Staying Secure Online

Learn how to protect your accounts, devices and data. You will see what attackers want and why everyone is a target, judge security problems with confidentiality, integrity and availability, build long passphrases and keep every password unique, and add a second factor to important accounts. You will learn to spot phishing and other tricks, tell viruses, worms, Trojans, ransomware and spyware apart, and know what to do after a mistake. Finally, you will keep devices safe with updates, security software, firewalls and backups that survive ransomware, and stay secure on public Wi-Fi and shared computers.

What you will learn

1Explain why online security matters
Describe what attackers want from accounts, devices and data, and use confidentiality, integrity and availability to explain what goes wrong when security fails.
- Explain what attackers want and why everyone is a target
  Name what cybercriminals are after, why ordinary people are targets, and the basic words used to talk about security risks.
- Use confidentiality, integrity and availability to judge a security problem
  Explain the three goals of information security, identify which one failed in a situation, and match protections to each goal.
2Protect accounts with strong passwords and multi-factor authentication
Explain how attackers guess or steal passwords, create long and unique passphrases, store them safely, and add a second factor to important accounts.
- Explain how passwords are cracked and what makes one strong
  Describe the main ways passwords are guessed or stolen, calculate how length changes the number of possible passwords, and judge whether a password is strong.
- Create passphrases and keep every password unique
  Build long passphrases from random words, explain why reusing passwords is dangerous, and keep passwords safe with a password manager.
- Add a second factor with multi-factor authentication
  Explain the three types of authentication factor, compare passwords with fingerprints and face recognition, and use multi-factor authentication safely.
3Recognize and respond to phishing and social engineering
Identify the tricks used to manipulate people, check messages, links and websites for warning signs, and respond safely when something looks wrong or after a mistake.
- Explain how social engineering manipulates people
  Describe the pressure tactics and common techniques of social engineering, from fake helpers to shoulder surfing, and the habits that defeat them.
- Spot the warning signs in phishing messages and fake websites
  Check emails, texts, calls, links and web pages for the signs of phishing, read a web address to find its real domain, and explain what the padlock does and does not prove.
- Respond safely to suspicious messages and mistakes
  Check and report suspicious messages, and take the right steps quickly after clicking a link, entering a password or giving away payment details.
4Identify malware and how it gets onto devices
Tell the main types of malicious software apart by how they spread and what they do, and recognize the routes and signs of an infection.
- Tell the main types of malware apart
  Describe viruses, worms, Trojans, ransomware, spyware, keyloggers, adware and bots, and classify malware by how it spreads and what it does.
- Explain how malware gets in and spot the signs of infection
  Name the usual routes malware takes onto devices, recognize the warning signs of an infection, and know what to do if a device is infected.
5Keep devices and data safe with updates, protection and backups
Explain why updates matter, use security software and firewalls sensibly, plan backups that survive loss and ransomware, and stay secure on public networks and shared devices.
- Explain why updates matter and install them safely
  Explain how software flaws become attacks, why security updates should be installed promptly, and how to tell a real update from a fake one.
- Use antivirus software and firewalls to block threats
  Explain how anti-malware software detects threats, what a firewall does, why the two are used together, and what neither can do.
- Plan backups that survive loss, damage and ransomware
  Explain what a backup is, apply the 3-2-1 rule, choose how often to back up, and protect backups from ransomware and loss.
- Stay secure on public Wi-Fi and shared devices
  Use public and home Wi-Fi safely, protect devices and accounts on shared computers, secure lost or unattended devices, and think before sharing information.

Online Security study guide

5 chapters

Understand what security protects

Your accounts hold more than passwords. They hold messages, photos, schoolwork, and ways to reach other people. Attackers can profit from any of these. Learning what they want helps you spot weak points. You will also learn three questions that show exactly how an incident harms data and the people who use it.

1.1 Why ordinary accounts attract attackers

Cybersecurity protects devices, accounts, networks, and data from misuse. Personal data includes information linked to you, such as your name, school, photos, birthday, and location.

What attackers gain

A stolen game account may contain valuable items or saved payment details. An attacker can sell it or message your friends with scams. Private data can be sold or used for identity theft: pretending to be someone else using their information. Attackers also want money, control of devices, attention, or the chance to disrupt services.

You need not be famous to become a target. Programs can send scam messages to millions of people. They can try leaked passwords on huge numbers of accounts. The attacker may know nothing about you until a trick works.

Small pieces of information can help. A birthday in a post and a pet's name in a photo caption may reveal a security-question answer. Someone can combine public details to make a fake message sound personal.

Describe the danger clearly

Four words help explain a security problem:

Word	Meaning	Example
Threat	Something that could cause harm	Criminals trying leaked passwords
Vulnerability	A weakness they can use	One password shared across accounts
Attack	An actual attempt to cause harm	Trying a leaked password on your email
Risk	The likelihood of success and size of the harm	Losing email could expose many other accounts

Suppose a club uses an old app with a known flaw. The flaw is the vulnerability. Someone using it to enter the club's system is making an attack. Risk is greater when an attack is likely or the club could lose important records.

Permission matters

Hacking means finding and using weaknesses to get into systems or accounts. Ethical hackers have the owner's permission to test agreed parts of a system. They report weaknesses so they can be fixed. Criminal hackers break in without permission.

Knowing a classmate's password gives you the ability to sign in, but not permission. Unauthorized access is a crime in the US, the UK, and many other countries, even when someone says they were only looking.

Some attacks exploit software. Others trick people into giving access. Many use both. Good security therefore combines tools with careful habits. The harm can include stolen money, exposed photos, locked homework, stress, and damage to trust. A school attack can also stop lessons and block access to records.

Key Takeaways

Attackers can profit from ordinary accounts and devices.
Personal details can support identity theft and convincing scams.
A vulnerability is a weakness; an attack is an attempt to use it.
Risk depends on both likelihood and harm.
Testing a system requires the owner’s permission.

1.2 Check who saw, changed, or lost access to data

Security has three linked goals: confidentiality, integrity, and availability. Their initials form the CIA triad. It gives you a way to describe damage clearly.

Three different questions

Goal	What it protects	A failure
Confidentiality	Only people with permission can see data	A private message is leaked
Integrity	Data stays accurate and complete; changes need permission	A score is edited without permission
Availability	People with permission can use data and systems when needed	A locked file cannot be opened

Integrity can fail by accident, too. Saving the wrong number over a correct one can damage a record. Availability can fail without theft. Losing the only device containing your project can leave the project unreachable.

Work through an incident in order. Ask who saw the data. Then ask what changed. Finally, ask whether people could use it. Check all three, because an incident can harm several goals.

Work through a ransomware incident

An attacker copies a family's photos, then encrypts the originals. Encryption scrambles data so someone needs the right key to read it. The attacker demands money to unlock the files and threatens to publish the copied photos.

The copied photos went to someone without permission. Confidentiality failed.
The original files were changed without permission. Integrity failed.
The family cannot open the originals. Availability failed.

A clean backup can help the family regain usable photos. It cannot take back the attacker's copies. That is why recovering files and dealing with a data leak are different jobs.

Match a protection to a need

Passwords, multi-factor authentication, privacy settings, and encryption help control who can read data. Edit permissions limit who can change it. Version history can help recover an earlier correct version. Backups and spare devices help keep work available. Updates can prevent attacks that would disrupt a system.

A website can also lose availability during a denial-of-service attack. Huge amounts of unwanted traffic stop real visitors from reaching it. The data need not be stolen for this to be serious.

Security choices affect convenience. An extra sign-in step takes time, but protects important accounts. Start with the accounts that control money, private files, or password resets. Settings should protect those accounts while still letting their owner get in.

Key Takeaways

Confidentiality controls who can see data.
Integrity protects accurate, complete data and authorized changes.
Availability means usable data and systems when needed.
Check all three goals for each incident.
Backups restore usable copies; they cannot undo a leak.
Match protections to the kind of harm they prevent.

Try chapter 1:Walkthrough 6 Practice Questions 13 Flashcards

Build stronger account protection

A username names an account; authentication checks who is signing in. Passwords can fail through guessing, theft, or reuse. You will see why length and random choices help, how a password manager keeps accounts separate, and how another factor blocks many stolen-password attacks. Email needs particular care because it receives password-reset links.

2.1 How length and guessing affect passwords

Authentication checks that you are who you claim to be. A username identifies the account. A password is a secret used to prove control of it.

How attackers get passwords

Guessing uses clues such as birthdays or names. A dictionary attack tries common passwords, words, and patterns. It includes predictable swaps such as "P@ssw0rd". A brute-force attack tries every possible combination. Credential stuffing tries leaked username-and-password pairs on other services.

A password can also be stolen through a fake sign-in page, someone watching your typing, or malware. Password strength helps against guessing. A stolen password is already known.

Count the possible choices

With the same choices in each position, multiply that number once for every position. A power is a short way to write repeated multiplication. Four PIN digits, each chosen from 0 through 9, give:

10^{4} = 10 \times 10 \times 10 \times 10 = 10,000

For lowercase letters, there are 26 choices in each position:

Length	Possible strings
8 letters	$26^{8} = 208,827,064,576$
12 letters	$26^{12} = 95,428,956,661,682,176$

Every extra letter multiplies the count by 26. Four extra letters multiply it by 456,976.

Suppose a computer tests one billion guesses each second. Trying the entire 8-letter space takes about 209 seconds, under four minutes. Trying the entire 12-letter space takes about 95 million seconds, around three years. These are times to try all possibilities at that stated speed, not promises about a real account.

Randomness changes what the count means

The counts include every possible string, even weak ones. They describe guessing difficulty when choices are independent and random. People often choose a capitalized word, a year, then a symbol. Attackers try such patterns early. "Summer2025!" has mixed character types, but follows a familiar pattern.

A strong password is long, unpredictable, and unique to one account. NIST, a US standards agency, requires services following its guidance to use a minimum of 15 characters for password-only sign-in. With another factor, the minimum is 8. Its guidance rejects forced character mixtures and routine password changes without evidence of exposure. Meet a site's rules, but build strength through length and unpredictability.

Online and stolen-database guessing differ

A login page can limit attempts. Three distinct guesses at a uniformly random 4-digit PIN cover three of 10,000 possibilities:

3 \div 10,000 = 0.03 %

A stolen password database lets attackers test guesses offline, without the site's attempt limit. The speed depends on how passwords were stored and the attacker's equipment.

Changing "Tiger1" to "Tiger2" is predictable after a leak. Make a fresh password when one is exposed. Protect email especially well: its reset links can open the way to many other accounts.

Key Takeaways

Length multiplies the number of possible passwords.
Random choices prevent attackers from trying likely patterns first.
Dictionary attacks try common words and predictable changes.
Offline guessing bypasses a login page’s attempt limit.
Use long, unpredictable, unique passwords.
Change exposed passwords and protect email especially well.

2.2 Use random passphrases and unique passwords

A passphrase is a password made from several words. Random words are easier to remember than a long random character string. A famous quotation or song lyric is predictable, so it is a poor substitute.

Choose words randomly

People tend to choose related words. Dice can choose without following a theme. One method uses a published list containing 7,776 words. Roll five dice, read their results in a fixed order, and find that entry. Repeat the whole process for each word.

Five dice provide this many possible results:

6^{5} = 7,776

Each independently chosen word multiplies the phrase count by 7,776. Four words give:

{7,776}^{4} = 3,656,158,440,062,976

That is about 3.7 quadrillion choices. Eight random characters from 94 keyboard characters give about 6.1 quadrillion. Four random words therefore give about 60% as many possibilities. Five words give about 28 quintillion, roughly 4,700 times as many as those eight characters. Longer random phrases make guessing harder. Some security agencies recommend at least three random words for everyday use; the dice method can use more.

Keep accounts separate

Imagine a small game site leaks its password list. Attackers try the leaked pairs on email, shopping, and social accounts. This is credential stuffing. A long password reused everywhere leaves all those accounts exposed.

A unique password limits that route into other accounts. Adding the site name to one shared base phrase is predictable once an attacker sees a version.

A password manager stores passwords in an encrypted vault. It can make long random passwords and fill them in. Protect its master password with a strong passphrase, and turn on MFA. Managers usually match saved passwords to a site's domain. Missing autofill can be a warning to check the address.

Store secrets and recovery details safely

Keep passwords private. Family rules may include sharing with a parent or guardian. A note stuck to a screen is exposed to anyone nearby. A private paper record stored safely at home can be safer than reusing one password.

Security questions are weak when answers are public. A pet's real name may appear online. Store an invented answer in your manager as another secret.

After a breach, change the affected password and every reused copy. Enable MFA, sign out other sessions, and check recovery details. Changing the password while leaving an attacker's recovery address in place can let them return.

Key Takeaways

Random word selection makes passphrases unpredictable.
A leaked password stays dangerous however long it is.
A unique password for each account limits credential stuffing.
Protect a password manager with a strong master password and MFA.
Treat security-question answers as secrets.
After exposure, check other sessions and recovery details too.

2.3 Add factors from different types

Multi-factor authentication, or MFA, asks for factors from different types. It gives an attacker more to overcome than a password alone. Exactly two factors is two-factor authentication, often called 2FA or 2-step verification.

Know, have, and are

Factor type	Examples
Something you know	Password, PIN, pattern
Something you have	Phone, security key, bank card
Something you are	Fingerprint, face, voice

A password and a security question are both knowledge. Two secrets do not become two different factor types.

For a bank transfer, a customer enters a password and then a code sent to their registered phone. Someone who has only the password lacks that second step. A 6-digit code has one million possibilities. It expires quickly and works once. Services limit attempts as well.

Compare the ways to confirm

Text-message codes improve on password-only access. A SIM swap can redirect them: a criminal tricks a phone company into moving the number to another SIM. An authenticator app avoids that route. It can provide changing codes or approval requests.

Security keys and passkeys resist fake websites. A passkey uses a secret key stored on a device or in a passkey manager. You unlock its use with a PIN, fingerprint, or face check. It is tied to the real service, so there is no password to type into a copied page.

Fingerprints and faces are biometrics. They are quick to use and hard to copy, but have limits. A wet or cut finger may fail a check. Some face systems struggle with poor light or a close lookalike. A leaked password can be replaced; your fingerprint cannot. Devices keep a backup unlock method. Most device biometric checks happen locally: the website does not receive a picture of your face or finger.

Keep control of approval

A caller may say, "I sent a code to your phone by mistake." Repeated approval requests may pressure you into tapping "Approve". This is MFA fatigue. Keep login codes private and deny requests you did not start.

An unexpected request shows an attempted sign-in, but some services send prompts without a password. Check recent security activity. If it shows a correct password was entered, change that password as exposed.

Enable MFA in security settings, starting with email and money-linked accounts. Save backup codes somewhere secure in case the phone is lost. Use "remember this device" only on your own trusted device.

Key Takeaways

MFA combines different factor types.
Two knowledge checks are still one factor type.
Text codes can be stolen through a SIM swap.
Passkeys and security keys resist phishing.
Deny unexpected approvals and check sign-in activity.
Store backup codes safely for account recovery.

Try chapter 2:Walkthrough 11 Practice Questions 23 Flashcards

Spot tricks and respond safely

Scam messages try to make a quick response feel urgent. A familiar name, logo, or voice can make that pressure stronger. You will learn to check both the request and the route it arrived through. Reading an address helps you spot copied sites. If a mistake happens, the next steps depend on what you clicked, shared, or installed.

3.1 How attackers use pressure and trust

Social engineering means manipulating people into giving money, information, or access. An attacker may find it easier to trick someone than to break a well-protected system.

Notice the pressure

An unexpected message might say, "Your account closes in 20 minutes." Urgency leaves little time to think. Fear adds a threat. A sender claiming to be support staff uses authority. Offers of prizes use reward. "See who viewed your profile" uses curiosity. A message claiming a relative needs help uses trust.

Several pressures can appear together. In a game chat, someone says, "I'm a moderator. Your account will be banned in an hour. Send your password to verify it." The claimed role adds authority, the deadline adds urgency, and the ban adds fear. The request for a password makes the action unsafe.

Recognize the technique

Technique	How it works
Phishing	A fake message lures you into clicking, paying, or sharing details
Pretexting, or blagging	A made-up story gives a reason for the request
Baiting	A tempting offer hides a trap
Quid pro quo	Help or a reward is offered in exchange for information or access
Scareware	A fake security warning pressures you to call or install something

A caller claiming to fix your school account uses a pretext. Asking for its password "so I can help" adds an exchange. These labels can overlap because they describe parts of the same trick.

A pop-up saying "Your device has 28 viruses" is not a security scan. Its aim may be to get you to install a fake cleaner or call a scammer.

Tricks can happen away from a screen

Shoulder surfing means watching someone enter a secret, directly or through a camera. Shield a PIN while typing it. Tailgating means following someone through a locked door without separate permission.

AI tools can copy voices and create fake videos, called deepfakes. An urgent call may sound like a relative and still be fake. Check an unusual request by calling the person's known number. A family code word offers another check.

Public details help attackers sound convincing. A school name or birthday can support their story. Even careful people can be fooled when rushed or tired. Build a repeatable habit: pause, check through a trusted route, then decide. Ask a trusted adult when a request is unclear.

Key Takeaways

Social engineering exploits people’s trust and reactions.
Urgency, fear, authority, rewards, curiosity, and trust create pressure.
A single trick can use several techniques.
A copied voice can support a fake request.
Check unusual requests through contact details you already trust.

3.2 Read messages and web addresses carefully

Phishing messages imitate trusted people or services. They try to get information, payment, a click, or an opened file. Smishing uses texts or messaging; vishing uses calls. Spear phishing targets a person or group using real details.

Check the whole request

Look for a sender address that differs from the organization, an unexpected attachment, pressure, or a request for secrets. A document asking you to "enable content" deserves care. Good spelling, your real name, and a copied logo can all appear in a scam.

A friend's account can send phishing if someone has taken it over. An unexpected request to sign in for a contest needs a separate check with the friend. QR codes and ads can also send you to fake pages.

Before opening a link, preview its destination. On a computer, hover over it. On a phone, press and hold without opening the preview. The shown address can differ from the link's visible words. Short links hide the final destination.

Find the domain that matters

For a simple address such as https://northfieldbank.com.account-check.net/login, first find the hostname between https:// and the next /:

northfieldbank.com.account-check.net

Read its ending from the right. The registered domain is account-check.net. Whoever controls that domain chose the bank-like words before it. The real bank name at the beginning does not make this the bank's site.

Some endings contain two parts, such as .co.uk. In school.example.co.uk, the registered domain is example.co.uk.

Lookalikes can change a single character. northfie1dbank.com uses the digit 1 where a letter belongs. Extra words or a changed ending can also create a different domain.

Check encryption and identity separately

HTTPS protects the connection between your browser and the site by encrypting its content. Browsers may show a padlock or another connection icon. A fake site can also use HTTPS.

For example, a text says, "Payment blocked. Verify today," and links to http://northfie1dbank-verify.com. The threat, deadline, lookalike, and missing HTTPS all raise concern. Open the bank's official app to check.

On a page, notice browser warnings, countdowns, unusually cheap offers, or requests for excessive details. If your password manager usually fills a password but now does not, check the domain before typing it yourself.

Key Takeaways

Phishing can arrive through messages, calls, QR codes, or ads.
Good spelling, logos, and personal greetings can appear in scams.
Read the registered domain from the right of a simple hostname.
Check for altered characters and misleading extra words.
HTTPS encrypts a connection; site honesty needs separate checks.
Verify odd messages from friends through another route.

3.3 Choose the next step after a suspicious message

When a message seems suspicious, use stop, check, then act. The safest next step depends on what has already happened. Quick reporting gives attackers less time.

Stop and check separately

Leave the message's links, attachments, reply button, and phone number alone. Open the official app, type a known address, or use a number already saved or printed on a card. Checking by replying to the message leaves the same sender in control of the answer.

Report it with the app's phishing, spam, or abuse tool. At school, tell a teacher or IT staff. Then delete the message or block the sender. Services can use reports to block attacks aimed at other people.

Match the response to what happened

You clicked but entered nothing. Close the page. If a file downloaded, leave it unopened, delete it, and run a security scan. Tell a trusted adult or school IT if something unusual happened.

You entered a password. Reach the real service independently and change it promptly. Change every account using the same password. Turn on MFA, sign out other sessions, and check the recovery email and phone number. Look for posts, purchases, or messages you did not make.

You shared card or bank details. Tell a parent or guardian immediately. Contact the bank through its official app, website, or the number on the card. The bank can help block the card and stop payments. A password change alone does not protect a disclosed card number.

You lost access to the account. Use the service's official recovery process. Warn contacts that messages from the account may be scams until control returns.

Follow a password leak through

Sam enters a game password on a fake prize page. The same password protects Sam's email. Sam closes the page and goes to the real game service. Sam changes both passwords to separate ones, enables MFA, and signs out other devices. Sam checks recovery settings, tells a parent, and reports the page.

The email change matters even if no email alert has arrived. Attackers can try the known password there next. Signing out other sessions matters because a login may already be active.

Being tricked is not a reason to stay silent. The scammer is responsible for the scam. Someone offering paid "recovery" through a new message may be another scammer. Use official recovery and reporting routes.

Key Takeaways

Check through a trusted route outside the suspicious message.
Report messages before deleting or blocking them.
After sharing a password, replace reused copies and check sessions and recovery settings.
After sharing payment details, involve a parent or guardian and the bank immediately.

Try chapter 3:Walkthrough 11 Practice Questions 22 Flashcards

Identify malware and handle warning signs

Malware can arrive inside something that looks useful. It can also spread through software weaknesses without a click. You will learn to describe both how a harmful program spreads and what it does. Those two descriptions can fit the same program. You will also learn how to judge warning signs and why recovery needs a clean device.

4.1 Describe how malware spreads and what it does

Malware is software designed to harm devices, steal data, spy, or take control without permission. A program's payload is the harmful action it performs. Classifying malware involves two questions: how does it arrive or spread, and what does it do?

Compare the ways it spreads

Type	Defining behavior
Virus	Attaches to a file or program and copies into other files when it runs
Worm	Copies itself across a network without needing a host file or someone to open it
Trojan	Pretends to be useful so someone installs it; does not copy itself

A virus usually needs someone to run an infected host file. A worm can use a weakness to move directly between devices. A Trojan relies on disguise, such as a free tool that secretly steals data. Its name comes from the story of soldiers hidden in a wooden horse.

Compare the harmful actions

Ransomware locks a device or encrypts files, then demands payment. Some attackers also steal copies and threaten to publish them. Payment offers no guarantee of recovery. A clean backup kept separately can restore files without depending on the attacker.

Spyware secretly collects information, such as browsing activity, messages, or passwords. A keylogger records typing, which can expose passwords. Software keyloggers are spyware; hardware keyloggers can also sit between a keyboard and computer.

Adware shows unwanted ads, redirects browsing, and may track activity. Malware can also turn a device into a bot under an attacker's remote control. A botnet joins many infected devices. They can send spam or flood a site with traffic, blocking real visitors.

Give a program more than one label

A downloaded "free cheat tool" installs software that records keystrokes and sends them away. The disguise makes it a Trojan. The typing capture makes it a keylogger. Both labels fit because they answer different questions.

Now consider a program that spreads unaided between vulnerable computers and then locks files for payment. Its spread is worm-like; its payload is ransomware. Calling it only ransomware would leave out how it spreads.

Phones, laptops, routers, and smart cameras can all be affected by malware. Use the broad word "malware" when the exact behavior is unknown. In computing, "virus" names one particular type, not every harmful program.

Key Takeaways

Classify malware by spread and by payload.
A virus needs a host file; a worm spreads independently across networks.
A Trojan uses a useful-looking disguise and does not copy itself.
Ransomware demands payment after locking data or devices.
Spyware collects data; a keylogger records typing.
Bots can join a remotely controlled botnet.
One program can fit more than one malware label.

4.2 Spot risky downloads and respond to infection

Malware can enter through attachments, links, malicious ads, unofficial downloads, fake updates, and infected USB drives. Apps outside official stores can carry it. Unpatched software can provide a route in without anyone opening a file.

Check before installing

An unofficial site offers a paid video editor for free. Its installer says, "Disable antivirus to avoid errors." The source and the request both warn of danger. Choose software from the maker's official website or an official app store. Check the developer and app details there, too: store checks reduce risk, but fake apps sometimes get through.

Permissions control what an app can access. A flashlight tool asking for contacts and microphone access wants more than its job requires. Question the request before allowing it.

Files from a friend also need care. A taken-over account may send harmful attachments without the friend's knowledge. Hand a found USB drive to staff or lost and found instead of connecting it to inspect its contents.

Look for changes, then check

A device may slow down, overheat, show constant ads, or drain its battery quickly. A homepage may change by itself. Unknown apps, disabled protection, strange filenames, and a ransom note are further warning signs. Friends receiving messages you never sent may signal an account or device problem.

Some signs have ordinary causes. A full drive can slow a computer, for example. Treat signs as reasons to investigate with a scan and help, not as a diagnosis on their own. Phones, tablets, and Macs can get malware too.

Recover in a safe order

Disconnect the affected device from Wi-Fi and other network connections. This limits spread and data being sent away.
Tell a trusted adult or the IT team. Use up-to-date security software to run a full scan.
With their help, remove the malware or reset the device if it cannot be cleaned.
Restore files only after both the device and the backup are known to be clean. Connecting a backup too early can expose it to the same malware.
Change important passwords from a different, clean device. A keylogger may have recorded them.

Do not pay a ransom. Keep security tools running while choosing downloads carefully. Newly created malware may escape detection, so having antivirus does not make every download safe.

Key Takeaways

Check software sources, developer details, and permissions.
Malware can exploit flaws without a click.
Warning signs call for investigation; they may have ordinary causes.
Disconnect a suspected infected device and get adult or IT help.
Clean the device before restoring clean backups.
Change exposed passwords from a clean device.

Try chapter 4:Walkthrough 8 Practice Questions 17 Flashcards

Keep protection and recovery ready

Everyday security needs several protections working together. Updates close known weaknesses. Security software and firewalls check different parts of device activity. Backups let you recover when prevention fails. You will also plan safer habits for shared computers, Wi-Fi, and lost devices, where physical access can matter as much as a password.

5.1 Close software weaknesses with updates

A bug is a mistake in software. A vulnerability is a weakness attackers can use. An exploit is the method or code that uses it. A patch fixes the flaw, usually through a security update.

Why waiting creates an opening

When a maker releases a patch, attackers can study what it changed. They may then target devices still running the old version. A device can appear to work perfectly while leaving a known weakness open.

Updates can add features and fix everyday bugs, but security fixes need prompt attention. Schedule them when work will not be interrupted. Restart when asked: some changes only finish installing during a restart.

Follow a real outbreak

Microsoft released update MS17-010 on March 14, 2017. It fixed weaknesses in Windows network file sharing. On May 12, 2017, 59 days later, WannaCry began using one of those weaknesses to spread.

WannaCry combined worm-like spread with a ransomware payload. It affected more than 200,000 computers in at least 100 countries. The UK's National Health Service lost access to systems, and appointments and operations were canceled. Installing the patch had protected computers against that spreading method.

This example connects a weakness, an available fix, and an attack. Working software still needed its security update.

Keep all software in view

Update the operating system, apps, browser, extensions, games consoles, and security software. Routers and smart devices use built-in software called firmware, which also needs updates. Turn on automatic updates where possible.

Use device settings, an official store, or the maker's website. A website pop-up saying "Update your browser here" can offer malware disguised as an update. Open the browser's own update settings to check.

Understand support limits

A zero-day is a weakness attackers use before the maker knows about it or has a fix ready. Other layers still matter while a patch is unavailable.

At end of support, routine security fixes stop. New weaknesses can then remain open. Windows 10 Home and Pro reached end of standard support on October 14, 2025. Extended Security Updates offer eligible enrolled devices extra fixes; some specialist editions have separate support dates. Check the exact product and edition. Unsupported devices need an upgrade or replacement, especially for important accounts.

Makers sometimes release emergency fixes for old products, as Microsoft did during WannaCry. An exceptional fix is not a continuing support plan.

Key Takeaways

A vulnerability is a weakness; an exploit uses it; a patch fixes it.
Install security updates promptly, including required restarts.
WannaCry used a flaw with a patch available 59 days earlier.
Update apps, operating systems, browsers, and firmware.
Use official update routes.
End of support leaves new flaws without routine fixes.

5.2 Combine security software, firewalls, and permissions

Anti-malware software, often called antivirus, checks files and programs for harmful software. A firewall controls network connections using rules. They protect different parts of device use.

How malware checks work

Signature-based detection looks for patterns from known malware. Its database needs frequent updates. Behavior-based detection watches what a program does, such as suddenly encrypting many files. This can catch a new threat, but may flag safe activity by mistake. Such a mistaken warning is a false positive.

A detected file may go into quarantine, where it is isolated and blocked from running. Real-time protection checks files as they arrive or open. Scheduled scans check the device regularly. Run a full scan when warning signs appear.

Many systems include security software. For example, Windows includes Microsoft Defender. Get security software through official sources. A web pop-up offering a cleaner may itself be scareware.

What a firewall checks

Think of a firewall as a gate with entry and exit rules. It can block an incoming connection that a device did not request. Operating systems and home routers often include firewalls; keep them enabled.

A firewall allows some connections because devices need them. A harmful file can still travel through an allowed connection. The firewall does not replace a check of that file or remove malware already running.

Protection	Main job
Anti-malware	Check files and programs
Firewall	Allow or block network connections
Updates	Fix software weaknesses
Standard user account	Limit permission to change the system

See the layers working

An attachment is named invoice.pdf.exe. The last ending, .exe, identifies a program, even though the earlier part looks like a document. Security software recognizes a known Trojan and quarantines it. Later, a firewall blocks an unwanted incoming connection. The two tools made different checks.

Using several protections is layered security, also called defense in depth. If one layer misses a threat, another may stop it. No layer catches everything. A person can still give a password to a fake website.

Use a standard account for daily work. Administrator access allows wider system changes, so keep it for tasks that need it. Requiring separate approval for those changes makes it harder for malware to take over the whole device.

Key Takeaways

Signature detection needs current patterns; behavior detection watches actions.
Quarantine blocks suspicious files from running.
A firewall controls connections; antivirus checks files and programs.
Layers cover different routes of attack.
A standard account limits everyday system permissions.

5.3 Build backups you can actually restore

A backup is a separate copy you can restore after the original is lost, damaged, deleted, or locked. Device failure, theft, water, and mistakes can destroy data as well as malware.

Separate the copies

A second folder on one laptop fails with the same laptop. Use separate storage, such as an external drive, another computer, a school backup service, or cloud backup. A cloud service stores data on the provider's servers over the internet.

The 3-2-1 rule means at least three copies, on two different storage types, with one copy offsite. Count the original among the three.

For example, photos stay on a phone, back up automatically to cloud storage, and are copied monthly to an external drive. The cloud is offsite; the external drive provides another storage type. Losing the phone leaves two recovery routes. A flood at home can destroy the local devices while leaving the cloud copy.

Keep ransomware away from recovery copies

Ransomware can encrypt connected backup drives too. Disconnect a drive after backing up. A backup service with earlier protected versions offers another recovery route. Check how long those versions stay available.

Sync keeps locations matching. If deletion or encryption is copied to every device, matching files can all be lost together. Sync can support backup when it also keeps recoverable earlier or deleted versions. Check the version-history settings; the word "cloud" alone tells you little about recovery.

Decide how much work you can lose

If you back up every Sunday, failure on Saturday can lose six days of new work. Daily backups reduce that gap to about one day. Choose frequency from how much work you could bear to repeat. Automatic backups are less easy to forget.

A full backup copies everything. It takes more time and space, but restoration is simple. An incremental backup copies changes since the previous backup. Restoration needs the latest full backup and every later incremental copy in order.

Suppose Monday has a full backup, followed by Tuesday and Wednesday increments. Recovering Wednesday's version needs all three. Wednesday's increment alone contains only the newest changes.

Test recovery by restoring a small file now and then. Finding that a copy cannot be opened during a real loss is too late. Keep backup drives physically secure, and protect cloud accounts with unique passwords and MFA. Backup copies contain the same private information as the originals.

Key Takeaways

A backup must survive loss of the original storage.
3-2-1 counts the original plus two backups.
Keep a copy disconnected or use recoverable earlier versions.
Sync needs recovery history to serve as backup.
Backup frequency sets how much recent work may be lost.
Incremental recovery needs the full backup and later increments.
Test restores and protect backup access.

5.4 Use Wi-Fi and shared devices with care

Shared networks and devices bring other people close to your data. A strong account password still needs safe handling before and after sign-in.

Public and home Wi-Fi

Open public Wi-Fi often lacks encryption between your device and the router. HTTPS separately encrypts website connections, but fake hotspots, unencrypted sites, and file sharing still create risks.

Check the official network name with staff or signs to reject lookalikes. An attacker can copy the exact name, too. At an airport, Jordan checks the posted name but uses mobile data for banking. A matching label alone cannot confirm who runs a network.

Use mobile data or your own hotspot for important sign-ins. On public Wi-Fi, check HTTPS and domains, switch off file sharing and automatic joining, then forget the network afterward. A VPN encrypts traffic between your device and the VPN provider. It protects that part of the route and shifts trust to the provider. It cannot make a fake website honest.

At home, change the router's default administrator password. Use WPA2 or WPA3 encryption, a strong Wi-Fi password, and updated router firmware.

Finish properly on shared computers

Sign out of every account. Leave "remember me" and password saving off. Close the browser when finished. A saved session can let the next person enter without knowing your password.

Private browsing, or incognito mode, removes that window's local history and cookies after all its private windows close. The network, school, and visited services can still observe activity. It does not remove a file you deliberately downloaded or protect against installed keyloggers.

Guard access to the physical device

Lock the screen whenever you step away. Set an automatic lock with a PIN, password, or biometric. On Windows, the Windows key plus L locks immediately. Someone holding an unlocked phone can read messages and use email password-reset links.

Keep devices with you in public, and shield PIN entry. Enable the device's location and remote-lock feature before it is lost. If it goes missing, use a trusted device to lock or erase it remotely and change important signed-in account passwords.

Limit public information that supports scams: a full birthday, school, live location, or an ID photo can all help attackers. Review who can see posts. Check photos for house numbers, screens, and private documents before sharing.

Key Takeaways

An exact Wi-Fi name can still be copied by an attacker.
Use mobile data for sensitive sign-ins and secure home router settings.
Sign out and avoid saved passwords on shared computers.
Private browsing limits local records, not network visibility.
Lock and physically protect devices; prepare remote-lock tools.
Shared personal details can make scams more convincing.

Try chapter 5:Walkthrough 14 Practice Questions 32 Flashcards

Online Security examples

5 Walkthroughs

Work out what an attack puts at risk

10 steps

Follow an account attack, separate risks from weaknesses, and use the three security goals to explain the damage.

1
IntroductionStart with what an account holds
A club account holds private messages, membership records, and a shared calendar. An attacker might want different parts for different reasons.

Follow the account through a possible attack. First identify what attracts the attacker. Then separate the weakness from the attempt (a vulnerability versus an attack), and describe exactly what harm follows, using the CIA triad, so protection fits the damage.
2
ExplanationSee the value to an attacker
Accounts can hold money, useful data, or trusted contacts. A stolen account can send scams to people who recognize its owner. A controlled device can help attack others.

Many attempts are automated. Being an ordinary user does not prevent a program from trying your account alongside thousands of others.
3
ExampleSeparate a weakness from an attempt
The club reuses one password across two services. One service leaks its sign-in list. An attacker tries that password on the club’s other account.

The reused password is the vulnerability. The attempted sign-in is the attack. The club’s risk depends on how likely entry is and what the account would expose.
4
ChallengeJudge a different weak point
A school app has an unfixed flaw. Nobody has tried to use it yet. Is the flaw a vulnerability or an attack, and what would make the risk greater?

---reveal---

It is a vulnerability. An attack would be an actual attempt to use it. Risk rises if exploitation is more likely or the possible harm is larger, such as exposing many private records.
5
ExplanationAsk three security questions
The CIA triad gives three questions for an incident.
- Confidentiality: did someone without permission see data?
- Integrity: was data changed wrongly or without permission?
- Availability: could people use what they needed?
Check each question. One incident may have several answers, and keeping data secret is only one part of protection.
6
ExampleTrack the stolen photos
Attackers copy a family’s photos to their own computer. They then encrypt the originals and demand payment, threatening to publish the copies.

Start with who has seen the data. The attackers have private copies without permission. Confidentiality has failed even before anyone publishes them.
7
ExampleTrack the changed originals
Continue with the same photos. The originals have been encrypted without the family’s permission. That harms integrity. The family cannot open them, so availability fails too.
8
ConnectionMatch recovery to the damage
A clean backup lets the family recover usable photos. It helps restore access and correct files. It cannot remove the attacker’s copies.

Permissions and strong sign-in checks help stop unauthorized readers and editors. Backups help after data loss.
9
ChallengeChoose the remaining protection
A club restores its correct calendar after an attacker copied it and edited the dates. Members can use it again. Which security harm remains, and why does the backup not solve it?

---reveal---

Confidentiality remains harmed: the attacker still has a private copy. Restoring correct, usable data repairs the club’s copy but does not recall data already taken.
10
RecapName the risk and the harm
Use two checks together: identify the weakness and likely harm, then ask who saw, changed, or lost access to data.

Choose protection for the problem you found. A password controls entry; edit permissions control changes; a backup supports recovery. Permission also sets the boundary for anyone testing a system.

Build a sign-in plan that survives a leak

18 steps

Compare guessing and theft, separate account passwords, and choose factors that add useful protection.

Save this lesson to follow every Walkthrough step by step.

Save this lesson

1
IntroductionProtect more than one secret
2
ExplanationTell guessing methods apart
3
ExampleCount one PIN position at a time
4
ExampleSee what four extra letters change
5
ChallengeApply the multiplication rule
6
ExplanationMake words unpredictable
7
Key InsightCount words as separate choices
8
ExampleFollow one leak to other accounts
9
TipLet a manager keep accounts separate
10
ChallengeExplain why strength is not enough
11
ExplanationCombine different factor types
12
ExplanationCompare second-factor routes
13
ConnectionKnow what a biometric check does
14
ExampleUse a passkey at the real service
15
ChallengeCount types, not questions
16
TipKeep approval in your control
17
ChallengeRespond to a confirmed leak
18
RecapKeep each layer doing its job

Check a message before trusting it

14 steps

Unpack pressure tactics, read a destination, and choose the right response after a suspicious interaction.

Save this lesson to follow every Walkthrough step by step.

Save this lesson

1
IntroductionLook past a familiar appearance
2
ExampleUnpack a fake moderator’s request
3
ExplanationNotice the story and the offer
4
ChallengeChoose an independent check
5
ExampleFind the hostname
6
ExampleRead the controlling name from the right
7
Key InsightCheck encryption separately
8
ChallengeRead a new destination
9
TipKeep the check outside the message
10
ExplanationHandle a click without shared details
11
ExampleFollow a shared password
12
ExplanationHandle money and lost access
13
ChallengeChoose the response that fits
14
RecapMake a separate check a habit

Classify malware and plan cleanup

12 steps

Use spread and payload as separate clues, then work through the order of a safe recovery.

Save this lesson to follow every Walkthrough step by step.

Save this lesson

1
IntroductionAsk how it spread and what it did
2
ExplanationCompare virus, worm, and Trojan
3
ExplanationIdentify the payload
4
ExampleFollow a disguised cheat tool
5
ChallengeClassify a different combination
6
TipCheck the route into the device
7
ExplanationTreat signs as reasons to check
8
ExampleFirst limit contact
9
ExampleClean before restoring
10
ChallengeProtect the replacement password
11
ConnectionKeep recovery separate from prevention
12
RecapUse the clues in the right order

Build layers and a recovery plan

20 steps

Connect updates and security tools with backups and safer handling of networks and shared devices.

Save this lesson to follow every Walkthrough step by step.

Save this lesson

1
IntroductionPlan for prevention and recovery
2
ExplanationTrace flaw, exploit, and patch
3
ExampleConnect a patch to a real outbreak
4
ChallengeChoose the trusted update route
5
ExplanationCheck patterns and behavior
6
AnalogyGive connections their own gate
7
ChallengeExplain why both tools matter
8
ExplanationCount the three copies
9
ExamplePlace a copy beyond the home
10
Key InsightMatching files can repeat a mistake
11
ExampleChoose the loss you can tolerate
12
ExplanationRestore a chain in order
13
ChallengeFind the missing protection
14
ExplanationLook beyond a network name
15
TipSecure the home router
16
ExplanationFinish a shared-computer session
17
TipPrepare before a device goes missing
18
ChallengeJudge two kinds of access
19
ChallengeBuild recovery after prevention fails
20
RecapCheck each job in the plan

Online Security practice questions

50 Practice Questions in 5 sets

Set 1: Check the security basics10 Practice Questions

Question 1 of 10

A club uses the same password for every member account. In security terms, what is this weak point?

A vulnerability
An attack
A payload
A threat

Show answerHide answer

Answer: A

Password reuse is a vulnerability because it gives an attacker a weakness to use. An attack is the actual attempt to cause harm, such as trying a leaked password; the weak point exists before that attempt happens.

Question 2 of 10

A stranger reads a private team chat. The messages stay unchanged and available. What security goal failed?

Both integrity and availability
Confidentiality
Availability
Integrity

Show answerHide answer

Answer: B

Confidentiality failed because someone without permission read the chat. Integrity concerns accuracy and authorized changes, so it has not failed in this account of the incident. The team can still use the unchanged messages.

Question 3 of 10

A random PIN has 3 digits, each from 0 through 9. Repeated digits are allowed. How many PINs are possible?

$100$
$729$
$30$
$1,000$

Show answerHide answer

Answer: D

Each of the three positions has 10 choices, so

10^{3} = 1,000

. Adding the choices gives 30, but counts positions separately instead of counting the different complete PINs. Repeated digits remain valid choices.

Question 4 of 10

A shopping account leaks a long password also used for a photo account. Why is the photo account at risk?

The two accounts share one database
The known password can be tried there
The photo site stores readable passwords
The leak bypasses its second factor

Show answerHide answer

Answer: B

The attacker can try the known password on the photo service through credential stuffing. Its length no longer protects against that attempt because the password is already known. The photo service does not need its own breach for reuse to cause harm.

Question 5 of 10

How should words be chosen for an unpredictable passphrase?

Choose related words about a favorite sport
Choose a familiar phrase with new spacing
Choose words from a favorite song verse
Choose each word through a random process

Show answerHide answer

Answer: D

Random selection avoids the links and familiar phrases that attackers can predict. A song verse can be long and memorable, but it may already appear on an attacker’s phrase list. Moving spaces does not make the word sequence random.

Question 6 of 10

A pop-up says, "Danger! Call this number now to remove 19 infections." What technique is it using?

Scareware
Shoulder surfing
Credential stuffing
Tailgating

Show answerHide answer

Answer: A

Scareware uses a frightening warning to push someone into calling or installing something. The pop-up’s claim is part of the trick, not a trusted scan result. Credential stuffing instead tries sign-in details leaked from another service.

Question 7 of 10

A text links to https://school.portal-reset.net/login. What is the registered domain?

school.portal
school.net
portal-reset.net
login.net

Show answerHide answer

Answer: C

The hostname ends in portal-reset.net, which is the registered domain in this address. The word school is a prefix controlled by that domain’s owner. A trusted-looking word at the start does not establish that the school runs the site.

Question 8 of 10

A harmful program copies itself between computers over a network without a host file. What type describes its spread?

A worm
A virus
A Trojan
Adware

Show answerHide answer

Answer: A

A worm spreads independently between devices, without needing a host file. A virus attaches to files and spreads through them when they run. Adware describes unwanted advertising, which tells you a payload rather than this spreading method.

Question 9 of 10

A laptop works normally, but a security update fixes a flaw in its browser. Why install it promptly?

Working browsers never need later restarts
The patch replaces all other protections
Attackers can exploit the unpatched flaw
The update restores every lost document

Show answerHide answer

Answer: C

A working browser can still contain a vulnerability. Installing the patch closes that known weakness before an attacker uses it. A patch fixes its specified flaws; it does not replace separate protections such as backups or malware checks.

Question 10 of 10

A camera club keeps originals on a laptop, a backup on an external drive, and a cloud backup offsite. The drive stays attached. What change addresses ransomware risk while keeping the 3-2-1 plan?

Move the cloud copy into a laptop folder
Delete the drive copy after each upload
Disconnect the drive after each backup
Keep both local copies on the same disk

Show answerHide answer

Answer: C

The plan already has three copies, two storage types, and an offsite copy. Disconnecting the drive protects a recovery copy from malware running on the laptop. Moving cloud files onto that laptop would remove the offsite protection and share its failure risk.

Set 2: Apply safe choices in everyday situations10 Practice Questions

Save this lesson to see every answer and practice every set.

Save this lesson

Question 1 of 10

Someone secretly changes a club’s payment record, but nobody loses access and no private data is read. What security goal failed?

Integrity
Confidentiality
Availability
All three goals

Show answerHide answer

Save this lesson to see this answer.

Question 2 of 10

A password uses 6 random lowercase letters. The next version uses 8, with all choices independent. By what factor does the number of possibilities grow?

$26$
$676$
$52$
$2$

Show answerHide answer

Save this lesson to see this answer.

Question 3 of 10

A full backup is made on Friday. Incremental backups follow on Saturday and Sunday. What is needed to restore Sunday’s final state?

The Friday full and Sunday increment only
The Sunday incremental backup by itself
Friday, Saturday, and Sunday backups
The Saturday and Sunday increments only

Show answerHide answer

Save this lesson to see this answer.

Question 4 of 10

A sign-in page uses HTTPS. What does that tell you about the connection?

The operator has checked every download
The page cannot collect stolen passwords
The site belongs to the named school
Its content is encrypted in transit

Show answerHide answer

Save this lesson to see this answer.

Question 5 of 10

Riley enters a card number on a fake ticket page. What should Riley do immediately?

Tell a guardian; call the bank officially
Call the help number shown on the fake page
Reply to the seller asking for card removal
Change the ticket-site password and wait

Show answerHide answer

Save this lesson to see this answer.

Question 6 of 10

A "free painting app" secretly records everything typed after installation. What two descriptions fit?

Worm and ransomware
Virus and adware
Worm and keylogger
Trojan and keylogger

Show answerHide answer

Save this lesson to see this answer.

Question 7 of 10

An offline photo editor asks to read all contacts. What makes this request concerning?

Photo editing needs administrator access
Official stores never check permissions
The access exceeds what its job needs
Contacts access always causes ransomware

Show answerHide answer

Save this lesson to see this answer.

Question 8 of 10

A firewall permits a browser’s connection. A harmful file downloads over it. What protection is designed to check that file?

The HTTPS connection
A private browsing tab
Anti-malware software
The firewall’s rules

Show answerHide answer

Save this lesson to see this answer.

Question 9 of 10

An art group edits work daily and can repeat at most one day’s work. Its only cloud service immediately copies edits and deletions, with no recovery history. What plan meets both recovery needs?

Monthly backups with deleted-file recovery
Daily backups retaining earlier versions
Daily sync to a second device without history
Weekly backups alongside the same live sync

Show answerHide answer

Save this lesson to see this answer.

Question 10 of 10

On a shared library computer, Noor opens email in a private window and downloads a private club roster. The next person needs the computer. What steps protect the account, remove the saved roster, and end the local browsing record?

Sign out, remove roster copies, close private windows
Close private windows, leave the roster downloaded
Delete the roster, keep the signed-in window open
Sign out, delete the roster, keep private windows open

Show answerHide answer

Save this lesson to see this answer.

Set 3: Connect threats, protections, and recovery10 Practice Questions

Save this lesson to see every answer and practice every set.

Save this lesson

Question 1 of 10

An attacker uses an account’s public school name and team photos to fake a coach’s message. How did those details help?

They granted permission to enter school systems
They removed the account’s password protection
They made the false story sound credible
They installed malware without any other action

Show answerHide answer

Save this lesson to see this answer.

Question 2 of 10

Drew shares an email password on a fake page, and the same password protects a music account. Email is still open on another device. What recovery plan addresses the leak and possible ongoing access?

Replace both passwords, end sessions, check recovery details
Replace email’s password and leave the music account unchanged
Replace both passwords and leave recovery settings unchecked
End email sessions and keep the old password for later use

Show answerHide answer

Save this lesson to see this answer.

Question 3 of 10

An attacker tests a list of common words with added years and symbols. What method is this?

A brute-force attack
A SIM swap attack
A dictionary attack
Credential stuffing

Show answerHide answer

Save this lesson to see this answer.

Question 4 of 10

An account requires a password and the answer to a secret question. Why is this not MFA?

MFA always needs a fingerprint reader
Both checks use something you know
Both checks use something you have
Questions count only when answers are public

Show answerHide answer

Save this lesson to see this answer.

Question 5 of 10

A call sounds like a cousin urgently asking for money from a new number. How can the request be checked independently?

Use the callback number supplied by the caller
Call the cousin’s previously known number
Trust the voice if it uses the cousin’s name
Ask the caller to repeat the request slowly

Show answerHide answer

Save this lesson to see this answer.

Question 6 of 10

Casey opens a suspicious page, enters nothing, and no file downloads. What is the immediate response?

Reply to the message to check the sender
Share the link publicly to identify its owner
Close the page without entering anything
Enter a false password to test the page

Show answerHide answer

Save this lesson to see this answer.

Question 7 of 10

A laptop shows a ransom note. An external backup is disconnected. What sequence best protects recovery files and account passwords?

Scan, reconnect the backup at once, then decide whether to get help
Connect the backup, restore, then scan and change passwords locally
Change passwords on the laptop, restore, then disconnect the network
Disconnect, get help, clean, restore; reset passwords elsewhere

Show answerHide answer

Save this lesson to see this answer.

Question 8 of 10

A browser update is downloaded, but settings say a restart is required. Why should the restart be completed?

The security changes may not be active yet
The download has already activated every fix
Restarting confirms all saved files are malware-free
Browser restarts are needed only to add features

Show answerHide answer

Save this lesson to see this answer.

Question 9 of 10

Security software wrongly flags a safe school program as harmful. What is this called?

A false positive
A zero-day flaw
An incremental backup
A brute-force attempt

Show answerHide answer

Save this lesson to see this answer.

Question 10 of 10

A café employee confirms the Wi-Fi name. Two nearby hotspots display that exact name. Morgan needs to open a payment account. What choice best addresses the unresolved network risk?

Choose the matching hotspot with the strongest signal
Trust either matching name if HTTPS is available
Connect to both hotspots and compare their logos
Use mobile data and the official payment app

Show answerHide answer

Save this lesson to see this answer.

Set 4: Reason through mixed security problems10 Practice Questions

Save this lesson to see every answer and practice every set.

Save this lesson

Question 1 of 10

A youth club posts its recovery answers publicly and uses the same password on several services. A member says only the public post matters because the password is long. What is the flaw in that judgment?

Reuse becomes safe when every service has a recovery question
Only the password’s length matters once recovery is enabled
Public answers and password reuse create separate routes in
Public details matter only after malware is already installed

Show answerHide answer

Save this lesson to see this answer.

Question 2 of 10

A password manager stops offering a saved password on a page that resembles the usual service. What should be checked before typing it?

Whether the page mentions the account owner
Whether the password still has enough symbols
The page’s complete registered domain
Whether the logo matches the previous page

Show answerHide answer

Save this lesson to see this answer.

Question 3 of 10

Tess receives repeated approvals she did not start. Security activity confirms a correct password was entered from an unfamiliar device. What response addresses both pieces of evidence?

Deny approvals, change the password, and end other sessions
Change the password but approve old requests to clear the queue
Deny approvals but keep the password because no code was shared
Approve once to stop prompts, then change the recovery question

Show answerHide answer

Save this lesson to see this answer.

Question 4 of 10

Someone watches a learner enter a tablet PIN from a nearby seat. What is this technique?

Baiting
Shoulder surfing
Tailgating
Pretexting

Show answerHide answer

Save this lesson to see this answer.

Question 5 of 10

The club’s known site is https://cedarclub.example.org. A message links to https://cedarclub.example.org.member-review.net/check. It uses HTTPS and names your coach. What should you conclude and do?

The coach’s name confirms it; ask for a code on that page
HTTPS confirms club ownership; reply if the password fails
It belongs to member-review.net; check through the known club site
It belongs to example.org; use its encrypted sign-in form

Show answerHide answer

Save this lesson to see this answer.

Question 6 of 10

Malware encrypts homework and demands payment, but its spreading method is unknown. What type is supported by these details?

A worm
Ransomware
A Trojan
A virus

Show answerHide answer

Save this lesson to see this answer.

Question 7 of 10

A program copies itself over a network with no host file, then records typing and sends it away. How should it be classified, and where should exposed passwords be replaced?

Worm with keylogger behavior; replace passwords on a clean device
Virus with keylogger behavior; replace passwords on a clean device
Worm with keylogger behavior; replace passwords on the infected device
Worm with ransomware behavior; replace passwords on a clean device

Show answerHide answer

Save this lesson to see this answer.

Question 8 of 10

A learner downloads software through an allowed connection and expects the firewall to remove any infection afterward. What is wrong with that plan?

A firewall controls connections, not malware cleanup
A firewall scans files only after they start running
An allowed HTTPS connection can carry only safe files
A firewall removes malware during its scheduled scans

Show answerHide answer

Save this lesson to see this answer.

Question 9 of 10

Lee saves a project in two folders on one laptop. Both open correctly. Why does this fail as a backup plan against theft?

Backups must stay connected to survive device theft
A cloud service is the only valid backup location
Version history protects same-device copies from theft
Both copies disappear with the same stolen device

Show answerHide answer

Save this lesson to see this answer.

Question 10 of 10

A learner leaves an unlocked phone on a table during a break. What action should become a habit before stepping away?

Use private mode
Go to home screen
Close email tabs
Lock the screen

Show answerHide answer

Save this lesson to see this answer.

Set 5: Choose and justify a complete response10 Practice Questions

Save this lesson to see every answer and practice every set.

Save this lesson

Question 1 of 10

An attacker copies a private schedule, changes its times, and blocks staff access. A clean backup restores the original schedule. What harm remains after staff regain access?

Staff can never use that schedule again
The backup must contain the altered times
The attacker still has a private copy
Restoration removes the attacker’s copy

Show answerHide answer

Save this lesson to see this answer.

Question 2 of 10

A lock uses 5 independently random digits and allows 4 distinct guesses before lockout. What is the chance those guesses include the PIN?

$0.04 %$
$0.4 %$
$0.004 %$
$4 %$

Show answerHide answer

Save this lesson to see this answer.

Question 3 of 10

An email password also protects a game account. A fake page captures the password and a texted code, then relays them immediately to email. Both services support passkeys. What sign-in change addresses both reuse and this live phishing method?

Keep the shared password and replace texts with app-generated codes
Use separate passwords and keep entering texted codes on request
Replace both password sign-ins with service-bound passkeys
Keep password sign-in and add a secret question on each service

Show answerHide answer

Save this lesson to see this answer.

Question 4 of 10

A perfectly spelled message from a friend asks you to sign in at an unfamiliar link to vote. How should you check it?

Reply to the same message asking if it is genuine
Ask the friend through a separate known route
Check spelling again and then enter the password
Trust it because the account belongs to a friend

Show answerHide answer

Save this lesson to see this answer.

Question 5 of 10

After a fake sign-in, Ari loses access to a social account. Friends receive payment requests from it. A new stranger offers recovery for a fee. What plan addresses both the takeover and the follow-up scam?

Use official recovery, warn friends, and reject the paid offer
Pay the stranger, then tell friends the account is secure
Create a new password on the stranger’s recovery page
Warn friends but leave recovery to anyone with good reviews

Show answerHide answer

Save this lesson to see this answer.

Question 6 of 10

Many infected cameras are remotely controlled together to send spam. What is this group called?

A worm
A botnet
A Trojan
A virus

Show answerHide answer

Save this lesson to see this answer.

Question 7 of 10

A tablet’s battery begins draining quickly, but there are no other reported changes. How should that sign be judged?

Treat battery drain alone as a confirmed infection
Factory-reset immediately without checking anything
Assume tablets cannot carry harmful software
Investigate possible causes and run a security check

Show answerHide answer

Save this lesson to see this answer.

Question 8 of 10

A laptop’s maker has ended support. Its antivirus is current and scans are clear. The laptop is used for private email. What unresolved problem should guide the next step?

New system flaws may lack fixes; plan a supported upgrade
Keep the old system; frequent scans replace the missing patches
Keep the old system; a firewall closes every software weakness
Keep the old system; private browsing blocks all new exploits

Show answerHide answer

Save this lesson to see this answer.

Question 9 of 10

A full backup is saved Monday. Tuesday’s increment saves new project work. The project is deleted Wednesday morning, and Wednesday’s increment records the deletion. Live sync has no recovery history. What should be applied to recover the latest project before deletion?

Monday’s full copy, then Tuesday’s increment
Monday’s full copy, then both increments
Tuesday’s increment without the full copy
Monday’s full copy, then Wednesday’s increment

Show answerHide answer

Save this lesson to see this answer.

Question 10 of 10

A leaked password database is copied to an attacker’s computer. Why do limits on the original login page no longer stop this guessing?

The attacker gains access to every account
The copy shows every password as plain text
The login page now allows unlimited guesses
Guesses can be tested against the stolen copy

Show answerHide answer

Save this lesson to see this answer.

Stuck on your own question? Homework Help

Key Terms

96 Key Terms, each with its definition

A

Account recovery

Account recovery is a service’s official process for regaining access when normal sign-in no longer works.

A learner reaches recovery through the official app after an account takeover.

Account session

An account session is an active sign-in that may keep access open without asking for the password on every page.

Ending other sessions helps remove an attacker’s ongoing access after a leak.

Adware

Adware creates unwanted advertisements, pop-ups, or redirects and can also track activity or slow a device.

New browser redirects and constant ads appear after an unofficial download.

Anti-malware software

Anti-malware software checks files and programs for harmful software, then blocks, isolates, or helps remove detected threats.

A scanner quarantines a harmful installer before the learner opens it.

App permission

An app permission grants access to a device feature or data, such as the microphone, camera, contacts, or location.

A flashlight app’s request to read contacts exceeds its apparent needs.

Attack

An attack is an actual attempt to harm a system, steal data, or gain access without permission.

Trying a leaked password on another person’s account is an attack.

Authentication

Authentication checks that a person signing in controls the proof needed for an account, such as its secret password.

A username names the account; the password helps prove who may enter it.

Authentication factor

An authentication factor is proof from one of three types: something you know, something you have, or something you are.

A password is knowledge, while possession of a security key is a different type.

Authenticator app

An authenticator app helps confirm sign-ins through changing codes or approval prompts on a registered device.

An unexpected approval request should be denied and checked in security activity.

Availability

Availability means people with permission can use the data and systems they need when they need them.

A locked project file loses availability even if no one else can read it.

B

Backup

A backup is a separate copy of data that can be restored if the original becomes lost, damaged, deleted, or locked.

An external copy survives when the laptop holding the original stops working.

Backup code

A backup code is a securely stored recovery code that can restore access when the usual authentication method is unavailable.

A learner keeps recovery codes safe before replacing a lost phone.

Baiting

Baiting hides a trap in a tempting offer or object, such as a prize link, free game tool, or unknown USB drive.

A supposed free game-currency tool invites someone to install harmful software.

Behavior-based detection

Behavior-based detection watches what programs do, helping spot new malware through suspicious actions as well as known patterns.

A program suddenly encrypting many documents can trigger a security warning.

Biometrics

Biometrics use body features, such as a fingerprint or face pattern, to check identity as something you are.

A wet finger may fail a reader even though the device belongs to that person.

Bot

A malicious bot is a device that malware places under an attacker’s remote control, often without its owner noticing.

An infected home camera can send spam at an attacker’s command.

Botnet

A botnet is a network of infected, remotely controlled devices used together for attacks such as spam or traffic flooding.

Many controlled devices flood a website until ordinary visitors cannot load it.

Brute-force attack

A brute-force attack tests every possible combination, such as every possible password, until it finds a match.

An extra random character multiplies the combinations that must be searched.

Bug

A bug is a mistake in software that can cause incorrect behavior. A bug becomes a security vulnerability when attackers can use it.

An app error may affect normal work without creating a usable route for an attacker.

C

CIA triad

The CIA triad groups the three goals of information security: confidentiality, integrity, and availability.

After an incident, a team checks who saw files, what changed, and what still works.

Cloud backup

Cloud backup stores recovery copies on a provider’s servers over the internet, usually away from the original device.

An offsite cloud copy can survive damage to both a phone and a local drive.

Confidentiality

Confidentiality means that data is seen only by people with permission to see it. It protects private information.

Forwarding a private photo to an unauthorized reader breaks confidentiality.

Credential stuffing

Credential stuffing tries username-and-password pairs leaked from one service on accounts at other services.

A leaked game password may be tried against email when the owner reused it.

Cybersecurity

Cybersecurity protects devices, accounts, networks, and data from access, damage, or disruption without permission.

A school uses updates and sign-in checks to protect its learning system.

D

Deepfake

A deepfake is AI-made or altered media that imitates a person, helping a fake message appear to come from someone familiar.

An urgent video request for money needs a check through a known contact route.

Denial-of-service attack

A denial-of-service attack overwhelms or disrupts a service so that people with permission cannot use it.

A flood of unwanted traffic stops genuine visitors from loading a club website.

Dictionary attack

A dictionary attack tries likely passwords, common words, and predictable changes such as added years or symbols.

A capitalized season followed by a year is a pattern a dictionary attack can try early.

E

Encryption

Encryption scrambles data so that it needs the right key to become readable, helping protect it from unwanted readers.

HTTPS uses encryption to protect a web connection’s content while it travels.

End of support

End of support is the point when a maker stops routine security updates for a product, leaving new flaws without those fixes.

A working old phone may still need replacement when security support ends.

Ethical hacker

An ethical hacker tests agreed parts of a system with the owner’s permission and reports weaknesses for repair.

A school hires a permitted tester to find flaws before criminals use them.

Exploit

An exploit is a method or piece of code that takes advantage of a vulnerability to gain access or cause harm.

A worm uses an exploit to spread through an unpatched network weakness.

F

Fake hotspot

A fake hotspot is an attacker-run wireless network that imitates a trusted one, sometimes using the exact same name.

A matching café network name alone cannot identify who operates the hotspot.

False positive

A false positive is a mistaken security warning that identifies safe software or harmless activity as a threat.

A legitimate file tool is flagged because its actions resemble suspicious behavior.

Firewall

A firewall allows or blocks network traffic entering or leaving a device or network according to a set of rules.

The firewall blocks an incoming connection that the laptop did not request.

Firmware

Firmware is built-in software that runs hardware such as routers and smart devices and may need security updates.

A home router needs firmware updates as well as a strong administrator password.

Full backup

A full backup copies all the selected data each time, using more time and storage but offering a simple starting point for recovery.

A full copy made on Monday contains a whole project folder as it was that day.

H

HTTPS

HTTPS encrypts content between a browser and a website. It protects that connection even when the website itself is dishonest.

Check the registered domain as well as HTTPS before entering a password.

I

Identity theft

Identity theft is using another person’s personal information to pretend to be them, such as when opening an account.

A criminal uses stolen details to create a shopping account in someone else’s name.

Incremental backup

An incremental backup copies changes since the last backup; restoration needs the latest full copy and each later increment.

A backup of only the files changed on Wednesday cannot replace missing changes that were saved on Tuesday.

Integrity

Integrity means data stays accurate and complete, with changes limited to people who have permission to make them.

An unauthorized edit to a competition score harms the record’s integrity.

K

Keylogger

A keylogger records keys pressed on a keyboard. It can be software or hardware and may expose passwords and messages.

Changing a password on an infected device can let a keylogger capture the replacement.

L

Layered security

Layered security uses several different protections together, so one layer can stop a threat that another layer misses.

Updates, malware checks, firewall rules, and careful choices cover different risks.

Lookalike domain

A lookalike domain resembles a trusted address but changes characters, adds words, or uses a different ending.

A digit 1 in place of a letter l can make a fake name easy to overlook.

M

Malware

Malware is software designed to harm devices, steal or spy on data, or take control without the owner’s permission.

A harmful program may fit several labels describing its spread and actions.

Malware infection

A malware infection occurs when harmful software is present on a device and can carry out unwanted actions.

A slow device needs investigation because slowness also has ordinary causes.

Master password

A master password unlocks a password manager’s vault, so it needs especially strong and careful protection.

A long random passphrase protects access to a manager’s saved passwords.

MFA fatigue

MFA fatigue is pressure from repeated sign-in approval requests that tries to make the account owner approve one.

Tapping approve to stop unwanted prompts may let an attacker finish signing in.

Multi-factor authentication

Multi-factor authentication requires two or more different factor types before allowing access to an account.

A password and a code from a registered phone combine knowledge and possession.

O

Official app store

An official app store distributes apps through a device platform’s service and checks them, reducing but not removing risk.

Checking a listed developer still matters because fake apps sometimes get through.

Offline backup

An offline backup is disconnected from the working device or network, helping keep its files beyond malware’s reach.

A learner unplugs the backup drive after the scheduled copy finishes.

Offline password guessing

Offline password guessing tests guesses against a stolen password database without using the service’s login page.

A login attempt limit cannot control tests made against a separate stolen copy.

One-time code

A one-time code is a short-lived sign-in secret that works once, often supplied by a text message or authenticator app.

A code requested by a stranger could complete the stranger’s attempted sign-in.

P

Passkey

A passkey signs in using a secret key tied to the real service, unlocked through a device PIN or biometric check.

A copied sign-in page cannot collect a reusable password from a passkey user.

Passphrase

A passphrase is a password made from several words. Independent random word choices make the sequence unpredictable.

A dice-based word list avoids choosing words linked by a familiar theme.

Password

A password is a secret used to help prove control of an account. Strong passwords are long, unpredictable, and unique.

Separate passwords keep a leak at one service from unlocking another account.

Password manager

A password manager creates and stores passwords in an encrypted vault and can fill the right password on a saved site.

A learner keeps different long passwords without memorizing every one.

Patch

A patch is a software fix that repairs a flaw, often delivered as part of a security update from the maker.

Installing a patch closes the known weakness that it was designed to repair.

Payload

A payload is the harmful action malware performs after arrival, such as recording typing or encrypting files for ransom.

A disguised download can have a keylogger as its payload.

Personal data

Personal data is information that identifies someone or can be linked to them, including names, photos, and locations.

A uniform in a public photo may reveal which school someone attends.

Phishing

Phishing uses fake trusted-looking messages to get information, money, clicks, or the opening of harmful files.

A copied school sign-in link asks learners to enter passwords on another domain.

Phishing report

A phishing report flags a suspicious message or site to a service or responsible staff so that they can investigate and act.

Reporting in a game app can help block a scam targeting other players.

Pretexting

Pretexting uses a made-up story to persuade someone to reveal information or allow access. It is also called blagging.

A caller claims a school account needs urgent repair and asks for its password.

Private browsing

Private browsing limits saved local history and cookies after the private windows close, while network activity remains visible.

A school can still observe network use when a learner opens an incognito window.

Q

Quarantine

Quarantine isolates a detected file and prevents it from running while security software handles the possible threat.

A suspicious attachment remains blocked instead of being opened for inspection.

Quid pro quo

Quid pro quo offers help or a reward in exchange for information or access that the attacker should not receive.

A fake helper offers to fix a device if the owner shares a login code.

R

Ransomware

Ransomware locks a device or encrypts its files and demands payment for access. Some attackers also steal copies.

A separate clean backup can restore files without relying on a ransom payment.

Recovery scam

A recovery scam promises to recover money or an account, often for a fee, while seeking further money or information.

A stranger’s paid recovery offer after a takeover needs to be rejected.

Registered domain

A registered domain is the name controlled by its registrant, such as example.org, with extra subdomains placed before it.

In team.example.org, the prefix team is controlled through example.org.

Restore

To restore data is to recover it from a saved backup, making a usable copy available again after loss or damage.

Testing a restore shows whether the saved project can actually be opened.

Risk

Risk combines the likelihood that an attack will succeed with the amount of harm that success could cause.

Losing control of email creates high risk because it can unlock other accounts.

S

Scareware

Scareware uses fake security warnings to frighten people into unsafe steps such as calling a scam number or installing software.

A web pop-up claims dozens of infections and pushes a download button.

Screen lock

A screen lock requires a PIN, password, or biometric check before someone can resume access to an unattended device.

Locking a phone protects its signed-in accounts when the owner steps away.

Security question

A security question checks a secret answer, often for account recovery, but public or guessable answers weaken the check.

An invented pet name saved privately avoids an answer visible in public photos.

Security scan

A security scan checks files and programs for signs of malware using the security tool’s available detection methods.

A full scan helps investigate unexpected apps and repeated unwanted pop-ups.

Shoulder surfing

Shoulder surfing observes someone entering a secret, such as a password or PIN, directly or through a camera.

Shielding the keypad reduces the view available to a nearby observer.

Signature-based detection

Signature-based detection matches files against stored patterns from known malware, using a database that needs regular updates.

An updated signature lets a scanner recognize a previously identified Trojan.

SIM swap

A SIM swap moves a phone number to another SIM, which criminals may arrange by deceiving the phone company.

Texted login codes can reach a criminal after the number has been moved.

Smishing

Smishing is phishing through text messages or messaging apps, often using a link or urgent request.

A message about an unexpected parcel directs its reader to a fake payment page.

Social engineering

Social engineering manipulates people into sharing information, giving access, paying money, or taking unsafe actions.

A fake support worker uses authority and urgency to request a password.

Spear phishing

Spear phishing targets a person or group using real details to make the fake request seem especially convincing.

A scam names a learner’s club and coach to make its sign-in request believable.

Spyware

Spyware secretly collects information from a device, such as browsing activity, messages, locations, or passwords.

A hidden program sends private browsing details to someone without permission.

Standard user account

A standard user account limits system-changing permissions and needs extra approval for some installations or settings changes.

Daily schoolwork runs without granting every program full administrator access.

Syncing

Syncing keeps files matching across locations by copying changes, which may include unwanted edits, deletions, or encryption.

Deleting a synchronized file can remove it from several devices at once.

T

Tailgating

Tailgating follows someone with permission through a locked door without separate authorization to enter.

A stranger slips behind a staff member into a room with controlled access.

Threat

A threat is something that could cause harm to devices, accounts, networks, or data, such as criminals sending scams.

Scammers trying leaked passwords are a threat to accounts that reuse them.

Trojan

A Trojan disguises itself as useful or wanted software so someone installs it. It does not copy itself.

A supposed free cheat tool secretly installs software that steals information.

Two-factor authentication

Two-factor authentication is MFA using exactly two factors from different types, also called 2FA or 2-step verification.

Two passwords alone do not qualify because both belong to the knowledge type.

U

Unauthorized access

Unauthorized access means entering a system or account without permission, even when someone knows a working password.

Seeing a friend type a password gives no permission to sign in as that friend.

V

Virus

A virus attaches to a host file or program and copies into other files when it runs, spreading as infected files are shared.

Opening an infected host file can start the virus and spread it into more files.

Vishing

Vishing is phishing through voice calls, where a caller imitates a trusted person or organization to obtain something.

A caller claiming to be account support asks the owner to read a login code aloud.

VPN

A VPN encrypts traffic between a device and its provider, protecting that route while requiring trust in the provider.

A VPN protects local-network traffic but cannot make a scam website honest.

Vulnerability

A vulnerability is a weakness that a threat can use to cause harm, such as a known software flaw or a reused password.

An old app with a missing security fix leaves a weakness attackers can use.

W

Worm

A worm is standalone malware that copies itself between devices across a network without needing a host file or user opening.

Unpatched network software can let a worm move from one computer to another.

WPA2 and WPA3

WPA2 and WPA3 are Wi-Fi security standards used to encrypt wireless connections and protect access to a network.

A home router uses one of these standards with a strong Wi-Fi password.

Z

Zero-day vulnerability

A zero-day vulnerability is attacked before the maker knows about it or has a fix ready, leaving no available patch yet.

Other protection layers still matter while the maker prepares a security fix.

#

3-2-1 rule

The 3-2-1 rule calls for three copies including the original, on two storage types, with one copy kept offsite.

A phone original, cloud backup, and external-drive copy can meet the rule.

About this lesson

By StudeliPublished November 13, 2026Report a mistake

Keep learning

More courses

Make your own Study Materials

Turn your notes, slides and documents into Study Guides, Practice Questions, Flashcards and 6 more tools.

Get Started