Online Safety

What makes a strong password?

• AYour first name followed by 123, which is easy to remember and hard for others to guess
• BYour date of birth written in full
• CA single dictionary word in lower case, changed to a new word every week for extra safety
• DA mix of upper and lower case letters, numbers and symbols of at least 8 characters✓

Answer: A strong password is long and hard to guess, so mixing upper and lower case, numbers and symbols across at least 8 characters is far safer than a name, a date of birth or a single dictionary word. Current NCSC advice is that length matters most, which is why it recommends joining three random words.

What is 'two-factor authentication' (2FA)?

• AHaving two separate email accounts for work
• BSigning in from two different devices at the same time
• CA second verification step (e.g. a code sent to your phone) in addition to your password✓
• DSetting two different passwords on the same account so that both must be typed in at sign-in

Answer: 2FA adds an extra security step beyond the password — such as a code sent by text message — making it much harder for attackers to access your account.

What is 'malware'?

• AA type of email service that filters junk messages out before they reach your main inbox
• BSoftware designed to damage, disrupt or gain unauthorised access to computer systems✓
• CA social media platform used for sharing photographs and messages with friends and family
• DA method of searching the internet by typing key words into a search engine such as Bing

Answer: Malware (malicious software) includes viruses, ransomware, spyware and trojans — programmes designed to harm your device or steal data.

What is a 'phishing' attack?

• AA deceptive attempt to trick you into revealing personal or financial information✓
• BA computer virus that copies your files and stores duplicates of them on the hard drive
• CA slow connection caused by too many users
• DSoftware that secretly records every key you press so it can be read by someone else

Answer: Phishing uses fake emails, websites or messages pretending to be legitimate organisations to steal passwords, bank details or other sensitive data.

Which of these is the safest way to create and remember multiple strong passwords?

• AUse your pet's name followed by your year of birth for all accounts
• BUse the same password for all accounts
• CUse a reputable password manager✓
• DWrite passwords on a sticky note attached to your monitor

Answer: A password manager stores unique, complex passwords securely, meaning you only need to remember one master password.

What should you do if you think your account has been hacked?

• AChange your password immediately and enable 2FA if not already active✓
• BDelete the account and reopen it with the same password
• CWait a few days to see if the problem clears up on its own
• DSend a warning to your contacts and change nothing else

Answer: Changing your password immediately limits the attacker's access. Enabling 2FA adds further protection. Report the breach if financial data is involved.

What is a 'firewall' used for?

• ATo increase your internet speed by giving priority to downloads over other network traffic
• BTo back up your files to cloud storage
• CTo cool the processor down when the computer overheats after very long periods of heavy use
• DTo monitor and control incoming and outgoing network traffic to protect against threats✓

Answer: A firewall is a security system that monitors network traffic and blocks unauthorised access while allowing legitimate communications.

What is 'antivirus software'?

• AA tool that speeds up your internet connection
• BA tool that compresses files to save space
• CA programme that creates secure passwords
• DA programme that detects, quarantines and removes malicious software from your device✓

Answer: Antivirus software scans your device for known malware signatures and suspicious behaviour, protecting it from viruses and other threats.

What does 'HTTPS' in a web address indicate?

• AThe website requires you to log in before any of its pages can be viewed
• BThe website is registered in the UK
• CThe website is for commercial use only
• DThe connection between your browser and the website is encrypted✓

Answer: HTTPS (HyperText Transfer Protocol Secure) means the data sent between your browser and the site is encrypted, protecting it from interception.

Why should you avoid using public Wi-Fi for online banking?

• APublic Wi-Fi is much slower than home broadband, and banking apps need a fast connection to work
• BPublic Wi-Fi uses far more mobile data than a home connection, so your allowance runs out
• CPublic Wi-Fi networks may not be secure, and others could intercept your financial data✓
• DBanks block any customer who signs in from a public network and lock the account for 24 hours

Answer: Unsecured public Wi-Fi networks can expose your data to eavesdroppers. Always use a trusted, private connection for financial transactions.

What are 'privacy settings' on social media platforms?

• AControls that block adverts from appearing
• BSettings that control how quickly the platform loads pages and how much data it uses
• CControls that determine who can see your profile, posts and personal information✓
• DSettings that change the colour scheme of the app

Answer: Privacy settings let you control who can see your posts and profile — restricting to friends only limits exposure to strangers.

What is a 'virus' in computing terms?

• AA self-replicating malicious programme that attaches to files and spreads to other systems✓
• BA physical defect in one of the computer's chips that stops the machine starting up properly
• CA type of unwanted spam email advertising products
• DA hardware fault in the graphics card that makes the screen flicker and the colours look wrong

Answer: A computer virus is malicious code that copies itself and spreads by attaching to legitimate files, potentially causing damage or data loss.

What should you look for to check if a website is legitimate before entering personal details?

• AThe website appears on the first page of Google search results, which means it has been checked and approved by the search engine
• BThe website displays customer reviews and a 'secure site' badge image in the footer, which proves the payment page is genuine
• CThe website loads quickly and has a professional design with no spelling mistakes on the homepage
• DThe website has a padlock icon and HTTPS in the address bar, and a recognisable, correctly spelled domain name✓

Answer: A padlock and HTTPS show only that the connection is encrypted — criminals use HTTPS on fake sites too, so it is not proof a site is genuine. Always check the domain name carefully for misspellings or extra words before entering personal details.

What is 'ransomware'?

• AA fake antivirus pop-up that charges a fee to remove infections that do not actually exist
• BA tool that copies your files to a paid cloud service every night
• CA software licence that must be renewed each year before the program will run
• DMalicious software that encrypts your files and demands payment to restore access✓

Answer: Ransomware locks or encrypts your files and demands a ransom payment (often in cryptocurrency) for the decryption key.

What is 'spyware'?

• ASoftware that monitors your device use and collects data without your knowledge✓
• BA program that displays unwanted pop-up adverts and changes your browser home page
• CAn email filter that scans incoming messages and moves suspected junk mail into a separate folder
• DA delivery app that tracks the location of your parcels in real time

Answer: Spyware secretly monitors your activity, keystrokes or personal data without consent, sending the information to a third party.

What is 'social engineering' in the context of cybersecurity?

• APlanning and scheduling social media posts across several platforms to get the maximum number of likes and shares
• BA network design in which computers are linked together so that they can share files and printers
• CThe process of designing the layout and features of a social media platform
• DManipulating people psychologically to reveal confidential information or perform actions✓

Answer: Social engineering exploits human trust and psychology rather than technical vulnerabilities — for example, pretending to be IT support to get your password.

Why should you keep your device's operating system up to date?

• AUpdates free up storage space by permanently deleting files and photos you have not opened recently
• BUpdates are required before your warranty or insurance cover will remain valid
• CUpdates often include security patches that fix vulnerabilities attackers could exploit✓
• DUpdates make the screen respond faster to touch gestures

Answer: Security updates fix known vulnerabilities in the operating system. Running outdated software leaves you exposed to attacks that exploit those gaps.

What does it mean to 'log out' of an account when using a shared device?

• ATo close the device down completely so that all running programs are shut off safely
• BTo end your session so the next user cannot access your account✓
• CTo store your username and password on the device so you can sign in faster
• DTo disconnect the device from the wi-fi network

Answer: Logging out ends your authenticated session, preventing other users of the same device from accessing your account and personal data.

What information should you NEVER share online with someone you do not know?

• AThe name of a television programme you enjoy watching in the evening
• BYour opinion of a film you both watched recently
• CYour favourite colour or football team
• DYour home address, phone number and financial details✓

Answer: Personal identifying and financial information should never be shared online with strangers as it can be used for identity theft, fraud or physical harm.

What is a 'data breach'?

• AA written agreement setting out how a company may use the data it collects about you
• BThe process of wiping a hard drive so that files cannot be recovered afterwards
• CAn incident where personal or sensitive data is accessed, stolen or disclosed without authorisation✓
• DA gap in mobile signal that stops an app from downloading new information

Answer: A data breach occurs when confidential data is accessed by an unauthorised party — for example, hackers stealing customer records from a company.

What is 'identity theft'?

• AWhen you share one streaming account login with several members of your family
• BWhen someone uses your personal information without consent to commit fraud or other crimes✓
• CWhen you forget which email address you used to register and cannot sign in
• DWhen a company keeps your details for longer than it is allowed to

Answer: Identity theft occurs when criminals use your personal information (name, address, financial details) to open accounts, take out loans, or commit fraud in your name.

What does a padlock, or similar site-information icon, in the browser address bar mean?

• AThe website is hosted in the UK and follows UK consumer law
• BThe site has been scanned for viruses by your web browser
• CThe page is locked and needs a paid subscription
• DThe connection to the website is encrypted (HTTPS)✓

Answer: The icon shows the site is using HTTPS, which encrypts data between your browser and the server so it cannot be read in transit. Browsers show this indicator differently and change it over time, so the reliable check is 'https://' at the start of the address. It does not mean the site is honest — criminals use HTTPS too.

Why should you be cautious about clicking links in emails from unknown senders?

• AThe links may lead to malicious websites designed to steal your information or install malware✓
• BUnknown senders usually attach very large files, and opening their links can quickly fill up your device storage
• CYour email provider charges a small amount of data allowance each time an external link is opened
• DEmails from unknown senders get deleted after seven days, disabling the link

Answer: Malicious links can redirect you to fake websites that steal login details, or trigger malware downloads. Always verify the sender before clicking.

What is a 'cookie' in the context of web browsing?

• AA complete copy of a web page saved by your browser so the site loads faster next time you visit it
• BA small file stored on your device by a website to remember your preferences and session information✓
• CA bookmark that stores the web addresses of the sites you visit most often
• DA tracking program that records your exact location and sends it to advertisers

Answer: Cookies store small pieces of data (like login status or preferences) on your device so websites can remember you between visits.

What should you do with a suspicious link before clicking it?

• AHover over the link to preview the web address and check it matches the expected destination✓
• BOpen the link in a private or incognito browsing window, because private mode blocks harmful content and hides you from the site
• CForward the message to your own email address first, so that you can open the link safely from a second inbox
• DCopy the address and paste it into a social media post so other people can tell you if it is safe

Answer: Hovering over a link shows its true web address in the browser status bar. If the address looks unusual or is not the site you expect, do not click it.

What is 'screen time management'?

• AA setting that schedules when your device downloads and installs its updates so it is not interrupted while you are using it
• BA display feature that dims the screen and reduces blue light in the evening to make reading more comfortable
• CMonitoring and limiting the amount of time spent on devices to maintain a healthy digital balance✓
• DA parental control that stops children installing new apps unless a grown-up types in a passcode first

Answer: Screen time management involves tracking and limiting device use to prevent excessive use that can affect sleep, wellbeing and productivity.

What is 'cyberbullying'?

• ABullying or harassment carried out through digital platforms such as social media, messaging or email✓
• BSending the same message to a large number of contacts at once without their permission, usually to advertise something
• CGaining access to another person's device or account without permission in order to view or change their files
• DAccidentally deleting a colleague's work in a shared document you are both editing

Answer: Cyberbullying uses digital technology to repeatedly harass, threaten, humiliate or harm others. It is harmful and in some cases illegal.

What does 'encrypting' a file mean?

• AConverting the file into a coded format that can only be read with the correct key or password✓
• BUploading a second copy of the file to a cloud service so that it can be restored if the original is lost
• CCompressing the file into a zip archive so that it takes up less space and can be emailed more easily
• DOverwriting the file several times so that it cannot be recovered by software

Answer: Encryption scrambles the contents of a file using an algorithm so that only someone with the correct decryption key can read it.

What is a 'VPN' used for?

• ATo create a secure, encrypted connection over the internet, hiding your IP address and protecting your data✓
• BTo store and synchronise your files online so you can open them from any device
• CTo block pop-up adverts so that pages load faster
• DTo manage which cookies a website is allowed to place on your device

Answer: A VPN (Virtual Private Network) encrypts your internet traffic and routes it through a server, protecting your data and masking your location.

What is the risk of using the same password for multiple accounts?

• AWebsites detect that the password is already in use elsewhere and force you to reset it every few weeks
• BYour browser saves the same password many times over, which gradually slows the device down and uses up storage
• CIf one account is breached, attackers can use the same password to access all your other accounts✓
• DTwo-factor authentication stops working once a password is used on more than one site

Answer: Reusing passwords means a single breach can compromise every account using that password — a technique called credential stuffing.