enable two-factor authentication on every account that supports it. Even if a password is compromised again, an attacker still can’t get in without a second verification step.

C) Updates patch known security vulnerabilities that attackers actively exploit.

When a security flaw is discovered in a piece of software, developers release a patch to fix it. The problem is that attackers learn about the same flaw — often at the same time or shortly after. The window between public disclosure of a vulnerability and the moment you apply the update is when your device is most exposed.

The WannaCry ransomware attack in 2017 is a well-documented case. It encrypted data on hundreds of thousands of systems across 150 countries by exploiting a Windows vulnerability that Microsoft had already patched two months earlier. The systems it hit simply hadn’t been updated. Keeping your software current is one of the lowest-effort, highest-impact steps you can take.

B) F7Rc6TmrKQ^ZbL^@wZNd.

Option B is the strongest because it combines length with complexity — uppercase and lowercase letters, numbers, and special characters — with no recognizable words or patterns for an attacker to predict. Options A and C use common words and are short enough to crack quickly. Option D adds numbers and mixed case but is still short enough to fall to a brute-force attack.

The longer and more random your password is, the harder it becomes to crack through automated tools. If you’re unsure how to create a strong password, the core principle is simple — avoid words, names, and predictable patterns. Since truly random passwords are difficult to remember, use a password manager to generate and store a unique password for every account.

C) Perform a factory reset to wipe the drive completely.

Simply deleting files or logging out of accounts doesn’t remove your data from the device. When you delete a file, it isn’t erased — it’s marked as available space, and anyone with basic data recovery software can restore it. Uninstalling apps leaves behind residual data in system directories. Logging out only ends your active session. Stored credentials and cached data may still be accessible.

A factory reset restores the device to its original, out-of-the-box state. On Windows, choose “Remove everything” and enable drive encryption before resetting to make any residual data unreadable. On a Mac, use “Erase all content and settings” — found in “System preferences” on older macOS versions and in “System settings” on macOS Ventura and later.

C) No, HTTPS only encrypts the connection — it doesn’t verify whether the site itself is trustworthy.

HTTPS means the connection between your browser and the website is encrypted — data you send isn’t intercepted in transit. It doesn’t mean the site is legitimate, safe, or run by who it claims to be. Scammers routinely set up HTTPS-enabled phishing sites because obtaining a basic SSL certificate is free and takes minutes.

Always check the full URL carefully, especially on sites asking for login credentials or payment details. Look for mispellings, unusual domain extensions, or URLs that don’t match the organization they claim to represent. A padlock tells you the connection is private — it doesn’t tell you who’s on the other end.

B) Use your phone’s mobile data instead.

Public Wi-Fi networks are a common target for a technique called a man-in-the-middle attack, where an attacker intercepts the data passing between your device and the network. On an unsecured network, that can include login credentials, session tokens, and any other data you transmit.

A password doesn’t make a network safe — it simply controls who can join, not whether the traffic on it is protected. Logging out after browsing doesn’t eliminate the risk either because your data can be captured while the session is still active.

The safest option is to use your phone’s mobile data. If you need to use public Wi-Fi, connect through a VPN — it encrypts your traffic so intercepted data can’t be read, even on an unsecured network. Read more about the risks of public Wi-Fi before you connect next time.

B) Fake news stories created by AI to spread misinformation.

Synthetic news refers to fabricated news content generated by AI — articles, headlines, images, and even videos that look legitimate but are entirely made up. AI can produce convincing text and realistic-looking media at scale. 

A fabricated story can reach millions of people within hours of being published, and corrections rarely travel as far as the original claim. When you encounter a breaking news story — especially one that triggers a strong emotional reaction — check whether it’s been reported by multiple credible outlets before sharing it.