Unit V Checkpoint: Defend the Devices
Where you are: Unit V — Machines and Networks Under Attack · Checkpoint · About 12 minutes. This checkpoint draws on Chapters 13 to 20 of Dr. Al-Doori's Cyber Security Essentials and Lessons 5.1 to 5.10.
Unit V took you through how devices are attacked (5A), how to protect them (5B) and how to use the web and Wi-Fi safely (5C). This checkpoint puts that knowledge to work in three short situations. For each one, read the scenario, decide what you would do, answer the question, and then compare your reasoning with the model answer. There is no trick: the aim is to practise the calm, ordered decisions this unit teaches.
Scenario 1: A Ransom Note and a Synced Folder
You open your laptop on Saturday morning and find that your documents have strange new file names and won't open. A note on the desktop says your files are encrypted and your data has been copied; you have 72 hours to pay in cryptocurrency. All your documents live in a folder that syncs automatically to a cloud storage service. You also own an external backup drive, which you last used two weeks ago and which is in a drawer.
What is the best first set of actions?
Model answer
c is right. The FBI does not support paying a ransom, and payment guarantees nothing. Taking the laptop offline (turning off Wi-Fi or unplugging the network cable) stops it syncing more encrypted files to the cloud: sync is not a backup, and encrypted files can sync over good cloud copies (Lesson 5.5). Your external drive is your best hope because it was disconnected; keep it unplugged until the laptop has been cleaned or reset. Photograph the note, report the attack (IC3 in the US, or your national reporting service), and check No More Ransom for a free decryptor (Lesson 5.2).
Then restore from the backup drive, accepting that you may lose two weeks of work. Finally, remember double extortion: the note says data was copied, so change passwords for accounts used on that laptop and watch for follow-up scams. Your backup restores your files, but not your privacy.
Why not the others? Paying (a) is not supported by the FBI, guarantees nothing and does not undo any data theft. Carrying on as normal (b) assumes the cloud copies are safe, when sync may already be overwriting them with encrypted versions. Deleting the cloud folder (d) could destroy good copies you might still recover; take the laptop offline instead and check what survived later, from a clean device.
Scenario 2: "Verify You Are Human"
You are looking for a free tool to convert a video for a class project. A site that looks professional shows a box: "Verify you are human. Press Windows + R, paste the code we copied for you, and press Enter." The download button will only appear after you verify.
What do you do?
Model answer
b is right. This is the "paste this command" trick that Microsoft calls ClickFix, which ENISA described as prevalent in 2025 (Lessons 3.3 and 5.3). No real website needs you to open a system tool and paste a command. If you ran it, you would be installing the malware yourself, often an infostealer that copies saved passwords and login cookies (Lesson 5.1). The habit that closes this door is simple: get software from the source, and never let a web page tell you to install, call or paste anything.
If you had already pressed Enter, the next steps would be to disconnect, run a full scan with your built-in protection, and follow Lesson 6.1: change important passwords from a clean device and sign out of all sessions, because stolen login cookies can work even after a password change (Lesson 5.8).
Why not the others? Real CAPTCHA checks (a) ask you to tick a box or pick pictures inside the page, never to run something on your computer. Pasting without pressing Enter (c) leaves you one keystroke from infection and means you are still following the attacker's script. Scanning afterwards (d) comes too late: the command has already run, and no scan catches everything.
Scenario 3: Two Networks, One Name
You are in a café and need to pay a bill through online banking before a deadline. Your laptop shows two networks with exactly the same name, "BeanHouse_Guest": one open, one asking for a password. The café's sign does not say which is real. Your phone has mobile data.
What is the best choice for this banking task?
Model answer
d is right. Two networks with the same name are a classic sign that one may be an evil twin, a fake network copying a real name (Lesson 5.9). Widespread HTTPS encryption has greatly reduced the classic public-Wi-Fi sniffing risk, so everyday browsing would usually be fine. But for a sensitive task like banking, the NCSC advises using mobile data or a trusted VPN, and you have mobile data in your pocket. It removes the question of which network is real.
If you did use the café Wi-Fi later for everyday browsing, you could ask staff for the exact network name, turn off auto-join for it, never give a sign-in page your email password or card details, and never click past a certificate warning (Lesson 5.7).
Why not the others? Devices tend to prefer a strong signal (a), which is exactly what an evil twin exploits. A password (b) only proves that whoever set up the network chose one; an attacker can set a password too, even one copied from a sign on the café wall. HTTPS (c) protects your connection to the bank, but it cannot stop a fake sign-in page from asking you to type your details, and "nothing can go wrong" is never a safe assumption.
Before You Move On
If any of these felt uncertain, revisit the lesson named in the model answer. The three habits behind all of them are the core of Unit V: keep an offline backup and don't pay, never let a web page tell you to install or paste anything, and move sensitive tasks to a connection you trust. Next, Unit VI turns to what happens after an attack: evidence and investigation.