AP Cybersecurity Drill 1: Phishing Email Triage

Question 1. Which detail in the message is the strongest single sign that it is not a legitimate ClassVault notification?

• A) The subject line refers to a Q3 grade report being ready for the teacher to open
• B) The sender domain is classvault-cordwell.com, not the official classvault.cordwell.edu ✓
• C) The message is addressed to a classroom teacher rather than to an actively enrolled student user
• D) The linked file uses the descriptive Q3_Grade_Report naming style for documents

Explanation: Choice B is correct. The sender domain classvault-cordwell.com is a look-alike that does not match the official classvault.cordwell.edu, and a mismatched sender domain is the strongest single indicator of a spoofed message. Choice A is incorrect. A subject line mentioning a grade report is exactly what a real notice might say, so it is not a sign of fraud. Choice C is incorrect. The platform legitimately sends notices to teachers, so being addressed to a teacher is unremarkable. Choice D is incorrect. A descriptive document name is normal and does not reveal anything about whether the message is genuine.

Question 2. What type of attack does this message most clearly represent?

• A) A denial-of-service attack meant to take the grade platform offline
• B) A SQL injection attack aimed at the platform's back-end database
• C) A phishing attack designed to harvest the user's login credentials ✓
• D) An evil-twin attack using a rogue wireless access point nearby

Explanation: Choice C is correct. The message impersonates a trusted platform and pressures the user into entering credentials on a linked page, which is the defining shape of a phishing attack. Choice A is incorrect. A denial-of-service attack floods a service to make it unavailable; nothing here targets availability. Choice B is incorrect. SQL injection inserts malicious database queries through an input field, which is not what this email does. Choice D is incorrect. An evil-twin attack sets up a rogue wireless network, which is unrelated to this email.

Question 3. The teacher asks which social-engineering principle the message relies on most heavily. Which is it?

• A) Consensus, since the message claims that many other users have already verified their accounts
• B) Urgency, since access is said to end within 24 hours unless the user acts right now ✓
• C) Familiarity, since the sender presents itself as a close personal friend of the teacher
• D) Scarcity, since only a strictly limited number of accounts can still be verified today

Explanation: Choice B is correct. The threat that access will be suspended within 24 hours unless the user acts now is a time-pressure tactic, which is the social-engineering principle of urgency. Choice A is incorrect. The message does not claim that many users have acted, so it does not lean on consensus. Choice C is incorrect. The sender poses as a platform, not a personal friend, so familiarity is not the main lever. Choice D is incorrect. The message does not say verification is limited to a few accounts, so scarcity is not what it relies on.

Question 4. Why is entering the school email and password on the linked page especially dangerous in a school setting?

• A) The linked page would quietly install antivirus software that the school district never approved
• B) Confirming the account on that page would permanently erase the teacher's Q3 grade report data
• C) The link relies on an unencrypted connection that noticeably slows the whole school network down
• D) School credentials often unlock many systems, so one stolen password can expose grades and email ✓

Explanation: Choice D is correct. School accounts are frequently used to sign in to several connected systems, so a single stolen password can give an attacker access to grades, email, and other services at once. Choice A is incorrect. Phishing pages steal credentials; they do not install school-approved antivirus, and that would not be the danger here anyway. Choice B is incorrect. Entering a password does not delete a grade report; the goal is credential theft, not data deletion. Choice C is incorrect. The risk is the captured credentials, not any effect on network speed.

Question 5. Based on the evidence, what is the best immediate response for the teacher?

• A) Avoid the link, report the message to the help desk, and verify any notice on the official site ✓
• B) Click the link but type in a deliberately fake password first to test whether the page is real
• C) Reply directly to the sender and politely ask them to confirm both their identity and their real intent
• D) Forward the message to all other teachers so they can sign in before their access is lost too

Explanation: Choice A is correct. Not clicking, reporting to the help desk, and confirming through the official ClassVault site avoids the trap while letting the school respond, which is the safest course. Choice B is incorrect. Visiting the page at all is risky, and entering any password can confirm the address is live or expose information. Choice C is incorrect. Replying engages the attacker and can verify that the address is active without confirming anything trustworthy. Choice D is incorrect. Forwarding spreads the lure to more potential victims rather than containing it.