Phishing Quiz: Can Your Team Spot a Fake Sender?

A pass mark of 80 out of 100, eight questions, and roughly 10 to 15 minutes per employee. That is the entire footprint of the Cybersecurity Awareness Training quiz, a scored assessment that checks whether staff can recognize phishing emails, vishing calls, weak passwords, ransomware, and the risks of public Wi-Fi before an attacker tests them for real.

It runs as a pass or fail test, so the outcome is a clean compliance record rather than a vague score, and every answer carries a written explanation of why it is right or wrong.

An email from rnicrosoft.com just hit the finance inbox

Picture the scenario the opening question is built around. A message arrives carrying a familiar logo, sent during business hours, formatted like every other internal email. The only tell is the sender's domain, which does not match the organisation it claims to represent. The quiz's own explanation cites the classic trick of registering rnicrosoft.com to impersonate microsoft.com, a swap most people miss at a glance.

That is the judgment this assessment measures. Not whether someone can define a firewall, but whether they pause on the small details that separate a legitimate request from a trap.

Lookalike domains, ransom notes, and a fake IT caller

The quiz mixes single choice, select all that apply, and true or false formats across its eight items. Alongside the phishing indicator question, staff work through a strong password checklist, a definition of social engineering, and a scenario quoted here in full: "You receive a phone call from someone claiming to be from IT support asking for your password to fix an urgent issue. What should you do?" The correct move, refusing and reporting through official channels, earns the points. Handing over even part of the password does not.

Later questions cover ransomware, safe handling of sensitive data, whether MFA matters beyond financial accounts, and a true or false statement about whether a password makes public Wi-Fi. Each answer is worth 12.5 points, skipping is permitted, and takers can revisit anything they answered earlier before submitting.

What a score of 80 actually certifies

Scoring is pass or fail against a 100 point total, with 80 needed to clear the bar. In practice, an employee can miss one question and still pass, but not two. There is no instant feedback during the attempt; explanations appear after submission, so the quiz measures knowledge first and teaches second.

Retakes are switched on in this template's settings, meaning anyone who falls short can study the explanations, close the gaps, and sit the test again. On your side, response analytics reveal how each individual question performed across the team, so if half the company stumbles on the public Wi-Fi item, you know exactly what the next security briefing should cover.

From the security team to every employee without a ticket queue

Everything here runs on Uplup's free plan, so the first company wide round costs nothing. Send the quiz by direct link in an announcement email, print its QR code into onboarding packets, or paste the embed snippet into the intranet. If the internal portal happens to run on WordPress, a shortcode from the Uplup plugin places the quiz on any page without touching a template file.

Results export to CSV for the compliance folder, and webhooks or Zapier can push each completed attempt into your HR system as it lands. All eight questions, their answer choices, their explanations, and the 80 point threshold are editable before you send a single invite, and applying your company's logo and colors makes the quiz read as an internal document rather than a third party test.