Staying Safe & Legal Online

A workplace laptop is exposed to threats such as phishing, ransomware, identity theft and malicious software. At Level 2, what does evaluating cybersecurity risk require beyond simply recognising that these threats exist?

• AChanging your email password each time a new virus is reported in the news
• BLearning the definitions of each threat type, so they can be named correctly
• CInstalling antivirus software once and assuming future threats are blocked
• DAssessing how each specific threat could impact devices, data and personal security in a given situation✓

Answer: Cybersecurity threats such as phishing, ransomware and identity theft carry different levels of risk depending on the situation. Level 2 practice requires assessing how each specific threat could affect devices, data and personal security, not just recognising that the threat exists. Simply naming threat types stays at a basic recall level, a single antivirus install does not guard against future risks, and reacting to individual news stories is not a systematic evaluation.

Before entering payment details into a website or app, what should you do to apply Level 2 cybersecurity practice?

• AEnter the payment details first, and only check the site's reputation afterwards once a problem has already occurred
• BAssess whether the website, app or platform is safe to use before entering any personal or financial information✓
• CWait for a pop-up warning to appear before deciding whether the site can be trusted at all
• DCheck for a padlock icon and treat its presence alone as proof that the site is completely safe

Answer: Secure connection indicators such as a padlock icon show that a connection is encrypted, but they do not confirm that a site or seller is legitimate. Level 2 practice means assessing the overall safety of a website, app or platform before entering personal or financial information. Treating a padlock as complete proof of safety is a common but incorrect assumption, and entering details first or waiting passively for a warning both leave you exposed before any check has taken place.

You need to check your online banking on a public library computer. Which browser practice reduces cybersecurity risk on a shared device?

• AUse the same password that you use on your own personal devices, just for convenience
• BSave your login details on the shared computer so you do not need to re-enter them if you return later
• CRely on the library's antivirus software to keep your session private
• DAvoid saving passwords and clear cached logins after finishing on the shared device✓

Answer: Shared and public devices can retain saved passwords and cached logins that anyone using the device afterwards could access. Level 2 practice is to avoid saving passwords and to clear cached logins once you finish using a shared device. Saving details for convenience, reusing a personal password, or relying only on the library's antivirus software all leave your account exposed to the next user.

In a workplace setting, why is it important to explain how poor cybersecurity practices affect the organisation, not just the individual?

• APoor cybersecurity habits affect the individual employee's own personal device, rather than others on the wider team
• BWeak cybersecurity habits can lead to data loss, financial harm and reputational damage across a shared environment✓
• CIT departments are responsible for cybersecurity, so individual habits make little real difference to the organisation
• DCybersecurity mainly matters for protecting personal social media accounts rather than anything used at work each day

Answer: Poor cybersecurity habits in a workplace can lead to data loss, financial harm and reputational damage that affect the whole organisation, not just the individual involved. Level 2 practice includes being able to explain this wider impact. Poor habits are not limited to one device, IT departments cannot compensate for unsafe individual behaviour, and cybersecurity extends well beyond personal social media use.

A colleague receives a text claiming to be from a delivery company, with a link to confirm an address. What Level 2 skill helps identify whether this message is genuine before responding?

• AIdentifying the features that make computer-generated messages or links look authentic, then verifying before responding✓
• BClicking the link immediately, without checking where it actually leads first
• CAssuming any message that mentions a real company name must therefore be genuine
• DWaiting to see if the delivery company confirms the message on social media later

Answer: Messages that appear to come from real organisations can still be fake, so it is necessary to check whether a link or request is genuine before responding. Level 2 practice involves identifying the features that make such messages look authentic and verifying them independently. Clicking the link straight away risks exposure before any check is made, assuming a message is genuine simply because it names a real company ignores how easily this can be faked, and waiting for unrelated social media confirmation is not a reliable verification method.

You are setting up a new social media account and already use several other platforms. What does Level 2 privacy management involve that goes beyond adjusting settings on one platform?

• ASetting every account to private without checking what each platform actually offers, just in case
• BDeleting older accounts instead of taking the time to review their existing privacy settings
• CComparing how visibility options such as public, private, friends-only or custom audiences vary between different platforms✓
• DOnly adjusting the privacy settings on the one platform you personally use most often, and leaving all the others completely unchecked

Answer: Visibility options such as public, private, friends-only and custom audiences are not defined the same way on every platform. Level 2 practice involves comparing these options across the different platforms you use, rather than adjusting settings on just one. Applying a blanket private setting without checking what it actually restricts, focusing only on your most-used platform, or deleting accounts instead of reviewing them all fail to achieve this cross-platform comparison.

A fitness app requests access to your contacts, camera, location and microphone. Which Level 2 privacy skill applies here?

• AAssuming that an app store checks that each permission requested is genuinely needed to function
• BChecking the app's star rating before deciding whether to install it
• CIdentifying which permissions are unnecessary for the app's intended purpose and declining them✓
• DGranting the permissions requested so that the app works smoothly without interruptions or pop-ups

Answer: Apps sometimes request permissions, such as contacts, camera or location access, that are not actually required for their core function. Level 2 practice involves identifying which permissions are unnecessary for the app's intended use and declining them. Granting every permission for convenience increases risk unnecessarily, assuming the app store checks each permission is incorrect, and a star rating says nothing about which permissions an app requests.

After comparing several messaging apps, what should you do if one offers noticeably stronger privacy controls than the others?

• AAssume that all messaging apps provide exactly the same level of privacy by default, without ever comparing them
• BIdentify and choose the platform or tool that offers stronger privacy settings for your needs✓
• CContinue using the least private messaging option because it already has more of your contacts added
• DUse whichever messaging app your device happens to install automatically, without comparing alternatives

Answer: When one platform offers noticeably stronger privacy controls than the alternatives, Level 2 practice is to identify and choose that platform for your needs. Continuing to use a less private option purely because contacts are already added ignores the privacy trade-off, assuming all messaging apps offer equal privacy is inaccurate, and letting a device's default installation decide for you skips the comparison altogether.

A social media app flags an unusual sharing alert after you post publicly by mistake. What does Level 2 practice require?

• AReport the alert as a fault in the app before ever checking your own settings first
• BInterpret the automated privacy alert and adjust the relevant sharing settings✓
• CAssume that automated alerts are accurate and require no review of your settings
• DIgnore the alert unless it happens to repeat several times in a row that day

Answer: Automated or AI-supported privacy alerts, such as warnings about unusual sharing, are designed to flag settings that may need attention. Level 2 practice is to interpret the alert and adjust the relevant sharing settings yourself. Ignoring an alert until it repeats, assuming it is always correct without checking your own settings, or reporting it as a fault before reviewing what happened all fail to act on the warning appropriately.

You join a new platform designed for public sharing. What Level 2 step should you take regarding its default privacy settings?

• ACheck privacy settings later on when you specifically plan to post sensitive content on the platform
• BLeave default settings unchanged, because platforms rarely ever alter them, or so people commonly assume
• CAssume that default settings are automatically set to the most private option that is available
• DReview the default settings, since they may expose more personal information than intended✓

Answer: Platforms designed for public sharing often use default settings that expose more personal information than a user might expect. Level 2 practice is to review these defaults as soon as you join, regardless of what you plan to post. Assuming defaults are always private, leaving them unchanged because they rarely alter, or only checking settings for sensitive content all risk leaving information exposed unnecessarily.

To manage a digital footprint at Level 2, what active research step should you take that goes beyond general awareness?

• ASearch your own name and review activity histories to see what information is publicly visible✓
• BTrust that searches for your name are rare, unless you happen to become well known or famous online
• CWait for a platform to notify you if your information happens to become public
• DAssume that deleting one recent post automatically removes the older posts that are linked to it as well

Answer: Understanding a digital footprint at Level 2 goes beyond general awareness that online activity persists. It involves actively searching your own name and reviewing your activity histories to see what information about you is publicly visible. Assuming searches for your name are rare, believing that deleting one post also removes older linked posts, or waiting for a platform to notify you all rely on passive assumptions rather than active research.

Why might content posted several years ago suddenly resurface in someone's search results?

• ASearch engines rank content by its posting date, placing the most recently published pages first in results
• BContent resurfaces in search results when you personally log back in to the original account
• CVisibility is influenced by platform algorithms, search engine indexing and AI-driven content promotion✓
• DOld content earns extra ranking weight, as a reward for its age, once it passes a fixed number of years online

Answer: Search engine indexing, platform algorithms and AI-driven content promotion all influence which older content resurfaces in searches. Level 2 practice includes understanding these mechanics behind visibility, not just knowing that a digital footprint exists. Search engines do not rank purely by posting date, age alone does not earn content extra ranking weight, and resurfacing does not depend on you logging back in to an old account.

An AI-powered search tool surfaces an old, outdated photo of a job applicant during a background check. What does this illustrate about Level 2 digital footprint awareness?

• AOutdated content is filtered out of AI-driven search results by default, unless the applicant chooses to opt in
• BAI-powered search tools display content from within the past month, based on each platform's own retention policy
• CAI-driven search tools may surface older or unexpected content, so managing what others can see matters✓
• DThe applicant's most recent post is what decides how they appear online to people who are searching for them

Answer: AI-powered search tools can surface older or unexpected content that a person may not expect to appear, which is exactly what Level 2 digital footprint management addresses. This means managing what others can see matters, because relevant content is not confined to the past month, outdated material is not filtered out of AI-driven results by default, and a person's online impression is shaped by more than just their most recent post.

A friend tags you in an old photo without asking first. What does this demonstrate about a digital footprint?

• AOnly public accounts contribute to a person's digital footprint
• BA digital footprint includes content created or shared by others, not only your own personal activity✓
• CYour digital footprint is limited entirely to content you post yourself
• DTagged content disappears automatically, and permanently, once the original poster deletes their account

Answer: A digital footprint is shaped by content that others create or share about you, such as tags and mentions, as well as by your own activity. Level 2 practice recognises this wider scope. Assuming your footprint is limited to what you post yourself, believing tagged content vanishes if the original poster's account is deleted, or thinking only public accounts contribute to a footprint all understate how a digital footprint is actually formed.

An employee uses a generative AI tool to write a report and submits it as entirely their own work, without disclosing this. What does Level 2 practice say about this?

• AThis is simply a matter of personal writing style, so it falls outside workplace or academic conduct rules
• BThis is acceptable, as long as the finished report reads well and contains no obvious factual errors or typos
• CGenerative AI tools are banned by law from use in workplace and academic tasks
• DPresenting generative AI output as personal work may breach workplace, academic or legal expectations✓

Answer: Presenting work produced by generative AI as entirely your own, without disclosure, may breach workplace, academic or legal expectations around originality and integrity. This is a genuinely Level 2 distinction, since AI use itself is common at every level but this specific integrity risk is not. The quality of the writing does not remove the ethical issue, it is not merely a question of personal writing style, and there is no legal ban on these tools, since the actual guidance is about appropriate use and disclosure rather than prohibition.

When should you attribute or seek permission rather than simply using a generative AI tool's output directly?

• AAttribution is handled by the AI provider, because its terms of use already credit it for the content produced
• BWhen the AI tool was used on a free trial rather than on a paid subscription plan
• CWhen original work, attribution or permission is required rather than presenting AI output as your own✓
• DWhen the finished piece of work runs to more than a page or two of written text

Answer: Attribution or permission is required when original work, credit or consent is expected, rather than presenting generative AI output as if it were entirely your own. This depends on what the work requires, not on its length or on whether the tool was used on a free or paid plan. An AI provider's terms of use do not attribute the work on the user's behalf, so responsibility for attribution stays with the person using the output.

Before sharing a colleague's photo from a work social event online, what should you evaluate?

• AWhether the event organiser has already posted similar photos themselves
• BOnly whether the photo is flattering to the people shown, regardless of context
• CWhether sharing could cause harm, and whether privacy, consent and the intended audience have been considered✓
• DWhether the photo will receive a high number of likes or shares online

Answer: Before sharing content involving other people, Level 2 practice is to evaluate potential harm, privacy, consent and the intended audience. Judging a photo only by how flattering it looks ignores these wider ethical considerations, chasing engagement such as likes has nothing to do with whether sharing is appropriate, and an organiser already posting similar content does not establish that consent was given for further sharing.

Re-using a colleague's copyrighted diagram in a client presentation without permission could breach which area of law?

• AEmployment law, because the diagram was created by a colleague as part of their contract of employment
• BWorkplace conduct policy applies here, rather than a wider legal framework
• CData protection law, since the diagram is a form of stored digital information
• DCopyright and intellectual property law, alongside possible privacy or harassment concerns depending on the content✓

Answer: Re-using someone else's copyrighted material without permission can breach copyright and intellectual property law, and depending on the content, may also raise privacy or harassment concerns. Treating this purely as a data protection issue misses the ownership dimension, treating it as an employment law matter misreads which law protects the diagram, and reducing the issue to conduct policy alone ignores that wider legal frameworks also apply.

You want to use a piece of music in a company promotional video. How should you check whether this is legally permitted?

• ACheck whether the music has ever been performed publicly before today
• BAssume that music found on a video-sharing site can be used freely in a business video
• CLook for clear usage information or use music from a trusted free-to-use source✓
• DUse the music straight away and remove it later if the copyright holder complains

Answer: Whether text, images, audio or music can be legally used depends on checking for clear usage information or sourcing material from a trusted free-to-use provider. Assuming music found on a video-sharing site is free to use in a business context is a common but risky mistake, using material and removing it only if challenged still constitutes an unauthorised use in the meantime, and whether music has been performed publicly before has no bearing on whether it can be reused.

A colleague repeatedly posts content online that targets and harasses another employee. What does Level 2 ethical practice say about this situation?

• AUnderstand when this behaviour should be reported, since responsible reporting supports a safer online environment✓
• BBlock the colleague's account straight away, without reporting the behaviour itself to anyone else
• CAvoid getting involved in the situation yourself, unless the harassment happens to take place on a work device specifically
• DReport the behaviour once it has happened on more than ten separate occasions, so a pattern is proven

Answer: Behaviour such as repeated harassment should be reported, because responsible reporting supports a safer online environment for everyone involved. Level 2 practice recognises this obligation. Staying uninvolved because the harassment did not occur on a work device ignores its impact on a colleague, setting an arbitrary number of incidents before reporting delays action unnecessarily, and blocking an account without reporting leaves the underlying behaviour unaddressed.

At Level 2, evaluating your own digital habits means looking beyond simple screen-time totals to also consider what?

• AHow many apps are currently installed on your device at the moment
• BHow bright your screen's backlight setting is during the day
• CHow patterns of multitasking and constant connectivity affect your physical and emotional wellbeing✓
• DHow today's screen time compares with yesterday's total figure

Answer: Evaluating digital habits at Level 2 means considering how patterns such as multitasking and constant connectivity affect physical and emotional wellbeing, not just totalling screen time. The number of installed apps says nothing about usage patterns, comparing screen time with yesterday's total misses longer-term patterns, and a screen's backlight brightness is a display setting rather than a wellbeing indicator.

Which early signs suggest that digital habits may be negatively affecting physical wellbeing?

• AReceiving more notifications than usual from a single app on your phone
• BNeeding to charge your device more than once during the day
• CFeeling generally tired after a full day of work, regardless of whether it involved any screens at all
• DEye strain, headaches and posture-related discomfort appearing during or after extended device use✓

Answer: Early signs that digital habits may be affecting physical wellbeing include eye strain, headaches and posture-related discomfort during or after extended device use. General tiredness after any kind of work is too broad to indicate a digital-specific issue, needing to charge a device more often reflects battery use rather than physical symptoms, and a rise in notifications from one app is unrelated to physical wellbeing.

Which combination of adjustments reflects Level 2 ergonomic practice for sustainable device use?

• ATurning down notification volume so alerts are less noticeable, rather than adjusting your workspace
• BAdjusting posture, lighting, seating position and break frequency together to support comfortable use✓
• CTaking a break once physical symptoms become severe enough to be genuinely noticeable
• DSwitching to a larger screen so that the text displayed on it simply appears bigger overall

Answer: Level 2 ergonomic practice involves adjusting posture, lighting, seating position and break frequency together, rather than changing a single setting in isolation. Lowering notification volume addresses distraction, not ergonomics, switching to a larger screen changes display size rather than posture or environment, and waiting until symptoms become severe misses the point of proactive adjustment.

Which device-based strategy helps reduce digital overload according to Level 2 digital wellbeing practice?

• AUninstalling and reinstalling apps each time their notifications become too frequent
• BLeaving notifications switched on permanently so that nothing important is missed
• CTurning the device off for the rest of the working day to stop the alerts arriving
• DAdjusting notification settings and using focus modes to limit interruptions✓

Answer: Adjusting notification settings and using focus modes are device-based strategies that reduce digital overload by limiting interruptions. Leaving every notification switched on increases interruptions rather than reducing them, repeatedly uninstalling and reinstalling apps does not address notification frequency, and switching a device off completely removes access rather than managing use in a sustainable way.

After a suspicious email leads to a work account being compromised, what should you do beyond using the platform's own report tool?

• AFollow recognised procedures, including workplace policies and contacts with trusted authorities✓
• BOnly report the incident if a financial loss, such as a missed payment, has already occurred
• CUse the platform's block or report button and consider the matter closed
• DWait for the platform's automated system to resolve the issue on its own

Answer: When an account is compromised, Level 2 practice is to follow recognised procedures that include workplace policies and contacts with trusted authorities, beyond the platform's own report tool. Waiting for an automated system to resolve the issue independently delays necessary action, restricting reporting to cases involving financial loss ignores account compromise as a reportable event on its own, and treating a block or report button as the end of the process overlooks the wider recovery steps required.

Before reporting an incident of online fraud, what should you gather to support the report and any recovery?

• ANothing at all, since reporting tools are assumed to automatically collect all the necessary evidence
• BA list of other unrelated accounts that you happen to hold online, unconnected to this incident
• CA general description of the incident recalled from memory, written down a few weeks later
• DRelevant information such as screenshots, dates and message details about the incident✓

Answer: Supporting evidence such as screenshots, dates and message details helps a report of online fraud be investigated and resolved effectively. Relying on memory weeks later risks losing important detail, assuming reporting tools automatically capture all necessary evidence is incorrect, and information about unrelated accounts does not support the specific report being made.

After discovering that an online account has been compromised, which recovery actions should you take?

• ASecure the account, suspend the compromised service and restore data from trusted backups✓
• BDelete the account immediately without saving any information from it beforehand, just to be safe
• CChange the account's display name and wait to see if the problem continues, without further action
• DLog out of the account and avoid using that particular service again in future

Answer: Recovering from a compromised account involves securing the account, suspending the compromised service and restoring data from trusted backups. Simply changing a display name and waiting does not address the underlying compromise, deleting the account immediately discards data that could otherwise be recovered, and logging out without further action leaves the compromise unresolved.

Why should personal reporting and recovery procedures be reviewed regularly rather than set up once and left unchanged?

• AReviews are carried out by the platform's own security staff, so a personal review adds little value
• BReviewing procedures is mainly a way to meet the platform's terms of service and user agreement
• CThreats and recovery practices change over time, so procedures need to be reviewed and updated✓
• DUpdating procedures is tied to the device warranty and matters when a device is repaired or replaced

Answer: Threats and recovery practices change over time, so personal reporting and recovery procedures need to be reviewed and updated regularly rather than left as they were first set up. Leaving the review to a platform's staff ignores how quickly personal threats evolve, reviews are about staying protected rather than meeting terms of service, and a device warranty has no bearing on when procedures need updating.