Social Engineering Blogs

How many people would get a 3/3 on the following questions without even watching a training video?

1)   Do you need a password?

Yes
No

2)   Should you give your password to a stranger?

Yes
No

3)   True or False: All passwords should be displayed in the open

True
False

What if 100 people were asked the following question on the local news, how many do you think would honestly say yes?

Have you ever had racist, sexist or ageist thoughts?

Maybe 1%? What about if another 100 were asked under complete and utter anonymity?

Think the number would jump up?

Each of these examples demonstrates a valuable point, ASKING QUESTIONS IS HARD. It’s not as easy as just slapping a question mark at the end of a sentence and calling it a day. There are millions –and I’m not exaggerating- of factors to keep in mind when making a test, making a survey, conducting an interview, taking a poll, or anything similar. Since some form of content retention is needed after training, lets focus on quizzes in this blog.

Challenges of Making a Quiz

What’s got 2 thumbs and took an ENTIRE graduate level course/and part of a graduate degree to just learn how to write a good series of questions?

Thanks right, this girl. But rather than put you through that, or more importantly rather than put me through that, I am going to focus on the top challenges of making an effective quiz.

(If you want to know more about any of the other forms of questions/surveys/polls/etc. feel free to ask)

1-    Being too easy-The goal of a quiz is to evaluate an individual’s comprehension, or even mastery of the topic at hand. Sometimes we even use this in annual training as a criterion for taking the next lesson. Because of this, making the quiz questions too easy is not only useless but also damages the overall training efforts. The previous phishing ‘quiz’ is a perfect example of questions that are too easy. Each question is a no brainer, ‘no duh’ question that does not require any learning. Therefore, users can just skip to the quizzes and be finished with your 25 video annual training in 10 minutes.

Yeah, lots of learning there.

Not only does this not evaluate their comprehension of the topic, but also renders the rest of your training efforts, and the information in it, completely useless. You have just made the one time a year that they have to pay a little attention into a wash. The quiz sucks, and now you need to find another way to get them new information so that your enterprise is not made vulnerable with attacks like the Nigerian Phishing Scam.

2-    Being too hard- Just like making a quiz too easy is counter productive, the same is true when the quiz is too hard. When aquiz is impossible to pass users will first spend loads of time trying to complete your training –not great when you are paying them to do so. Once learned helplessness settles in users will start to give up rendering your training message useless.

3-    Getting actionable results- Even though quizzes are made to evaluate a users performance, they also tell the trainers/teachers/managers something as well. If evaluated correctly you can see where there is large levels of misunderstanding, or needed improvement. For example, if you notice that 75% of the users got a 20% or less on their first attempt at a quiz on cloud computing, that tells you that supplemental efforts need to be made to close that gap. Make a newsletter. Start that security awareness campaign sooner rather than later. Regardless, structure your quiz so that you, and your enterprise, can evaluate the user knowledge and adapt accordingly.