Compliance training often asks employees to recognize a policy title when their real job is to make a decision under pressure. The questions below use short workplace scenarios to practice that decision. Each has four options and one correct answer based on a conservative generic policy.
Important: These examples are not legal, regulatory, or HR advice. Replace fictional workflows with your approved procedures and have the responsible policy owner review the final deck. Do not use a generic answer key as a substitute for organizational policy.
Security and access: Questions 1 to 5
- A manager receives an urgent request for a password reset from someone claiming to be a new executive. What should the manager do?
A. Reset it because the request is urgent
B. Use the approved identity-verification and access-request process
C. Ask for the executive's date of birth
D. Create a shared temporary password for the team
Answer: B. Urgency does not replace identity verification and authorization. - A contractor asks for a full production database export to investigate one support ticket. What is the best first response?
A. Send a compressed copy through private chat
B. Provide permanent read-only administrator access
C. Ask the contractor to follow the approved access and data-minimization workflow
D. Remove the customer names and post the file to a public link
Answer: C. Access should be authorized and limited to the information required for the task. - An employee clicks a suspicious invoice link and then notices the domain is misspelled. What should they do next?
A. Keep it private if no password was entered
B. Report the incident promptly through the approved security channel
C. Reply to the sender and ask for confirmation
D. Forward it to the security distribution list as an interesting example
Answer: B. Prompt reporting helps the response team assess and contain possible exposure. - A laptop containing work files is missing after a train journey. What is the correct first action?
A. Wait a day to see whether it turns up
B. Post a public message with the device details and customer filenames
C. Report the loss immediately using the organization's incident process
D. Change only the email password and continue working
Answer: C. The response team may need to revoke access, secure data, and assess reporting obligations. - A colleague asks to borrow your badge because they forgot theirs. What should you do?
A. Lend it for one hour
B. Hold the door open while they enter
C. Ask them to use the approved visitor or temporary-access process
D. Share your access PIN instead
Answer: C. Physical access should remain attributable to the authorized individual.
Privacy and information handling: Questions 6 to 10
- A customer asks support to change their account email over chat, but they are not signed in. What should the agent do?
A. Make the change if the customer knows their billing amount
B. Follow the approved identity-verification procedure before changing account details
C. Ask for a photograph of the customer's payment card
D. Send the current email address to the requester for confirmation
Answer: B. Account changes require the prescribed verification, not improvised personal questions. - A project team wants to paste customer conversations into an unapproved public AI tool for summarization. What should happen first?
A. Remove only the customer names and proceed
B. Use a personal paid account instead
C. Stop and follow the organization's approved tool and data-handling process
D. Paste only every second message
Answer: C. Informal redaction does not establish that a tool or data transfer is approved. - A trainer wants to use real participant names and responses in a public product screenshot. What is the safest approach?
A. Publish it if the session was useful
B. Use an authorized test state with no real participant identifiers
C. Blur only the final score
D. Replace last names with initials and publish everything else
Answer: B. A controlled test state avoids exposing participant information in marketing material. - An employee needs to share a spreadsheet with an external auditor. What should they check before sending it?
A. That the file has a professional title
B. That the recipient, authorization, fields, and transfer method match the approved request
C. That the file is small enough for email
D. That hidden columns are used instead of deleting unnecessary data
Answer: B. Data sharing should be authorized, necessary, and limited in scope. - A team finishes a project that contains records subject to a retention schedule. What should they do?
A. Keep every copy forever in case it becomes useful
B. Delete files immediately from every location
C. Follow the approved retention, legal-hold, and disposal procedure
D. Move the records to a personal archive
Answer: C. Retention and deletion decisions should follow the governing schedule and any active holds.
Workplace conduct and speaking up: Questions 11 to 15
- An employee witnesses behavior that may violate the workplace conduct policy but is unsure whether it crosses the line. What is the best action?
A. Investigate the people involved personally
B. Post the allegation anonymously in a group chat
C. Use the available advice or reporting channel to raise the concern
D. Ignore it unless the behavior happens again
Answer: C. The appropriate channel can assess the concern without requiring the employee to conduct an investigation. - A supplier offers a personal gift while a purchasing decision is open. What should the employee do?
A. Accept it if everyone else does
B. Keep it secret and remain objective
C. Follow the gifts and conflicts policy, including disclosure or refusal where required
D. Donate the gift without telling anyone
Answer: C. The policy should determine the correct response and any disclosure obligation. - A salesperson realizes they may have a personal relationship with someone evaluating bids. What should they do?
A. Disclose the potential conflict through the approved process
B. Avoid mentioning it unless the bid wins
C. Ask the evaluator to favor another supplier
D. Delete their personal messages
Answer: A. Early disclosure allows the organization to manage the conflict appropriately. - A manager is asked by a senior leader to retaliate against someone who raised a concern. What should the manager do?
A. Carry out the request because of seniority
B. Refuse and report the instruction through the appropriate channel
C. Transfer the employee without documenting why
D. Ask the reporter to withdraw the concern
Answer: B. Retaliation concerns should be escalated rather than implemented or concealed. - A colleague repeatedly makes jokes that another team member appears uncomfortable with. What is an appropriate response?
A. Wait for a formal complaint before doing anything
B. Use the available support, advice, or reporting path rather than treating discomfort as a joke
C. Share a recording publicly to settle the disagreement
D. Remove the uncomfortable person from future meetings
Answer: B. Use the organization's conduct process and avoid actions that could isolate or retaliate against the affected person.
Operational policy and records: Questions 16 to 20
- An employee discovers that a required approval was skipped after a purchase was completed. What should they do?
A. Backdate an approval to make the record look complete
B. Delete the purchase record
C. Report the exception and follow the documented correction process
D. Ignore it because the purchase is already complete
Answer: C. Transparent correction preserves the integrity of the record and addresses the control failure. - A supervisor asks an employee to record inaccurate safety-check results to meet a deadline. What is the correct response?
A. Record the requested values and fix them later
B. Refuse to falsify the record and escalate through the approved channel
C. Stop keeping safety records entirely
D. Ask a colleague to sign instead
Answer: B. Safety records must remain truthful, and pressure to falsify them should be escalated. - A team member notices a discrepancy between a vendor invoice and the approved purchase order. What should happen before payment?
A. Pay the lower amount and ignore the remainder
B. Approve it if the vendor is well known
C. Route the discrepancy through the defined review and resolution process
D. Change the purchase order without approval
Answer: C. The discrepancy needs authorized review rather than an informal adjustment. - An employee finds a shared folder containing confidential files with broader access than the policy allows. What should they do?
A. Download a copy for safekeeping
B. Report the exposure and follow the access-remediation process
C. Rename the folder so fewer people recognize it
D. Send the link to everyone who may need access
Answer: B. The exposure should be reported and access corrected through the responsible workflow. - A policy changes shortly before an employee completes a routine transaction. Which source should guide the transaction?
A. An old saved checklist from a previous year
B. A message from an unrelated department
C. The current approved policy and any official transition instructions
D. The fastest procedure used by a colleague
Answer: C. Current controlled guidance should supersede informal or outdated copies.
How to facilitate this question bank
Do not run all 20 items as one rapid-fire test. Select four or five scenarios that match a specific module. After each answer, ask participants which detail in the scenario determined the correct action. That turns the debrief into practice recognizing cues rather than memorizing letters.
For required combinations such as selecting every required verification step, use multi-select and explain that QuizMeter grades the exact set. For sensitive discussions about reporting or conduct, use an unscored Poll or anonymous Q&A instead of forcing every concern into a scored question.
After the session, review which wrong options attracted meaningful numbers of responses. A recurring misunderstanding may indicate that the policy or reporting workflow is unclear, not simply that employees need another reminder. Use the answer-distribution playbook for that review.
To turn your approved questions into a deck, format them with the six columns question, a, b, c, d, and correct, then follow the spreadsheet import tutorial. You can also start from a ready-to-import template or adapt the employee training session plan.