EC-Council Certified Secure Computer User Exam — Questions and Answers

Question 1: A type of malware is discovered that encrypts all the files on a user's hard drive and then displays a message demanding payment in cryptocurrency to restore access. This is characteristic of which malware category?

Spyware
Worm
Ransomware (Correct answer)
Rootkit

Correct answer: Ransomware

Ransomware is a malicious software designed to block access to a computer system or its data, typically by encryption, until a sum of money (a ransom) is paid. The scenario described, involving file encryption and a demand for payment, is a textbook example of a ransomware attack.

Question 2: You receive an unsolicited phone call from someone claiming to be with the IRS. They state that a warrant has been issued for your arrest due to tax fraud, but it can be voided if you immediately pay a fine using gift cards. This is a classic example of what type of scam?

A multi-level marketing scheme.
A mandatory IRS account verification process.
A legitimate asset recovery procedure.
A vishing (voice phishing) and impersonation attack. (Correct answer)

Correct answer: A vishing (voice phishing) and impersonation attack.

This scenario is a common vishing (voice phishing) attack. Scammers impersonate authority figures from organizations like the IRS or law enforcement to create a sense of fear and urgency. Legitimate government agencies will never demand immediate payment over the phone, especially using non-standard methods like gift cards, wire transfers, or cryptocurrency.

Question 3: Which of the following is a primary security advantage of using a major cloud service provider for data storage compared to storing files solely on a personal external hard drive?

It guarantees that the user will never accidentally delete a file.
It eliminates the need for the user to have a strong password.
It provides professional security management and geographic data redundancy. (Correct answer)
It prevents the user's account from being targeted by phishing attacks.

Correct answer: It provides professional security management and geographic data redundancy.

Major cloud providers employ teams of security experts and operate highly secure, geographically dispersed data centers. This provides a level of data redundancy (protection against data loss from a single event like a fire or hardware failure) and professional security management that is difficult for an individual to achieve with a local storage device.

Question 4: Why is it important to disable unnecessary features and services on mobile devices?

Disabled features make the device lighter
It prevents the device from overheating
Each enabled feature is a potential attack vector that increases the device's attack surface (Correct answer)
Disabling features frees up storage space

Correct answer: Each enabled feature is a potential attack vector that increases the device's attack surface

Every enabled feature, service, or connectivity option (Wi-Fi, Bluetooth, NFC, location services) represents a potential attack vector. Disabling unused features reduces the device's attack surface.

Question 5: A user needs to send a contract containing sensitive financial data to a business partner via email. Which of the following is the MOST secure method to protect the document?

Password-protecting the document using strong AES encryption before attaching it. (Correct answer)
Sending the document in a ZIP file.
Renaming the file extension from .pdf to .txt.
Sending the document password in the same email as the attachment.

Correct answer: Password-protecting the document using strong AES encryption before attaching it.

Encrypting the document itself with a strong password using a standard like AES-256 provides robust protection for the file's contents. This ensures that even if the email is intercepted, the attachment remains unreadable without the password. The password should be shared through a separate, secure channel (e.g., a phone call). Simply zipping or renaming the file offers no real security.

Question 6: What is the purpose of a digital signature in email?

To automatically reply to incoming emails
To add a decorative signature block at the end of an email
To verify the identity of the sender and ensure the message has not been altered (Correct answer)
To compress email attachments

Correct answer: To verify the identity of the sender and ensure the message has not been altered

A digital signature uses cryptographic techniques to verify the sender's identity and confirm that the email content has not been modified during transit.

Question 7: What security risk does Bluetooth pose when left enabled and discoverable on a mobile device?

Attackers can exploit Bluetooth vulnerabilities to access data, eavesdrop on communications, or gain control of the device (Correct answer)
Bluetooth interferes with Wi-Fi signal quality
It drains battery faster
It reduces cellular reception strength

Correct answer: Attackers can exploit Bluetooth vulnerabilities to access data, eavesdrop on communications, or gain control of the device

Leaving Bluetooth enabled and discoverable exposes the device to attacks like Bluejacking, Bluesnarfing, and BlueBorne that can steal data, install malware, or take control of the device.

Question 8: What is clickjacking and how does it trick users?

A method for automatically filling in forms
A browser feature for recording click patterns
An attack that overlays invisible or disguised elements on a webpage so users unknowingly click on something different from what they see (Correct answer)
A technique for speeding up mouse clicks

Correct answer: An attack that overlays invisible or disguised elements on a webpage so users unknowingly click on something different from what they see

Clickjacking uses transparent iframes or overlays to place hidden clickable elements on top of a legitimate webpage, tricking users into clicking something they did not intend—such as liking a page, sharing content, or changing account settings.

Question 9: What is the security risk of using public social media profiles for professional networking?

Public profiles load more slowly
Public profiles cannot receive direct messages
Attackers can harvest professional details to craft targeted spear-phishing and social engineering attacks against you or your organization (Correct answer)
Public profiles cost more to maintain

Correct answer: Attackers can harvest professional details to craft targeted spear-phishing and social engineering attacks against you or your organization

Public professional profiles provide attackers with organizational structure, job roles, projects, and business relationships that enable highly targeted spear-phishing and social engineering attacks.

Question 10: Which of the following is an example of a 'something you have' authentication factor?

Your fingerprint
A one-time code sent to your phone (Correct answer)
Your username
Your password

Correct answer: A one-time code sent to your phone

A one-time code sent to your phone represents the 'something you have' factor because it requires physical possession of your device.

Question 11: What is the purpose of a fraud alert on your credit report?

It automatically rejects all credit applications
It locks your bank account from all transactions
It sends you a daily credit score update
It notifies creditors to take extra steps to verify your identity before approving new credit applications (Correct answer)

Correct answer: It notifies creditors to take extra steps to verify your identity before approving new credit applications

A fraud alert flags your credit report to warn creditors that they should verify the applicant's identity through additional steps before opening new credit accounts.

Question 12: What is multi-factor authentication (MFA) and why is it effective?

Changing your password multiple times per week
Using multiple passwords for the same account
Logging in from multiple devices simultaneously
Requiring two or more different types of verification factors to prove identity, making account compromise significantly harder (Correct answer)

Correct answer: Requiring two or more different types of verification factors to prove identity, making account compromise significantly harder

MFA combines two or more independent authentication factors—something you know, something you have, and something you are—so compromising one factor alone is insufficient for access.

Question 13: What precaution should be taken when sending sensitive information via email?

Add a confidentiality disclaimer in the email footer
Mark the email as high priority
Send the email to multiple recipients for redundancy
Use end-to-end encryption or send sensitive data through a secure file-sharing platform instead (Correct answer)

Correct answer: Use end-to-end encryption or send sensitive data through a secure file-sharing platform instead

Sensitive information should be protected with end-to-end encryption or shared through a secure platform, as standard email provides limited security for confidential data.

Question 14: What is full disk encryption and why is it recommended for operating system security?

Encrypting the entire contents of a storage drive so data is unreadable without the proper authentication credentials (Correct answer)
Compressing all files on the disk to save space
Partitioning the drive into multiple sections
Formatting the hard drive to remove old files

Correct answer: Encrypting the entire contents of a storage drive so data is unreadable without the proper authentication credentials

Full disk encryption protects all data on the drive by encrypting it, ensuring that if the device is lost, stolen, or the drive is removed, the data remains unreadable without proper authentication.

Question 15: What does the term "firewall" refer to in computer security?

A physical barrier to protect a server room
A backup solution for critical data
Software or hardware that filters incoming and outgoing network traffic (Correct answer)
A security update for the operating system

Correct answer: Software or hardware that filters incoming and outgoing network traffic

A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

Question 16: A user wants to ensure that if their laptop is stolen, the data on the hard drive is unreadable to an unauthorized person. Which of the following Windows features is specifically designed for this purpose?

Windows Update
User Account Control (UAC)
Windows Defender Firewall
BitLocker (Correct answer)

Correct answer: BitLocker

BitLocker is a full-volume encryption feature included with Microsoft Windows versions starting with Vista. It is designed to protect data by providing encryption for entire volumes. If a computer is lost or stolen, BitLocker prevents unauthorized access to the data stored on the drive.

Question 17: What is data residency in the context of cloud computing?

The amount of storage space allocated to a user
The speed at which data is stored in the cloud
The backup frequency of cloud data
The physical or geographic location where data is stored and processed (Correct answer)

Correct answer: The physical or geographic location where data is stored and processed

Data residency refers to the geographic location where data is physically stored and processed, which has important implications for regulatory compliance and data sovereignty laws.

Question 18: What is the primary purpose of encryption?

To organize files in a structured manner
To compress data for faster transmission
To convert readable data into an unreadable format to protect it (Correct answer)
To delete sensitive data after use

Correct answer: To convert readable data into an unreadable format to protect it

Encryption converts plaintext into ciphertext to protect data from unauthorized access by those without the decryption key.

Question 19: What should you do before entering your password on a website?

Clear your browser cache
Check that the URL uses HTTPS and the domain is correct (Correct answer)
Disable your antivirus temporarily
Switch to incognito mode only

Correct answer: Check that the URL uses HTTPS and the domain is correct

Verifying the HTTPS padlock and the exact domain name protects against phishing and man-in-the-middle attacks before you type sensitive credentials.

Question 20: What is a logic bomb in the context of malware?

Malware that destroys computer hardware
Malicious code that remains dormant until a specific condition or date triggers its execution (Correct answer)
A program that creates excessive pop-up windows
A virus that spreads through logical reasoning puzzles

Correct answer: Malicious code that remains dormant until a specific condition or date triggers its execution

A logic bomb is hidden malicious code programmed to activate when specific conditions are met, such as a certain date, a user action, or the deletion of a specific account.

Question 21: What type of cloud attack involves intercepting data transmitted between the user and the cloud service?

Denial of Service attack
Man-in-the-middle attack (Correct answer)
Brute force attack
SQL injection attack

Correct answer: Man-in-the-middle attack

A man-in-the-middle (MITM) attack intercepts communications between a user and a cloud service, allowing the attacker to eavesdrop on or alter the data being transmitted.

Question 22: What is a social media bot and what security risks do bots pose?

A customer service chatbot on a company's social media page
Automated accounts that can spread misinformation, amplify malicious content, manipulate public opinion, and distribute phishing links at scale (Correct answer)
An official account run by the social media platform
A feature that automatically posts at scheduled times

Correct answer: Automated accounts that can spread misinformation, amplify malicious content, manipulate public opinion, and distribute phishing links at scale

Social media bots are automated accounts that can be used maliciously to spread disinformation, amplify propaganda, distribute malware links, inflate follower counts, and manipulate trending topics.

Question 23: What is the purpose of a security policy in an organization?

To restrict employees from using computers
To establish formal rules, guidelines, and procedures that define how the organization protects its information assets and manages security risks (Correct answer)
To list all software installed on company computers
To document the organization's IT budget

Correct answer: To establish formal rules, guidelines, and procedures that define how the organization protects its information assets and manages security risks

A security policy provides the formal framework of rules, guidelines, and responsibilities governing how an organization protects its information assets, manages risks, and ensures regulatory compliance.

Question 24: Why should you lock your computer screen when stepping away, even briefly?

To prevent screen burn-in
To speed up the processor
To save battery power
To prevent unauthorized access to your open files and applications (Correct answer)

Correct answer: To prevent unauthorized access to your open files and applications

Locking your screen requires re-authentication to regain access, preventing anyone nearby from viewing or using your open session.

Question 25: What is the purpose of a 'salt' added to a hashed password?

To make the password easier to remember
To add a random value that prevents two identical passwords from producing the same hash (Correct answer)
To encrypt the hash with an additional key
To slow down the login process for security

Correct answer: To add a random value that prevents two identical passwords from producing the same hash

A salt is a random value added to a password before hashing so that identical passwords produce unique hashes, defeating precomputed rainbow table attacks.

Question 26: A user follows the '3-2-1 rule' for their critical photos. They have the original files on their laptop, a copy on an external hard drive stored in their desk, and another copy uploaded to a cloud storage service. Which part of the rule does the cloud storage service primarily fulfill?

Maintaining one off-site copy (Correct answer)
Keeping three copies of the data
Creating a RAID array
Storing copies on two different media

Correct answer: Maintaining one off-site copy

The 3-2-1 backup rule recommends having three copies of your data on two different types of media, with one copy stored off-site. The cloud storage service acts as the off-site copy, protecting the data from local disasters like fire, flood, or theft that could destroy both the laptop and the local external hard drive.

Question 27: What is immutable backup storage and why is it important?

Storage that automatically deletes old backups
Backup storage where data cannot be modified, deleted, or encrypted once written, protecting against ransomware and accidental deletion (Correct answer)
Storage that can be easily modified by any user
A type of USB flash drive

Correct answer: Backup storage where data cannot be modified, deleted, or encrypted once written, protecting against ransomware and accidental deletion

Immutable storage enforces a write-once-read-many (WORM) model where stored backup data cannot be altered or deleted for a specified period, providing guaranteed protection against ransomware and malicious deletion.

Question 28: Why is it risky to use public Wi-Fi for checking email without a VPN?

Email applications do not work on public Wi-Fi
Public Wi-Fi makes emails load slower
Attackers on the same network can potentially intercept email credentials and content (Correct answer)
Public Wi-Fi networks block email protocols

Correct answer: Attackers on the same network can potentially intercept email credentials and content

On unsecured public Wi-Fi networks, attackers can use packet sniffing or man-in-the-middle techniques to intercept email credentials and message content.

Question 29: A user has several IoT devices, such as smart light bulbs and a smart thermostat, on their home network. To minimize the potential damage if one of these devices is compromised, which of the following is the BEST network security practice?

Disabling the firewall on the main router to improve device communication.
Assigning static IP addresses to each IoT device.
Placing all IoT devices on a separate, isolated network segment. (Correct answer)
Connecting all IoT devices using Ethernet cables instead of Wi-Fi.

Correct answer: Placing all IoT devices on a separate, isolated network segment.

Network segmentation is a critical security practice for IoT devices. By placing them on a separate network (like a guest Wi-Fi network or a VLAN), you isolate them from your primary computers and data. If an IoT device is compromised, the attacker's access is contained within that segment, preventing them from easily accessing more sensitive systems on the main network.

Question 30: Why should you avoid using an administrator account for daily computing tasks?

Administrator accounts cannot access the internet
Administrator accounts make the computer run slower
Administrator accounts have fewer features
Malware that runs under an administrator account gains full system access, while a standard account limits the damage malware can cause (Correct answer)

Correct answer: Malware that runs under an administrator account gains full system access, while a standard account limits the damage malware can cause

Using a standard account for daily tasks limits the damage that malware can inflict because it inherits the restricted permissions of the account, preventing system-wide changes without explicit elevation.

Question 31: You receive an unsolicited email with a generic greeting like 'Dear Customer' that urges you to click a link to 'verify your account details immediately' due to a security alert. This is a common tactic used in which type of attack?

A brute-force attack
A drive-by download
A phishing attack (Correct answer)
A zero-day exploit

Correct answer: A phishing attack

Phishing attacks often use social engineering tactics such as a sense of urgency, generic greetings, and requests to verify account information by clicking a malicious link. The goal is to trick the recipient into divulging sensitive credentials or personal data on a fake website.

Question 32: Why are operating system security patches important?

They improve the computer's physical appearance
They fix known vulnerabilities that attackers can exploit to compromise the system (Correct answer)
They add new features and wallpapers
They increase the operating system's storage capacity

Correct answer: They fix known vulnerabilities that attackers can exploit to compromise the system

Security patches fix discovered vulnerabilities in the operating system that, if left unpatched, provide known entry points for attackers to exploit for unauthorized access or malware installation.

Question 33: What is a supply chain attack in the context of malware distribution?

Infecting a single computer in an office
Compromising legitimate software updates or development tools to distribute malware to a wide base of trusting users (Correct answer)
Stealing products during shipping
Attacking a company's physical supply warehouse

Correct answer: Compromising legitimate software updates or development tools to distribute malware to a wide base of trusting users

Supply chain attacks compromise trusted software vendors, update mechanisms, or development tools to inject malware into legitimate software, affecting all users who install the compromised update.

Question 34: What is full disk encryption (FDE)?

Encrypting only specific folders selected by the user
Encrypting all data on a storage drive, including the OS and user files (Correct answer)
Encrypting only the operating system files on a drive
Encrypting data only when it is transferred over a network

Correct answer: Encrypting all data on a storage drive, including the OS and user files

Full disk encryption encrypts the entire contents of a storage device, protecting all data including the operating system from unauthorized access.

Question 35: What is a rootkit and why is it particularly dangerous?

A legitimate system administration utility
A type of firewall configuration tool
Malware that hides deep within the operating system to conceal its presence and the presence of other malware (Correct answer)
A tool for managing root access on Linux systems

Correct answer: Malware that hides deep within the operating system to conceal its presence and the presence of other malware

A rootkit embeds itself deep in the operating system—sometimes at the kernel level—to hide malicious activity from security software and users, making detection and removal extremely difficult.

Question 36: Which type of backup only saves changes made since the last backup?

Differential backup
Full backup
Incremental backup (Correct answer)
Continuous backup

Correct answer: Incremental backup

Incremental backups only save the changes made since the last backup, reducing storage space and time required.

Question 37: Why is remote wipe capability important for mobile device security?

It allows all data on a lost or stolen device to be erased remotely to prevent unauthorized access (Correct answer)
It restarts the device to clear temporary files
It cleans the screen of the device remotely
It updates the device's operating system wirelessly

Correct answer: It allows all data on a lost or stolen device to be erased remotely to prevent unauthorized access

Remote wipe allows you to erase all data on a lost or stolen mobile device from another device or computer, preventing thieves from accessing personal information, accounts, and sensitive data.

Question 38: What is the purpose of endpoint detection and response (EDR) solutions?

To manage software licensing on corporate devices
To continuously monitor endpoints for suspicious behavior, detect threats, and enable rapid investigation and response (Correct answer)
To block all software installations on endpoints
To replace traditional antivirus software entirely

Correct answer: To continuously monitor endpoints for suspicious behavior, detect threats, and enable rapid investigation and response

EDR solutions provide continuous monitoring of endpoint activities, using behavioral analysis to detect suspicious patterns and enabling security teams to investigate and respond to threats in real time.

Question 39: What is continuous data protection (CDP)?

Continuously monitoring data for viruses
A type of firewall that protects data 24/7
Running antivirus software continuously
A backup method that automatically saves every change to data as it occurs, enabling recovery to any point in time (Correct answer)

Correct answer: A backup method that automatically saves every change to data as it occurs, enabling recovery to any point in time

CDP captures every change made to data in real time, creating a continuous journal that allows restoration to any point in time, not just the last scheduled backup.

Question 40: What is an air-gapped backup?

A backup that is encrypted with a strong password
A backup stored on a cloud service with limited access
A backup stored in a compressed format
A backup stored on media that is physically disconnected from any network (Correct answer)

Correct answer: A backup stored on media that is physically disconnected from any network

An air-gapped backup is stored on media physically disconnected from all networks, making it immune to network-based attacks like ransomware.

Question 41: What is the 3-2-1 backup rule?

Back up data 3 times a day on 2 devices using 1 software
Keep 3 copies of data on 2 different media types with 1 copy offsite (Correct answer)
Store 3 files in 2 folders on 1 hard drive
Use 3 encryption methods across 2 servers with 1 password

Correct answer: Keep 3 copies of data on 2 different media types with 1 copy offsite

The 3-2-1 backup rule is a best practice that recommends maintaining three copies of data, stored on two different media types, with one copy kept offsite for disaster recovery.

Question 42: What is a drive-by download attack?

Malware that automatically downloads and installs when a user visits a compromised website, without any clicks or interaction required (Correct answer)
Downloading files from a USB drive
A fast download from a high-speed server
Downloading files while connected to a car's Wi-Fi

Correct answer: Malware that automatically downloads and installs when a user visits a compromised website, without any clicks or interaction required

Drive-by downloads exploit browser or plugin vulnerabilities to silently download and install malware when a user simply visits an infected web page, requiring no user interaction.

Question 43: Why should you be cautious about clicking links in emails, even from known contacts?

The sender's email account may have been compromised and used to send malicious links (Correct answer)
Email links expire after 24 hours
Clicking links uses excessive internet bandwidth
Links in emails always contain viruses

Correct answer: The sender's email account may have been compromised and used to send malicious links

Even emails from known contacts can contain malicious links if the sender's account has been hacked, making it important to verify unexpected links before clicking.

Question 44: What is a cipher in the context of cryptography?

A type of computer virus
A hardware device for storing passwords
A type of firewall rule
An algorithm used to encrypt and decrypt data (Correct answer)

Correct answer: An algorithm used to encrypt and decrypt data

A cipher is a cryptographic algorithm that transforms plaintext into ciphertext and reverses the process with the correct key.

Question 45: What is the purpose of a cloud exit strategy?

To plan how to reduce cloud usage costs
To define how an organization will migrate data and services away from a cloud provider if needed (Correct answer)
To limit the number of cloud users in an organization
To schedule regular cloud service downtimes

Correct answer: To define how an organization will migrate data and services away from a cloud provider if needed

A cloud exit strategy outlines the process for migrating data and services from one cloud provider to another or back to on-premises infrastructure, preventing vendor lock-in.

Question 46: What is heuristic-based malware detection?

Detection that analyzes code behavior and structure to identify potentially malicious programs even without a known signature (Correct answer)
Detection based on matching known virus signatures
Detection based on the file size of programs
Detection that only works when connected to the internet

Correct answer: Detection that analyzes code behavior and structure to identify potentially malicious programs even without a known signature

Heuristic analysis examines the behavior patterns and code characteristics of programs to detect potentially malicious software, even if it hasn't been previously identified and cataloged.

Question 47: What is a man-in-the-middle attack on a mobile device?

An attacker intercepting communications between the mobile device and a server by positioning themselves in the network path (Correct answer)
Blocking cellular signal to prevent phone calls
A person reading someone's screen over their shoulder
Physically stealing a phone from someone's hand

Correct answer: An attacker intercepting communications between the mobile device and a server by positioning themselves in the network path

In a mobile MITM attack, an attacker intercepts the communication between a device and a network service—often through rogue Wi-Fi access points—to steal data or inject malicious content.

Question 48: Why should you be cautious about browser auto-fill for sensitive information?

Auto-fill does not work on HTTPS websites
Auto-fill changes your saved information without permission
Hidden form fields on malicious websites can trick auto-fill into revealing more personal data than you intend to share (Correct answer)
Auto-fill makes typing slower

Correct answer: Hidden form fields on malicious websites can trick auto-fill into revealing more personal data than you intend to share

Malicious websites can include hidden form fields that browser auto-fill automatically populates with stored personal data—such as your address, phone number, or credit card—without your knowledge or visible indication.

Question 49: What is ARP spoofing and how does it threaten network security?

A wireless signal amplification method
A technique for testing network speed
A method to speed up network connections
An attack that manipulates the Address Resolution Protocol to redirect network traffic through the attacker's device (Correct answer)

Correct answer: An attack that manipulates the Address Resolution Protocol to redirect network traffic through the attacker's device

ARP spoofing sends falsified ARP messages to link the attacker's MAC address with a legitimate IP address, causing traffic intended for that IP to be sent to the attacker instead.

Question 50: You receive an email with a link to what appears to be your bank's website. Which of the following is the BEST technique to verify the link's legitimacy before clicking?

Checking if the email contains the bank's official logo. (Correct answer)
Replying to the email to ask if the link is legitimate.
Clicking the link to see if the website has a padlock icon.
Hovering the mouse cursor over the link to see the actual destination URL in the browser's status bar.

Correct answer: Checking if the email contains the bank's official logo.

Phishing attacks often use hyperlinks where the displayed text looks legitimate, but the underlying URL points to a malicious site. By hovering the mouse over the link without clicking, you can preview the actual destination URL in the bottom corner of the browser window. This allows you to check for misspellings or entirely different domains before navigating to a potentially dangerous site.

Question 51: What is the primary security concern when using public cloud storage services for sensitive business documents?

Slow upload speeds
Files cannot be organized into folders
Cloud storage has limited capacity
Data may be accessed by unauthorized parties if not properly encrypted (Correct answer)

Correct answer: Data may be accessed by unauthorized parties if not properly encrypted

Public cloud storage can expose sensitive data if proper encryption and access controls are not implemented, as data travels through and resides on third-party infrastructure.

EC-Council Certified Secure Computer User Exam

The CSCU (112-12) exam validates knowledge of secure computing practices including network security, data protection, cloud security, mobile device security, and safe internet usage for end users.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds