certification
Phishing Certification Exam
This is the last step. It checks that you can tell a genuine message from an attack when nothing is flagged for you in advance. Expect it to be tougher than the practice tasks, because several of the messages here are completely real.
How it works
- Questions are pulled from a larger set, so every attempt looks different.
- Nineteen correct answers pass. One slip is fine, two are not.
- You get no feedback while you work. At the end you see the full explanation for every question, whatever your score.
- If it does not go your way, you can start again straight away with fresh questions.
- Please answer on your own. Going through it with a colleague only takes the meaning out of your certificate.
How to think about it
Mail from your own company's domain is trustworthy by default, and treating normal internal work as suspicious is its own kind of mistake. The rare exception shows itself in the request rather than the sender: a payment outside the usual process, a code someone wants from you, a link that leads somewhere odd.
When something does look off, the right-sized check is one short message on a second channel, such as {{chat}}. Save the phone call for when that gets you nowhere.
Use the same address you used in the training. Your master code and your certificate are both calculated from it.