First name

Score

Result label

Recommendation

AI recommendation

Where Am I in Cybersecurity?

Reply to the email and ask the sender to confirm the change.

Contact the supplier using a phone number already held in your records.

Call the new phone number included in the email’s signature.

Accept the change if the bank details appear on supplier-branded stationery.

You receive a convincing email from a supplier saying its payment details have changed. The sender’s display name is familiar. What is the safest next step?

It prevents the attacker from submitting that password on the sign-in page.

It guarantees access is blocked, even if the employee approves the attacker’s prompt.

It automatically resets the stolen password before the attacker can use it.

It requires another authentication check, although some MFA methods can still be bypassed.

An attacker obtains an employee’s password. How can multifactor authentication (MFA) help protect the account?

The identity provider’s sign-in logs for the account and time period

The organization’s DNS logs showing domains requested during that period

The endpoint software inventory showing applications installed on the user’s laptop

The email gateway logs showing messages delivered to the user’s mailbox

An alert reports a successful sign-in from an unfamiliar location. You want to check the time, source IP, and device information for that sign-in. Which source is most useful first?

A password-guessing attack succeeded and the account is confirmed compromised.

The legitimate user mistyped their password and eventually remembered it.

Both legitimate activity and an attack remain possible; more context is needed.

The successful sign-in means the earlier failures can be closed as harmless.

You see several failed sign-ins followed by one successful sign-in to the same account. Which conclusion is best supported by that sequence alone?

Add every reported indicator to a permanent blocklist without further review.

Check whether the techniques affect your environment and identify relevant defensive actions.

Rank the report’s importance mainly by how many organizations shared it online.

Copy its technical findings into a briefing without assessing their local relevance.

A report describes attacks against organizations in your industry. Which follow-up would make it most useful to your security team?

Treat it as an unverified claim from one underlying source and seek corroboration.

Treat the two websites as independent confirmation that the breach occurred.

Reject the claim as false because the original source did not identify themselves.

Treat it as confirmed if both websites repeat the same technical details.

Two websites report the same alleged breach, but both cite one anonymous social media post. How should you treat this information?

Search existing alerts for the report title and count how often it appears.

List all scheduled tasks and classify every unfamiliar name as malicious.

Block the reported file hashes and wait for the security tools to alert.

Test whether unusual task creation follows suspicious script execution on your endpoints.

A threat report says attackers create scheduled tasks to maintain access. Which action best turns that information into a threat hunt?

Disable it until a real incident demonstrates whether the alerts are useful.

Exclude all activity by the IT team to remove the known false positive.

Examine what distinguishes the maintenance activity, refine the rule, and retest both cases.

Keep it unchanged because detecting the test attack is sufficient validation.

A new detection correctly catches a test attack but also alerts on a routine IT maintenance script. What is the best next step?

Check the underlying events and reliable sources before accepting the attribution.

Accept the attribution because two assistants independently reached the same conclusion.

Ask both assistants for confidence percentages and use the higher-scoring answer.

Include the attribution in the incident report as fact, noting that AI generated it.

An AI assistant attributes an alert to a known threat actor. A second assistant agrees, but neither provides verifiable evidence. What should you do?

Whether removing customer names alone makes the entire report safe to upload

Whether this tool and use are permitted for that data, and what information is necessary

Whether a private browser window prevents the tool from retaining the report

Whether the tool agrees to delete the report when asked in the prompt

Your organization allows an approved AI tool for some work. You want it to summarize an incident report containing customer data. What should you check first?

Where Am I in Cybersecurity?

First name

Email address