Final Assessment: 20 Questions

Where you are: Capstone · 7.3 · Final Assessment · About 25 minutes. The questions cover the whole course, from Dr. Al-Doori's Cyber Security Essentials to the 2026 updates.

Answers explained

• Question 1 — c is right. Attackers go where people are, and Microsoft has reported infostealer malware aimed at macOS, so Macs and phones are targeted too. Malware is not Windows-only (a), public Wi-Fi is not the main risk (b), and most attacks are not aimed at famous people (d). Revisit Lesson 1.1.
• Question 2 — a is right. This is credential stuffing: leaked email-and-password pairs are tried on other sites, so reuse links one breach to another account. Shop staff (b) and a simultaneous provider breach (c) are far less likely, and a breach exposes only the data that leaked (d). Revisit Lesson 4.2.
• Question 3 — d is right. The real domain is read from the right: login.northbank.example ends in northbank.example. In a and c the real domain is secure-login.example and example-verify.example; b is a different domain that only looks similar. Revisit Lesson 2.3.
• Question 4 — b is right. HTTPS encrypts the connection; it does not prove who runs the site, and nearly all phishing sites now use HTTPS. Banks do not "approve" pages this way (a), so it is not proof of safety (c) or of a genuine site (d). Revisit Lesson 5.7.
• Question 5 — c is right. SPF, DKIM and DMARC confirm a message was sent with the domain owner's permission — but a scammer can own a look-alike domain. Passing checks is not proof of honesty (a), says nothing about malware (b), and the checks did not fail (d). Revisit Lessons 2.2 and 3.2.
• Question 6 — a is right. A passkey is phishing-resistant and is the NCSC's first choice wherever offered; app codes make a sensible backup. SMS is the weakest tier (b), approving whatever arrives invites MFA fatigue (c), and a password alone can be phished or reused (d). Revisit Lessons 4.5 and 4.6.
• Question 7 — d is right. A prompt you did not start usually means someone has your password; deny it and change the password. Approving gives the attacker access (a, c), and ignoring it leaves your password in their hands (b). Revisit Lesson 4.5.
• Question 8 — b is right. NIST guidance says services should not force periodic changes; change a password when there is evidence of compromise. More frequent changes (a) and predictable tweaks (d) lead to weaker passwords, and reuse (c) fuels credential stuffing. Revisit Lessons 4.3 and 4.4.
• Question 9 — c is right. Current guidance focuses on strong encryption, a changed admin password, firmware updates and turning off WPS. Hidden names and address filtering are not real security controls (a), switching off the router does not fix its settings (b), and an open network removes protection (d). Revisit Lesson 5.10.
• Question 10 — a is right. A network name proves nothing about who runs it, so a same-name network may be a fake hotspot; mobile data avoids the question. Signal strength (b) and matching names (c) prove nothing, and joining both (d) doubles the risk. Revisit Lessons 2.4 and 5.9.
• Question 11 — b is right. Grant only the permissions an app needs; a torch app has no reason to use your microphone or contacts. Good reviews (a) can be faked, contacts are exactly the data at risk (c), and restarting (d) changes nothing. Revisit Lesson 5.6.
• Question 12 — d is right. Urgency plus a link is a classic smishing pattern; contact the bank through a channel you trust. Tapping (a) leads to a fake page, replying (b) confirms your number is active, and forwarding (c) spreads the link. Revisit Lessons 3.1 and 3.3.
• Question 13 — a is right. The FBI warns that criminals use AI to clone voices; verify by calling back on a known number or asking for a family code word. A familiar voice is no longer proof (b), photos can be faked too (c), and partial payment (d) is still payment to a possible scammer. Revisit Lesson 3.4.
• Question 14 — c is right. Payment-change requests are the heart of business email compromise, which can come from a real but hacked account; confirm by phone on a known number. The genuine address proves nothing (a), replying may reach the attacker (b), and paying both (d) sends money to the criminal. Revisit Lesson 3.2.
• Question 15 — b is right. A disconnected copy is out of ransomware's reach. Sync copies the damage to the cloud (a), the recycle bin (c) and a copy on the same laptop (d) are encrypted along with everything else. Revisit Lessons 5.2 and 5.5.
• Question 16 — d is right. Microsoft ended Windows 10 support in October 2025, so new security flaws stay open. Antivirus does not replace updates (a), avoiding email does not close the other routes in (b), and the risk applies to everyone (c). Revisit Lesson 5.4.
• Question 17 — b is right. A new password does not end the attacker's sessions or undo the forwarding rules and recovery details they changed. Stopping there (a) leaves those doors open, deleting the account (c) loses evidence and history, and public posting (d) exposes private information. Revisit Lesson 6.1.
• Question 18 — a is right. Breach notices are a favourite phishing disguise, so check by going to the service yourself, then change the password everywhere it was reused. Clicking (b) risks a fake page, ignoring it (c) leaves reused passwords exposed, and no genuine service asks for your password (d). Revisit Lesson 6.2.
• Question 19 — d is right. A matching hash proves the data has not changed since it was hashed — nothing about guilt (a), lawful collection (b) or what happened before seizure (c). Revisit Lesson 6.4.
• Question 20 — c is right. An IP address is a connection, often shared, not a person; a café's address is used by many people and header lines can be faked. Naming staff (a) or the owner (b) could harm innocent people, and the header is still a useful lead to keep and report (d). Revisit Lesson 6.5.