Online Safety & Awareness

This quiz is designed to test and strengthen your understanding of real‑world security threats that commonly occur in the workplace. Each question presents a practical scenario, such as suspicious emails, unexpected MFA prompts, data‑handling issues, or social engineering attempts and asks you to choose the safest and most appropriate response.

The goal of this exercise is to help you confidently recognise potential security risks, make informed decisions, and follow best practices that protect both you and the organisation. By working through these scenarios, you’ll gain better awareness of common cyber threats and reinforce the essential habits needed to maintain a secure working environment.

Make your attempt count, there’s only one chance to pass this quiz.

By continuing, you agree that System Force can use your details to send you your quiz results by email.

1 / 15

Your screen locks with a message demanding Bitcoin to recover files.

Pay the demanded Bitcoin as quickly as possible in the hope of regaining access to your encrypted files

Download and run an unverified “unlocker” tool from the internet, despite the significant risk of further infection

Restart the computer and hope that rebooting will resolve the ransomware message on the screen

Disconnect from the network (Wi‑Fi/ethernet), do not power off, and contact IT/security immediately

2 / 15

You find a labelled USB stick in the office car park ('Q4 Payroll').

Plug the device into your own computer to check its contents, despite the possibility of hidden malware

Keep the device with you in case someone asks about it later, even though it may contain harmful software

Leave the USB stick on a colleague’s desk for them to deal with, without confirming whether it is safe

Give the USB stick to IT or security for proper handling and investigation to avoid any potential risk

3 / 15

Near end‑of‑day, a message from ''Your Manager' asks you to urgently process a payment and keep it confidential. The email is from a free mail domain.

Process the payment immediately to be helpful, even though the message comes from a free email domain

Call your manager on a known number or through Teams to verify the request, and report the suspicious message to IT or security

Forward the email to the Finance team and mark it as urgent without checking its authenticity first

Reply to the sender asking for additional details, despite the unusual urgency and unfamiliar address

4 / 15

A large file won’t email, so you plan to upload to your personal Google Drive and share a link with a supplier.

Split the document into smaller sections and send each part separately by email

Share the file through your personal WhatsApp account, bypassing standard procedures

Proceed with the task because it seems efficient, despite potential security concerns

Use approved company sharing tools with correct permissions

5 / 15

A colleague sends a chat: 'Is this you in this video? 😂' with a download link. The message style seems off.

Click the link to view the video and check whether it is really about you, and then consider sharing it afterwards

Verify the message by contacting your colleague through a known and trusted channel, and report it if anything seems suspicious

Download the linked video file and scan it locally before opening, assuming this makes it safe to view

Ask your colleague for more context in the same chat and proceed to click the link despite the unusual message style

6 / 15

You see a stack of printouts with customer data left on the office printer.

Leave the printouts on the printer since they aren’t yours, assuming the owner will collect them eventually

Put the documents straight into the recycling bin immediately, without checking ownership or data‑handling requirements

Take a quick photo of the customer information so you can report it to your supervisor later on

Secure the documents by placing them face down or collecting them, notify the owner or IT, and follow the clean‑desk policy

7 / 15

Someone calls claiming to be a senior exec and demands a password reset 'now, no security questions.' Caller ID shows 'Private.'

Provide assistance promptly while ensuring the situation does not escalate further

Follow identity verification procedures strictly or escalate to security

Offer to send a secure password reset email to help them regain access

Request their full date of birth as part of the verification process

8 / 15

Working in a shared workspace, someone sits behind you while you handle payroll data.

Ask the person behind you to move elsewhere rather than adjusting your own setup or improving screen privacy

Enable a privacy screen, adjust your position to prevent viewing, and lock your device whenever you step away

Continue working without making changes, assuming the bright screen will not reveal sensitive payroll data

Slightly tilt your screen in an attempt to reduce visibility, even though the information may still be exposed

9 / 15

You receive an email saying: 'Your Microsoft 365 password expires today. Click here to reset.' The sender’s address is unfamiliar and the link is shortened.

Click the shortened link immediately and reset your password quickly, trusting that the email is genuine

Forward the suspicious email to your team to ask if it seems legitimate before taking further steps

Ignore the email entirely and take no action, assuming that any real expiry issue will resolve itself

Open a browser and visit the official Microsoft 365 portal directly to confirm the message, or contact IT for verification

10 / 15

A printed flyer in reception says 'New visitor system — scan to log in.' The URL looks odd after scanning.

Proceed with the login process as long as the webpage appears to load normally, despite the unusual-looking URL

Share the QR code with your team so they can access the same page, without verifying whether it is legitimate

Bookmark the questionable page so you can return later and use it again for logging into the visitor system

Close the suspicious page and manually enter the official visitor system URL, or confirm the details with Reception or IT

11 / 15

A pop‑up says: 'Critical update available — click here to install' from a browser window on a non‑IT website.

Click the install button directly from the pop‑up without verifying its authenticity

Close the browser, run updates via official OS/company update tool, and report the pop‑up

Restart the device and hope the suspicious pop‑up does not reappear afterward

Ignore the message completely and continue browsing as if nothing happened

12 / 15

You receive a text on your personal phone: 'Company IT: Your mailbox is full — verify now,' with a link.

Tap the link directly because the message mentions your company and appears related to your mailbox

Reply with the word STOP, assuming it will prevent further messages without verifying the sender’s legitimacy

Report via the company’s phishing channel, avoid clicking the link, and check your mailbox using the official app or portal to confirm

Forward the suspicious text to colleagues to ask whether they have seen anything similar before acting

13 / 15

You’re at a café needing to access company email and files.

Use your company VPN or a trusted personal hotspot before accessing any company email or files while working remotely

Email work files to your personal account so you can access them offline, even though this bypasses security controls

Connect to the public café Wi‑Fi because it is convenient and free, despite the risk to company data

Use the café’s public Wi‑Fi but restrict yourself to checking emails, assuming this poses minimal security risk

14 / 15

A long‑time supplier emails requesting a full customer list 'to reconcile invoices.' The request is unusual.

Validate the request with the supplier via known contacts and check data‑sharing policy before sending

Send the full customer file because the supplier is long‑standing and generally considered trustworthy

Ask your team whether anyone else has handled a similar request before proceeding with any data sharing

Share a redacted screenshot of the customer list to save time, despite the unusual nature of the request

15 / 15

You get multiple unexpected MFA prompts while you’re not logging in.

Deny the MFA requests but simply ignore the repeated prompts without taking further protective action

Deny the unexpected MFA prompts, reset your password immediately, and notify IT or security about the suspicious activity

Disable MFA in your device settings to prevent future interruptions, despite the security risks involved

Approve the authentication prompts to make them stop, even though you are not attempting to log in