An ordinary-looking message can ask for a risky action. With Nestor, inspect messages, compare addresses and try different decisions. No exercise click leaves this course. You can make a mistake, read the explanation and try again.

An email, a text, a call or a QR code: the channel changes, the trap stays the same. Select each object to discover the request. The channel does not prove fraud: look at what you are being asked to do.

Alex usually checks messages carefully. Between meetings, a request apparently from the team pushes Alex to act quickly. The trap exploits context and trust. It does not measure intelligence or competence. Pausing breaks the imposed pace.

Bruno is in a hurry. This polished message says access expires today and asks for a scan to keep the account active. Inspect the clues or go straight to the known portal: checking independently is already a good decision.

A genuine message can contain a typo. A fake one can be flawless. Urgency can be real, but does not justify bypassing a procedure. Consider context and the request, then check elsewhere. You do not need to prove fraud before asking for advice.

In this fictional address, https describes an encrypted connection. portal.northstar.example is the hostname, belonging here to northstar.example. /account is the path inside the site. A familiar name in a path or at the start of another address proves nothing. Suffixes can have several parts: do not learn a universal last-two-words rule.

Your usual portal is the first address. Break down the second: where do you really arrive? Both addresses can display a padlock. It indicates encryption, not a legitimate request. These exercise addresses are fictional and inert.

This text asks for a small fee to release a parcel. The amount seems negligible, but the form may request card details and a banking code. Check your order in the retailer’s or carrier’s known app. A low fee does not make the requested information less sensitive.

Anna-Maria wants to help a visitor find Wi-Fi. A sticker covers the poster and the destination requests a sign-in. The pattern shown here is not a real QR code. What do you do before entering anything?

Open a saved bookmark, your usual app or the internal directory. A number supplied in the suspicious message is not independent. A legitimate example: an expected invoice also appears in the supplier portal, and your usual contact confirms the change through the agreed procedure. Verification can let you proceed, not just refuse.

A caller says: your files may be lost, install our tool and give me its code. Bruno fears losing his work. The displayed number does not prove identity. Choose a response, then try the others to compare the consequences.

In the previous call, fear of losing files and the authority of support speed up the decision. You can say: I will call back through our usual support team. Someone who demands secrecy or refuses verification gives you another reason to pause the request. You do not have to argue.

You recognise a voice asking for an unusual payment. A voice can be imitated or reproduced. Apply the same callback and dual-approval procedure as for a written message. Neither resemblance nor pressure replaces independent verification.

The message appears in a familiar conversation. Alex seems to ask for your verification code to sign in. Even a real account can be compromised. Which decision protects the account without jumping to accusations?

A click alone, an entered password and an executed file are different situations. Stop interacting with the page and contact support promptly. Describe exactly what you did. If you ran a file, follow your organisation’s incident procedure. Do not improvise a cleanup that might erase evidence.

Alex entered a password in the simulation. Compare two possible outcomes. The aim is to limit harm without blame. Changing a password can be part of the response, but does not replace support reviewing sessions and access.

Include the message or page, the time, the device and what you did. For example: this morning on my work computer, I opened the link and entered my password, without running a file. Use the reporting button or designated channel. Do not forward the trap to the whole team. You do not need a certain diagnosis.

A page claiming to check your browsing suddenly asks you to leave the browser and perform an unusual system action. No actual command is shown here. Security-themed styling does not make the request safe. What do you do?

You expected meeting notes and receive this message from Anna-Maria. There is no typo or threat. Before reading the answer below, state your decision and reason. Can you find the document through your usual sharing workspace? Plausible context is a reason to check, not proof that the link is safe.

Check through another route. Resist pressure. Report promptly, including after a mistake. The aim is not to guess the scammer from their style, but to protect sensitive actions. Now try different situations in the mini quiz. You can revisit the activities at any time.

Payment fraud targets the decision to pay. A scammer may know a real project and use the name of an executive, supplier or lawyer. With Bruno, Anna-Maria and Alex, practise checking a request without letting urgency isolate you.

Urgency, secrecy, flattery and authority can combine. A legitimate request can also be urgent, so these clues do not prove fraud. They never justify bypassing procedure. Verify the payment even when the voice or signature seems familiar.

Bruno receives a message attributed to the CEO. It names the project but demands a secret payment before four. His manager is away. Which decision protects the project without accepting this exception?

Use a number already saved in the directory or supplier record, never one added to the suspicious message. Confirm changed bank details and require a second approval. A match between the account name and bank details alone does not prove the request is authorised.

Anna-Maria expects this invoice. The amount and supplier name are correct, but the bank account has changed. Even a real mailbox can be compromised. What should she check before updating the supplier record?

A caller may propose a test transfer or a move to a supposedly secure account. Do not act during that call. Hang up and contact your adviser through the usual details. A document sent by the caller is not independent verification.

Alex realises that the bank account was unusual. He feels embarrassed and hopes nobody will notice the transfer. Acting quickly may still help limit the loss. What should happen next?

Keep the message, payment references and correspondence under your procedure. Do not negotiate with the caller yourself. Your manager and responsible teams coordinate the bank, incident response and necessary follow-up. Reporting a mistake enables action; hiding it delays the response.

Before an unusual payment: call a known number, obtain a second approval, then proceed. After a mistake: alert immediately with the facts. In the quiz, identify the sensitive request and how to check it, rather than relying on writing style.

Ransomware can make files unusable and may involve data theft. Your role is not to solve the attack alone: it is to recognise an anomaly, limit spread and report it. Three situations will help you choose the first actions.

An unexpected attachment, stolen access, an unpatched flaw or unauthorised software can open the door. Do not disable protection to open a document. Use approved tools, multifactor authentication and updates arranged by support.

Bruno receives an unexpected invoice. The document will not display and asks him to disable protection. He wants to finish his accounts. Which choice avoids turning this opening problem into an incident?

Renamed files, unreadable documents, a ransom note or a protection alert deserve attention. Slowness alone does not prove an attack. Describe what you observe without repeated experiments or installing a cleanup tool found online.

Several files change names in front of Anna-Maria. She can phone support. The procedure calls for network isolation. Which first action limits the risk without erasing evidence?

Save work in locations backed up by the organisation. Synchronisation alone can replicate deletion or encryption. Technical teams maintain separate copies and test restoration. During an attack, do not connect a backup to the suspicious device yourself.

Alex finds a ransom demand and a contact supplied by the attackers. He wants his work back immediately. Who should handle this situation?

Keep a support or emergency number accessible outside your computer. Give the device, time and observed signs, then explain what you disconnected. Do not reconnect the device to see whether it has improved: wait for the response team’s instructions.

Avoid security exceptions. When worrying signs appear, follow the isolation procedure, report and preserve evidence. Backups are prepared before a crisis; restoration is coordinated with support. The quiz asks you to choose these actions in other situations.

Helpfulness can be exploited to obtain an open door, a badge or information. You can remain friendly while following the rules. With our three colleagues, practise offering a safe solution without acting as a security officer.

A uniform, a manager’s name or urgency makes a story plausible. None proves permission to enter. Check a visit with reception or a known internal contact. Someone in a hurry may be legitimate; the procedure still applies.

Bruno has just used his badge. Someone carrying boxes asks him to hold the secure door. He wants to help. How can he help without granting unverified access?

A visitor follows the agreed route: registration, badge and escort where required. Use the authorised guest network rather than an improvised internal connection. Report a propped-open door; never obstruct an emergency exit to solve a security issue.

A technician asks Anna-Maria for her badge to access a room alone. He names a manager and seems familiar with the building. Which response keeps verification in the right hands?

On the phone, someone may ask for a schedule, names or the software you use. Refer the request to the responsible team and verify identity through a known channel. Put your badge away outside the building and report its loss promptly so access can be disabled.

Alex finds a USB drive and wants to identify its owner. No visible sign establishes whether it is safe. Which solution helps return it without exposing a computer?

If the situation allows, calmly offer to help the person find reception. Notify reception or security under the procedure. Do not endanger yourself, pursue anyone or physically detain an intruder. For an immediate threat, follow emergency instructions.

One person, one verified authorisation. A badge stays personal. Unknown devices stay unplugged. These rules let you help without improvising access. In the quiz, look for a courteous response that hands verification to reception or the responsible team.

An account gives access to your messages, files and sometimes the team’s resources. We will combine three protections: a unique secret, an approval you initiated and, where supported, a phishing-resistant passkey.

Use the approved manager to create and store a long, different password for each account. A passphrase can protect the manager under internal guidance. Never reuse your work password on a personal service or give it to a colleague.

Bruno learns that a personal site suffered a breach. He uses the same password at work. This does not prove his work account was accessed, but which action reduces the risk?

Multifactor authentication adds proof beyond the password. Reject notifications you did not initiate and never read a code to a caller. Check the service and context of your own sign-in. A fake page can relay a code live: keep using your usual route.

Anna-Maria receives approval requests while she is not signing in. They are irritating and interrupt her work. Which decision avoids giving someone else access?

A passkey uses a cryptographic key tied to the service. You activate it by unlocking your device; the site does not receive your fingerprint. It resists fake domains. Use the approved solution and prepare its recovery process in case the device is lost.

Alex is going on leave. A trusted colleague offers to use his account to finish a task. How can work continue without sharing Alex’s digital identity?

Store recovery methods in a protected location under support guidance. Do not keep every backup access method only on the device it replaces. After a loss or shared code, report it: changing the password may not close every session.

A unique password in the approved manager. No unexpected approvals or shared codes. Passkeys where offered and recovery prepared in advance. In the quiz, protect both the secret and the action a request asks you to approve.

An open session, a forgotten document or a visible notification can reveal more than intended. With Bruno, Anna-Maria and Alex, we will protect the workstation, papers and screen sharing. The right habit should stay simple, even on a busy day.

Lock your session whenever you leave: Windows and L on a PC, Control, Command and Q on a Mac. Closing a window does not lock the account. Keep automatic locking and a passcode on your phone too. Never lend your session, even for printing.

Bruno gets up for coffee. A customer file remains visible and visitors use the room. He expects to return quickly. Which action protects his session without delaying him?

Store sensitive files in the designated furniture. Collect printouts immediately or use secure print release. Clear the board and collect notes after meetings. Confidential papers go through secure disposal; passwords belong in the manager, not on a sticky note.

Anna-Maria needs to print confidential documents. A meeting is starting and she cannot collect them now. Which arrangement avoids leaving the records for everyone to see?

Before a video call, close private material, hide notifications and choose a single window to share. Check the background and board behind you too. In an open space, position the screen to limit viewing; a privacy filter can supplement these habits.

Alex is demonstrating a tool to a customer. A notification reveals an internal topic. He can still stop sharing and prepare a dedicated window. Which response reduces exposure and addresses what was shown?

Put papers away, secure devices under local guidance and check the meeting room. A locked screen does not protect a laptop against theft. If you find an open session, follow internal practice and notify its user without reading messages or playing a prank.

Lock whenever you leave. Store and dispose of papers through the right processes. Before sharing, reduce what becomes visible. These small actions protect identity and confidentiality without complicating the day. The quiz lets you apply them to new cases.

At home, on a train or in a hotel, work information remains sensitive. We will choose an appropriate place, connection and device. Travelling changes the context, not confidentiality rules or the need to report a loss.

Use the authorised device, keep it updated and lock it even at home. Do not lend the session to family. Secure home Wi-Fi and follow instructions for the organisation’s private network. Sensitive calls and printouts should stay out of reach of other occupants.

Bruno receives a call about a negotiation while nearby passengers can hear. His screen also shows prices. How can he continue work without turning the carriage into an open meeting room?

A network can copy a hotel or airport name. Prefer an authorised mobile connection or follow support guidance for Wi-Fi and the private network. Do not bypass a certificate warning. A private network does not make a site’s deceptive request safe.

Anna-Maria wants to send a document from a hotel. The portal asks for a certificate and her work credentials. This is not her organisation’s approved process. Which option lets her continue without this installation?

Before travel, take only the data you need and ask support about any specific guidance. Keep devices with you, use your own charger and disable automatic connections to open networks. A filter protects against viewing, not theft.

Alex cannot find his bag when leaving a café. The laptop was locked. He hopes to recover it tomorrow. Which choice gives the organisation a chance to protect access promptly?

If a connection fails, do not switch to a personal account to send work files. Explain the need to support and the recipient. Keep an emergency contact accessible without your computer. While travelling too, a factual report is better than a hidden workaround.

Protect what can be seen and heard. Use the authorised connection and device. Keep equipment under your control and report a loss immediately. In the quiz, consider nearby people as well as the technical security of the connection.

An assistant can draft and summarise, but your request may contain sensitive information. We will distinguish what can be shared with the tool, what needs checking in its answer and which actions remain under your control.

Check that both the tool and the use are authorised. A file, screenshot or recording can contain personal data, secrets or internal information. Retention depends on the service. Deleting a conversation does not guarantee recall of data already transmitted.

Bruno wants to upload his customer file to draft follow-ups. The tool has not been approved. Removing only emails would leave names and histories. How can he get writing help without sending this file?

The assistant can confidently invent a reference or figure. Check important facts in the original source, review the result and adapt it to context. An approved tool is not infallible. Keep appropriate human approval before sending, paying or deleting.

Anna-Maria is preparing a briefing. The assistant cites a study, but she cannot find the title or publication. Her manager is waiting. How should she handle this passage before sending it?

An assistant reading a page or document may encounter an instruction trying to redirect its task. Limit access to what is needed and review proposed actions. Extensions and meeting bots also need approval: they can read or record work information.

Alex recognises a manager’s voice asking for a payroll export to a personal address. A voice can be imitated. Which decision checks the request without relying on resemblance alone?

Promptly report the tool, account, time and nature of the data sent. Do not paste sensitive data again into an unsuitable channel to explain the incident. Support and the responsible specialist will assess access, deletion options and necessary follow-up.

Choose an approved tool and use. Minimise the data sent. Check answers and actions. A familiar voice or face does not replace verification of a sensitive request. The quiz asks you to retain AI’s usefulness while protecting information.

A named address, photo or case number can relate to an identifiable person. Protecting this information depends on everyday access, recipients and comments. We will choose the minimum needed and respond when information goes to the wrong place.

Removing a name is not always enough: a number or combination of details may still identify someone. Take particular care with information such as health data. Ask the responsible contact whether your task needs this data and which tools and recipients are authorised.

Bruno prepares an invitation for customers who do not know one another. He has put every address in the recipient field. Which change avoids revealing the list to the other participants?

Collect necessary information, share it with authorised people and apply the agreed retention period. A temporary export should not be forgotten in downloads. Use approved spaces and access permissions, never personal email to take a file away.

Anna-Maria has just had a tense conversation. She needs to leave a useful note for the person calling back. Which wording records facts without judgment or guesses about the customer’s life?

A customer or colleague may request access, correction or deletion of their data. Forward the request promptly to the data protection officer or designated contact. Do not promise immediate deletion or erase a record before applicable obligations have been checked.

Alex notices he attached the salary spreadsheet instead of the schedule. It went to a supplier. He tries recalling the message. Which action must accompany that attempt?

Loss, unintended access, a wrong recipient or accidental deletion can affect personal data. Report facts without waiting for a diagnosis. The responsible contact assesses risk and organisational obligations; your role is to provide reliable information promptly.

Before collecting or sharing: is it necessary, for whom and in which tool? Keep comments factual. Route rights requests and report mistakes. In the quiz, think about the people concerned, not just the file you handle.

Public information can be combined to prepare a highly convincing request. A photo, an absence and a job title may complement one another. With our three colleagues, we will choose what can be published and check people seeking more information.

Open-source intelligence uses publicly accessible information. It is not necessarily malicious, but a scammer can learn names, tools and timing from it. A well-informed request therefore does not prove that its sender is authorised.

Bruno wants to publish a good team photo. Behind the smiles, a badge and customer information are readable. Which preparation shares the moment without sharing these details?

In an external absence message, provide useful information under internal policy without describing travel or the team’s full structure. Check the audience of personal accounts. Real-time posts and games asking personal details can build a detailed profile.

Someone asks Anna-Maria about software, approval steps and holiday deputies. They introduce themselves as a student. Which response protects the organisation while allowing a legitimate request to be considered?

A fake colleague or recruiter can gain credibility through mutual connections. Verify independently before sending an internal document or installing a test. A professional photo and posting history do not replace verification.

Alex receives an attractive offer with a program to run for an interview. He knows the recruiter only through a profile. How can he explore the opportunity without running the file on his work device?

If sensitive information was published, limit visibility or remove it under guidance, then report what was exposed. Deletion does not guarantee no copy exists. Give the link, time and nature of the content to the responsible contact without spreading the information further.

Before publishing, check the text, background and audience. Before answering, verify who asks for what and why. Route sensitive internal requests to the authorised team. The quiz helps you spot details that together reveal more than intended.

Updates fix vulnerabilities, but a fake alert can also push you to install a trap. We will recognise the update process, choose approved software and explain a need when the official tool is not enough.

Accept system and support updates within the agreed deadlines. Save your work and plan the required restart. Phones, browsers and extensions matter too. Report devices at end of support: they may need replacement or special handling.

Bruno has postponed a restart requested by the organisation’s tool for several days. He has documents open. How can he complete the update while preserving his work?

A web page claiming to detect an infection or demanding a new player may be deceptive. Do not download its file or call its number. Open the usual update settings, the organisation’s catalogue or contact known support to check.

Anna-Maria opens an article. A page announces that her browser is outdated and provides a download. How can she check for a real update without using this file?

Install only authorised software and extensions. An official store does not replace reviewing permissions and need. A tool may request access to pages, files or an account. Avoid pirated versions and never disable protections to make them work.

Alex needs to convert a contract and the usual tool fails. A free site offers conversion by uploading the file. How can he solve the problem without sending the contract to an unknown service?

Personal storage, private email, converters or unapproved assistants create access the organisation does not control. If you already used one, report which tool and what data went through it. Support can arrange a transition and offer a replacement.

Complete updates through the intended process. Check alerts by finding that process yourself. Before installing or uploading, check approval. If a tool is missing, explain the need to support. The quiz distinguishes legitimate fixes from risky detours.

You do not need to prove an attack to report an anomaly. A mistake, loss or unusual request deserves a description. With Bruno, Anna-Maria and Alex, we will prepare a prompt, factual and useful report, without blame or improvised investigation.

Suspicious messages, entered codes, unexpected notifications, lost devices, wrong recipients or unknown visitors: reporting is not just about viruses. Describe what you know. A qualified team will assess severity; waiting for certainty can delay useful measures.

Bruno spots a suspicious message without opening anything further. He thinks reporting is pointless because he did nothing. Which choice can also protect colleagues who might receive the same message?