Learning Lab

SysSeder / Learning Lab

Free to explore

Practice your next decision.

Small workplace scenarios. Useful explanations. Explore the choices behind safer, more thoughtful technology use.

IT   /   Security   /   Authentication   /   AI   /   Hardware & energy

Watch: Passkeys vs Push MFA

What changes, what still matters. Watch the short explainer, then try the exercises below.

Watch Passkeys vs Push MFA on YouTube

Practice, not a security assessment. These are simplified learning scenarios. A score does not measure whether you or an organization are secure. Real incidents can have more than one cause; follow your organization’s policies and support process.

The exercises do not request personal information, send answers or save progress. They run in this page’s memory and reset on reload. This describes the exercises, not the hosting platform’s privacy practices.

Sources & further reading

Reading version / answer key

All eight scenarios are below, with four choices each. Pause before the answer if you want to test yourself. This version is included when you print the page.

Security judgment check

1. The urgent payroll message

   An unexpected email says payroll will be paused unless you sign in through its link today. The logo and sender name look familiar. What is the best next step?

   1. Open the link and inspect the sign-in page.
   2. Reply and ask the sender to confirm their identity.
   3. Verify through a known payroll contact and report the message.
   4. Sign in if the page shows a padlock.

   Answer C. An independent, trusted contact lets you check the request without relying on the suspicious message. Use a known contact route, not the message’s link or phone number. Follow your workplace’s phishing-reporting process. Source guidance.

2. An approval you did not request

   Your work authenticator asks you to approve a sign-in, but you are not signing in anywhere. Then another prompt arrives. What should you do?

   1. Approve once, then tell IT about the repeated prompts.
   2. Deny the request and report it through the approved IT route.
   3. Ask a colleague to approve it from your phone.
   4. Turn off MFA until the prompts stop.

   Answer B. Denying avoids granting that request; reporting lets your support team investigate the unexpected activity. Only approve sign-ins you initiated. An unexpected prompt needs investigation; it does not by itself prove a successful compromise. Source guidance.

3. A shortcut for a sensitive report

   You want an AI tool to summarize customer-support notes containing names and account details. You do not know whether this tool is approved for that information. What should happen first?

   1. Upload the notes because summarizing does not change them.
   2. Remove names, then upload everything else without checking.
   3. Use a personal account so the work account stays separate.
   4. Check data policy and use a tool approved for this information.

   Answer D. Confirming authorization and data handling before uploading helps avoid exposing sensitive customer information. Check what information may be shared and with which tool. Minimize sensitive data; do not assume a model or account type guarantees privacy. Source guidance.

4. The USB drive in the meeting room

   You find an unclaimed USB drive labelled “Team photos” in a shared meeting room. You want to return it. What is the safest next step?

   1. Hand it to IT or security without connecting it.
   2. Connect it briefly to find the owner’s name.
   3. Try it on a spare work laptop instead.
   4. Ask a colleague to check its files on their computer.

   Answer A. IT or security can handle unknown media through an approved process without exposing your workstation. Do not connect found storage media. Use your organization’s process for handling and returning it. Source guidance.

5. Less idle power, without less protection

   You want your work laptop to use less energy while you are away. Your organization manages its security and update settings. Which approach balances both needs?

   1. Disable updates and security tools to reduce background activity.
   2. Turn off the display and leave the session unlocked.
   3. Use approved screen/sleep settings and lock it before leaving.
   4. Use an animated screen saver and keep the laptop awake.

   Answer C. Screen and sleep settings can reduce idle power. Locking separately protects access to your open session. Use permitted power-saving settings and lock before stepping away. Preserve your organization’s security, access and update policies. Source guidance.

TLS troubleshooting lab

1. The name and dates look right

   A client cannot validate an HTTPS certificate. In this simulation, the hostname matches and the certificates are within their validity dates. Which check should you investigate first?

   Diagnostic

   Unable to get local issuer certificate

   Server presentation

   Leaf certificate only; issuing intermediate absent

   Client configuration

   Approved root is trusted; intermediate unavailable locally

   1. Trust-chain building
   2. Hostname matching
   3. Certificate expiry
   4. None: bypass certificate validation

   Answer A. The missing issuer prevents this client from building a path to its approved trust anchor. Investigate the missing intermediate and the client’s trust configuration. Do not promote a certificate from the failing connection into a trusted root. Source guidance.

2. Trusted issuer, wrong destination

   The chain validates and the dates are current. A browser connects to portal.example.com. Which check fails with the evidence below?

   Requested hostname

   portal.example.com

   Certificate DNS SAN

   files.example.com only

   Diagnostic

   Hostname mismatch

   1. Certificate expiry
   2. Trust-chain building
   3. None: a trusted issuer covers every name
   4. Hostname matching

   Answer D. portal.example.com is not the listed DNS identity. The certificate does not cover the requested hostname. Check the requested hostname and the certificate served for it. Use a certificate with the appropriate Subject Alternative Name (SAN); adding roots will not fix the name. Source guidance.

3. Everything matches except the clock

   The client’s clock has been checked and is correct. The hostname and issuer chain are otherwise valid. Which check explains this failure?

   Simulation time

   24 October 2026, 12:00 UTC

   Leaf valid until

   23 October 2026, 23:59 UTC

   Diagnostic

   Certificate has expired, depth 0 (leaf)

   1. Hostname matching
   2. Certificate validity period
   3. Trust-chain building
   4. None: move the client clock backwards

   Answer B. The verified current time is later than the leaf certificate’s stated expiry. Arrange renewal and deployment of the appropriate certificate, then retest. In real incidents, check the failing certificate and clock; any chain element can have a validity problem. Source guidance.

Sources & further reading

Scenario choices are SysSeder’s educational examples, informed by the primary guidance below. Reviewed 24 October 2026. Links lead to the source organizations.

• CISA · Recognize and report phishing (PDF)
• Microsoft · Report suspicious MFA activity
• NIST · Generative AI Profile, data privacy (§2.4; PDF)
• CISA · Risks of portable devices (PDF)
• Microsoft · Energy recommendations
• Microsoft · Locking your Windows device
• OpenSSL · Certificate verification
• OpenSSL · Verification error meanings
• IETF · Service identity in TLS (RFC 9525)

More to explore

Computer energy calculator — estimate electricity use and running cost.

SysSeder · Understand the system. Make the better call.