Level 5 exam — Cybersecurity

Exam — fresh questions

12 new questions to validate Incidents & security culture: respond, report, charter, culture, SecNumacadémie.
Answer everything, then click Check: your score and explanations will appear.

5.1 · Recall

1. Facing a suspicious workstation (ransomware), what is the first-minutes triad?

Switch off, pay, reinstall alone as fast as possible Isolate without switching off, alert, stop touching Keep working while ignoring the symptoms Unplug then throw away the hard drive

Network cut without switching off (evidence preserved), IT/CISO alert, machine untouched.

5.1 · Application

2. Karim sees his files renamed with strange extensions + ransom message. What does he do?

He switches the workstation off then on to see if it passes He reinstalls the system alone to clean the machine as fast as possible He cuts the network without switching off, alerts IT, notes and preserves He quickly pays the ransom before the displayed countdown ends

Isolate (without switching off), alert the CISO/IT, note time and symptoms, preserve evidence — never pay or tinker.

5.1 · Arbitration

3. Vital data encrypted, no backup, countdown pressure. Pay?

No: no guarantee, funds crime, re-attack — backups + pros Yes: vital data always justifies paying the ransom demanded Yes: pay quickly then hide the incident from IT to avoid blame No: just switch the workstation off and wait for it to resolve alone

Never pay: the real life insurance is the offline backup (3.1), not the ransom.

5.2 · Recall

4. What is the correct reporting order at work?

Internal first (IT/CISO), official next, complaint if offence Wait for certainty, then say nothing Social media, then press, then IT Complaint first, report next, forget after

Internal always first at work; official platforms next; complaint if offence.

5.2 · Application

5. Karim receives a “parcel blocked” SMS + a phishing email. Correct move?

Forward the trap to ten colleagues to warn them Delete silently to avoid overloading IT Reply to the SMS to verify the sender Report internally then forward: SMS to 33700, email to signal-spam.fr

Internal button/address + 33700 (SMS) + signal-spam.fr (emails): doubt is enough, without spreading the trap.

5.2 · Arbitration

6. Proven fraud but fraudster probably abroad. Is a complaint useful?

No: the complaint replaces internal reporting, so IT is useless Yes: but only if you first ran the whole investigation yourself Yes: it feeds investigations and conditions insurance and remedies No: with a fraudster abroad, no file is ever of any use

Serial frauds: without a complaint, no case file — and never a solo investigation that destroys evidence.

5.3 · Recall

7. What is the value of the IT charter?

Optional advice for managers only Binding (appended to rules), able to justify a sanction Valid only if everyone signed it Decorative HR paper without consequence

Brought to attention, it applies even without signature; ignorance is no defence.

5.3 · Application

8. Karim shares his password “to help out” and installs software without approval. Verdict?

Normal mutual help between colleagues, which the charter never covers Forbidden only if IT ever notices one day Allowed as long as no colleague complained about these practices Two likely charter breaches: fix, then question to the contact

Compare 3 real practices with the written rule: fixing quickly beats pleading ignorance.

5.3 · Arbitration

9. The charter is silent on generative AI. Karim wants to paste company data into it. Decision?

Test alone in secret: charter silence means tacit permission Bypass the charter via a free personal account Share the data anyway, then carefully erase traces Ask the contact/CISO (and HR/legal if disputed) before any use

Silent does not allow all: charter first, contact next — indicative value, legal/HR if disputed.

5.4 · Application

10. A colleague admits clicking a suspicious link. Response that anchors culture?

Gently mock them so they durably remember the lesson Advise them to stay quiet to avoid trouble with management Reward their report and help them quickly alert IT Publicly sanction them in front of the team to set an example

Zero blame: a reported mistake is congratulated, concealment is sanctioned — never the reverse.

5.4 · Arbitration

11. Team with no time, one big annual training offered. Culture decision?

Raise awareness only for managers, employees will follow on their own Visible example + 5 monthly minutes kept + quiz taken as a team Refuse all awareness on grounds that technical tools suffice Run one big annual training alone, with no follow-up

Consistency beats intensity: short ritual kept + visible example + peers sharing.

5.5 · Application

12. Karim finished the guide. What correct post-guide plan?

SecNumacadémie (certificate) + 1 watch read + quizzes retaken together Avoid internal tests for fear of being trapped Consider yourself protected forever, do nothing Subscribe to five feeds without ever reading them

Free ANSSI MOOC, one source actually read, internal tests as training: subscription, not diploma.

What's next?

Score ≥ 80%: move to Level 6 “In practice” — concrete incident cases and toolbox (NO exam).
Score 50-79%: re-read the explanations above — each re-explains the concept — then redo the failed sections' 48h challenges.
Score < 50%: resume sheets 5.1 (quick-reaction card) and 5.2 (directory), your two vital moves, before continuing.