Cyber Awareness Knowledge Check
95 Answered Questions — All Correct
Complete Study Guide — 95-Question Comprehensive Exam
Aligned with DoD/Agency Annual Cyber Awareness Training Standards · 7 Domains
Instructions. This 95-question knowledge check covers the full cyber awareness curriculum across 7 domains: (1) Cyber
Threat Landscape and Threat Actors; (2) Password Security and Authentication; (3) Data Protection and Privacy; (4) Safe
Browsing, Email, and Social Media; (5) Mobile, Remote Work, and Network Security; (6) Incident Reporting, Insider
Threats, and Physical Security; and (7) Compliance, Policies, and Emerging Threats. Each question is followed by the
correct answer and a detailed rationale with cybersecurity-specific reasoning aligned with organizational policy and DoD
Cyber Awareness Challenge content. Cognitive levels are approximately 30% recall, 55% application, and 15% analysis,
with 70% scenario-based items and 30% direct recall. Many questions use 'What should you do FIRST?' and 'What is the
appropriate action?' formats to reflect real-world incident response.
Section 1 — Cyber Threat Landscape and Threat Actors (Malware, Ransomware, Phishing, &
Social Engineering)
Questions 1–16 cover malware types, ransomware, phishing variants, social engineering, and BEC/CEO fraud. Aligned with DoD
Cyber Awareness Challenge Domain 1.
Q1: You receive an email that appears to be from your organization's IT helpdesk requesting that you click a link
to reset your password within 24 hours or your account will be locked. The sender address shows
''. What is the MOST appropriate FIRST action?
A. Click the link to verify whether the request is legitimate.
B. Reply to the sender asking them to confirm their identity.
C. Do not click the link; report the email using your organization's phishing reporting mechanism and verify
through an independent channel. [CORRECT]
D. Forward the email to all coworkers to warn them.
Correct Answer: C. Do not click the link; report the email using your organization's phishing reporting mechanism
and verify through an independent channel.
Rationale: The email exhibits classic phishing indicators: urgency, a suspicious look-alike domain, and a call to click a
link. The correct first action is to avoid clicking, report via the approved channel, and verify through an independent
channel (e.g., calling the helpdesk directly). Replying or forwarding spreads risk; clicking executes the attack. Urgency +
domain mismatch = phishing.
,Q2: Which type of malware self-replicates and spreads across networks without user interaction, often causing
widespread disruption?
A. Trojan
B. Virus (requires a host file)
C. Worm, which propagates autonomously across networks [CORRECT]
D. Adware
Correct Answer: C. Worm, which propagates autonomously across networks
Rationale: A worm self-replicates and spreads across networks without user action or a host file. Viruses require a host
file and user action; trojans disguise themselves as legitimate software; adware displays unwanted ads. Worms'
autonomous propagation makes them particularly dangerous on connected networks.
Q3: A user notices that files on their workstation have been encrypted and a ransom note demands
cryptocurrency payment within 72 hours for decryption. Which type of malware is this, and what is the
recommended response?
A. Adware; pay the ransom to restore access quickly.
B. Ransomware; do not pay the ransom, disconnect the device from the network, report the incident
immediately to the security team, and follow organizational incident response procedures. [CORRECT]
C. Spyware; delete the files to remove the infection.
D. Virus; reboot the computer to remove the encryption.
Correct Answer: B. Ransomware; do not pay the ransom, disconnect the device from the network, report the
incident immediately to the security team, and follow organizational incident response procedures.
Rationale: File encryption with a ransom demand is ransomware. Best practice is to NOT pay (no guarantee of decryption
and funds future attacks), disconnect from the network to prevent spread, and report immediately to follow organizational
incident response. Paying, deleting, or rebooting does not resolve the encryption and may destroy evidence.
Q4: An attacker sends a targeted email to your organization's CFO, posing as a known vendor and requesting an
urgent wire transfer to a 'new' bank account. The email is well-researched and uses the vendor's logo and
addressing style. Which attack is this?
A. Mass phishing (spray-and-pray)
B. Spear phishing, a targeted attack using specific recipient and vendor details [CORRECT]
C. Vishing (voice phishing)
D. Smishing (SMS phishing)
Correct Answer: B. Spear phishing, a targeted attack using specific recipient and vendor details
Rationale: Spear phishing targets specific individuals using researched details (vendor name, role, logos) for credibility.
Mass phishing is broad and untargeted; vishing is by phone; smishing is by text. Targeting the CFO with vendor
impersonation is also a form of Business Email Compromise (BEC).
, Q5: You receive a phone call from someone claiming to be from Microsoft support, stating that your computer is
sending error reports and they need remote access to fix it. What is the appropriate response?
A. Grant remote access to resolve the issue quickly.
B. Provide your password so they can verify your identity.
C. Hang up; legitimate vendors do not make unsolicited support calls, and this is a tech-support scam/social
engineering attack. Report the call if your organization requires it. [CORRECT]
D. Ask the caller for their employee ID and then grant access.
Correct Answer: C. Hang up; legitimate vendors do not make unsolicited support calls, and this is a tech-support
scam/social engineering attack. Report the call if your organization requires it.
Rationale: Unsolicited tech-support calls claiming errors or infections are classic social engineering. Microsoft and other
vendors do not make unsolicited support calls. Hang up and report per organizational policy. Granting remote access or
sharing credentials gives attackers control of the device.
Q6: Which type of phishing uses SMS text messages to trick users into clicking malicious links or revealing
information?
A. Vishing
B. Smishing (SMS phishing) [CORRECT]
C. Spear phishing
D. Whaling
Correct Answer: B. Smishing (SMS phishing)
Rationale: Smishing uses SMS/text messages to deliver phishing lures. Vishing uses voice calls; spear phishing is
targeted email; whaling targets high-ranking executives. SMS lures often exploit urgency (e.g., 'package delivery',
'account suspended').
Q7: An attacker impersonates the CEO and emails the payroll department requesting urgent changes to direct
deposit information for several employees. The email header shows a slightly altered domain. What type of
attack is this, and what is the best defense?
A. Standard phishing; rely on spam filters only.
B. Business Email Compromise (BEC)/CEO fraud; verify out-of-band by phone with a known number,
enforce policy for financial change requests, and require secondary approval. [CORRECT]
C. Vishing; block the caller's number.
D. Malware infection; run an antivirus scan.
Correct Answer: B. Business Email Compromise (BEC)/CEO fraud; verify out-of-band by phone with a known
number, enforce policy for financial change requests, and require secondary approval.
Rationale: BEC/CEO fraud uses executive impersonation (often with look-alike domains) to trick finance/payroll into
wire or direct-deposit changes. Defense requires out-of-band verification with known numbers, enforced financial policy
with secondary approval, and staff training. Spam filters alone are insufficient because BEC emails often lack malware or
obvious malicious links.
95 Answered Questions — All Correct
Complete Study Guide — 95-Question Comprehensive Exam
Aligned with DoD/Agency Annual Cyber Awareness Training Standards · 7 Domains
Instructions. This 95-question knowledge check covers the full cyber awareness curriculum across 7 domains: (1) Cyber
Threat Landscape and Threat Actors; (2) Password Security and Authentication; (3) Data Protection and Privacy; (4) Safe
Browsing, Email, and Social Media; (5) Mobile, Remote Work, and Network Security; (6) Incident Reporting, Insider
Threats, and Physical Security; and (7) Compliance, Policies, and Emerging Threats. Each question is followed by the
correct answer and a detailed rationale with cybersecurity-specific reasoning aligned with organizational policy and DoD
Cyber Awareness Challenge content. Cognitive levels are approximately 30% recall, 55% application, and 15% analysis,
with 70% scenario-based items and 30% direct recall. Many questions use 'What should you do FIRST?' and 'What is the
appropriate action?' formats to reflect real-world incident response.
Section 1 — Cyber Threat Landscape and Threat Actors (Malware, Ransomware, Phishing, &
Social Engineering)
Questions 1–16 cover malware types, ransomware, phishing variants, social engineering, and BEC/CEO fraud. Aligned with DoD
Cyber Awareness Challenge Domain 1.
Q1: You receive an email that appears to be from your organization's IT helpdesk requesting that you click a link
to reset your password within 24 hours or your account will be locked. The sender address shows
''. What is the MOST appropriate FIRST action?
A. Click the link to verify whether the request is legitimate.
B. Reply to the sender asking them to confirm their identity.
C. Do not click the link; report the email using your organization's phishing reporting mechanism and verify
through an independent channel. [CORRECT]
D. Forward the email to all coworkers to warn them.
Correct Answer: C. Do not click the link; report the email using your organization's phishing reporting mechanism
and verify through an independent channel.
Rationale: The email exhibits classic phishing indicators: urgency, a suspicious look-alike domain, and a call to click a
link. The correct first action is to avoid clicking, report via the approved channel, and verify through an independent
channel (e.g., calling the helpdesk directly). Replying or forwarding spreads risk; clicking executes the attack. Urgency +
domain mismatch = phishing.
,Q2: Which type of malware self-replicates and spreads across networks without user interaction, often causing
widespread disruption?
A. Trojan
B. Virus (requires a host file)
C. Worm, which propagates autonomously across networks [CORRECT]
D. Adware
Correct Answer: C. Worm, which propagates autonomously across networks
Rationale: A worm self-replicates and spreads across networks without user action or a host file. Viruses require a host
file and user action; trojans disguise themselves as legitimate software; adware displays unwanted ads. Worms'
autonomous propagation makes them particularly dangerous on connected networks.
Q3: A user notices that files on their workstation have been encrypted and a ransom note demands
cryptocurrency payment within 72 hours for decryption. Which type of malware is this, and what is the
recommended response?
A. Adware; pay the ransom to restore access quickly.
B. Ransomware; do not pay the ransom, disconnect the device from the network, report the incident
immediately to the security team, and follow organizational incident response procedures. [CORRECT]
C. Spyware; delete the files to remove the infection.
D. Virus; reboot the computer to remove the encryption.
Correct Answer: B. Ransomware; do not pay the ransom, disconnect the device from the network, report the
incident immediately to the security team, and follow organizational incident response procedures.
Rationale: File encryption with a ransom demand is ransomware. Best practice is to NOT pay (no guarantee of decryption
and funds future attacks), disconnect from the network to prevent spread, and report immediately to follow organizational
incident response. Paying, deleting, or rebooting does not resolve the encryption and may destroy evidence.
Q4: An attacker sends a targeted email to your organization's CFO, posing as a known vendor and requesting an
urgent wire transfer to a 'new' bank account. The email is well-researched and uses the vendor's logo and
addressing style. Which attack is this?
A. Mass phishing (spray-and-pray)
B. Spear phishing, a targeted attack using specific recipient and vendor details [CORRECT]
C. Vishing (voice phishing)
D. Smishing (SMS phishing)
Correct Answer: B. Spear phishing, a targeted attack using specific recipient and vendor details
Rationale: Spear phishing targets specific individuals using researched details (vendor name, role, logos) for credibility.
Mass phishing is broad and untargeted; vishing is by phone; smishing is by text. Targeting the CFO with vendor
impersonation is also a form of Business Email Compromise (BEC).
, Q5: You receive a phone call from someone claiming to be from Microsoft support, stating that your computer is
sending error reports and they need remote access to fix it. What is the appropriate response?
A. Grant remote access to resolve the issue quickly.
B. Provide your password so they can verify your identity.
C. Hang up; legitimate vendors do not make unsolicited support calls, and this is a tech-support scam/social
engineering attack. Report the call if your organization requires it. [CORRECT]
D. Ask the caller for their employee ID and then grant access.
Correct Answer: C. Hang up; legitimate vendors do not make unsolicited support calls, and this is a tech-support
scam/social engineering attack. Report the call if your organization requires it.
Rationale: Unsolicited tech-support calls claiming errors or infections are classic social engineering. Microsoft and other
vendors do not make unsolicited support calls. Hang up and report per organizational policy. Granting remote access or
sharing credentials gives attackers control of the device.
Q6: Which type of phishing uses SMS text messages to trick users into clicking malicious links or revealing
information?
A. Vishing
B. Smishing (SMS phishing) [CORRECT]
C. Spear phishing
D. Whaling
Correct Answer: B. Smishing (SMS phishing)
Rationale: Smishing uses SMS/text messages to deliver phishing lures. Vishing uses voice calls; spear phishing is
targeted email; whaling targets high-ranking executives. SMS lures often exploit urgency (e.g., 'package delivery',
'account suspended').
Q7: An attacker impersonates the CEO and emails the payroll department requesting urgent changes to direct
deposit information for several employees. The email header shows a slightly altered domain. What type of
attack is this, and what is the best defense?
A. Standard phishing; rely on spam filters only.
B. Business Email Compromise (BEC)/CEO fraud; verify out-of-band by phone with a known number,
enforce policy for financial change requests, and require secondary approval. [CORRECT]
C. Vishing; block the caller's number.
D. Malware infection; run an antivirus scan.
Correct Answer: B. Business Email Compromise (BEC)/CEO fraud; verify out-of-band by phone with a known
number, enforce policy for financial change requests, and require secondary approval.
Rationale: BEC/CEO fraud uses executive impersonation (often with look-alike domains) to trick finance/payroll into
wire or direct-deposit changes. Defense requires out-of-band verification with known numbers, enforced financial policy
with secondary approval, and staff training. Spam filters alone are insufficient because BEC emails often lack malware or
obvious malicious links.
