Match the next action to what may have been exposed.
Review exposed passwords, suspicious downloads, a stated work-reporting rule and the difference between reporting and recovery. No incident diagnosis is supplied.
Four original scenarios each count one correct answer. Your count out of four describes this edition only; it is not a security certification, percentile, or prediction that an account is safe.
Separate four response tasks
This group distinguishes changing exposed credentials, checking a potentially harmful download, reporting under a supplied work rule and recognizing what reporting alone does not do. Each scenario states what is known. Do not add a claim that every unusual symptom proves malware or that sending a report automatically secures all accounts.
Reporting does not revoke a password
Suppose a password was typed into a suspicious page and you report the message. The report can help others investigate, but it does not itself change the password. Independently reach the real service and follow its recovery or security instructions, including changing reused credentials. What else is needed depends on the information exposed and the affected service.
Avoid certainty that the scenario does not provide
Look for a selected answer that waits for the suspicious sender’s reassurance, assumes closing a browser reverses disclosure, or declares a device clean without a check. The worked explanations give bounded next steps. A correct count here is not evidence that a real incident is contained, that funds are recoverable or that all unauthorized access has stopped.
Write a fictional response note
Use an invented event and record what happened, when, which type of information may have been exposed and which established contact should receive the report. Keep passwords and codes out of the note. Then distinguish reporting from the affected service’s recovery actions. For work systems, use the actual organization’s instructions rather than improvising intrusive checks.
Use trusted help for a real event
The FTC phishing guidance informs the credential and download examples. The work-reporting rule is explicitly fictional, so its timing is not presented as a universal legal requirement. The practice gives no forensic diagnosis or recovery guarantee. If an actual event occurs, follow the affected service’s trusted support and the relevant organization’s established response process.