What is a 'drive-by download'?

Malware that automatically downloads and installs on your computer just by visiting an infected website — no clicking required Software you download from a car while it's moving past a Wi-Fi hotspot Files that download to your computer when you drive past a store's Bluetooth beacon An app that automatically downloads updates while you're driving

What is 'malware'?

Any software designed to harm, disrupt, or gain unauthorized access to computer systems — including viruses, ransomware, spyware, and trojans Only computer viruses — other types of harmful software have different names Software that slows down your computer by running too many processes in the background Any app that collects data about how you use your device

Why is it risky to plug in a USB drive you found in a parking lot?

Attackers deliberately drop USB drives loaded with malware — curiosity makes people plug them in, and the malware installs automatically when connected The USB drive might be corrupted and damage your USB port It's fine as long as you scan it with antivirus before opening any files Only risky if the drive is formatted for a different operating system

What is 'oversharing' on social media and why is it a security risk?

Posting personal details (birthday, address, school, daily routines) that attackers can use for identity theft, targeted phishing, or to answer security questions Sharing so many photos that the platform's servers get overloaded Posting opinions that might upset other users Sending too many messages in a short period of time

What is the '3-2-1 backup rule' and why does it protect against ransomware?

Keep 3 copies of data, on 2 different types of media, with 1 copy offsite — if ransomware encrypts local files, the offsite backup lets you recover without paying Back up your data every 3 days to 2 different cloud services, with 1 password protecting both The rule that says 3 minutes of downtime per day, 2 reboots per week, and 1 antivirus scan per month Store backups for 3 years, in 2 formats, with 1 encryption key

What is 'spear phishing' and how is it different from regular phishing?

Targeted phishing customized for a specific person using personal details gathered from research — far more convincing than generic mass phishing emails Phishing using physical mail (letters and postcards) instead of email A more advanced form of phishing that uses phone calls instead of emails Phishing that specifically targets people who work in cybersecurity

What should you check before clicking a link in an email?

Hover over the link to see the actual URL destination — check if it matches the legitimate domain, and look for misspellings like 'paypa1.com' or 'amazon-security.net' Check if the email has a 'Secure' badge — only legitimate emails have this See if the email was sent during business hours — hackers usually work at night Count the number of links — legitimate emails never have more than one

What does it mean when a website says 'We never share your data with third parties'?

It's a marketing claim, not a guarantee — read the actual privacy policy to understand what data is collected, how it's used, and what 'third parties' specifically means It's a legal contract — if they share your data after saying this, you can sue them It means your data is deleted after your session ends It means only government agencies can access your data, not companies

What is 'two-person integrity' (TPI) in high-security systems?

A security policy requiring two authorized people present and cooperating to complete sensitive actions — preventing any single person from abusing access Making sure both the user and the company's IT department verify every login A backup authentication method where two devices must both confirm a login Requiring two passwords to access any account containing sensitive data

Which of the following is the BEST cybersecurity habit for a student?

Use a password manager to keep unique, strong passwords for every account, and enable MFA on email and social accounts Use a different browser for school and personal use to keep accounts separate Clear your browser history and cookies every day after using the internet Only use websites that have a blue checkmark or verified badge