For facilitators
Teaching someone?
Borrow a workshop.
Three short plans for a class, a study group, a new-hire session or a kitchen table. Each one uses the free interactive lessons on this site, and comes with timings, a printable worksheet, answer guidance and the sources to check.
How each workshop runs
- Guess first. Learners write a prediction before they see anything. A wrong guess is useful.
- Try the model. Change one thing together on a shared screen or on each learner’s device.
- Explain it back. Learners answer in their own words. No copied definitions.
You need a browser and a screen. No accounts, sign-ups or installs. The lessons are simplified teaching models: they don’t inspect anyone’s device or account, and each one says what it leaves out.
Workshop 1 · 40 minutes
How does a website reach your screen?
Learners separate four jobs that happen in one website visit: finding an address, protecting a connection, receiving content, and reusing a saved copy.
- Who it suits
- First-time learners. No technical background needed.
Before you start
- Open the DNS lesson on a shared screen, or ask learners to open it on their own device.
- Open the pretend cache in the Learning Lab (/lab/), experiment 02.
- Print one worksheet per learner, or share the download.
Run of show
| 0–5 min | Warm-up Ask: “You type example.com and press Enter. What happens before you see the page?” Learners write a guess on the worksheet (question 1). Don’t correct anyone yet. |
|---|---|
| 5–15 min | Predict, then click Step through the DNS click-through together. Before each click, learners call out which job comes next: find the address, protect the connection, or receive the page. |
| 15–25 min | Change one thing Run the pretend cache: load, update the original, load again, wait twice, load. Before each load, ask: “Will this come from the saved copy or the original?” |
| 25–35 min | Spot the trap Show the HTTPS lesson’s lookalike-site example. Discuss: what does the padlock protect, and what does it not prove? |
| 35–40 min | Explain it back Learners answer the exit question in their own words, without copying a definition. Collect a few answers aloud only if people volunteer. |
Learner worksheet
noobquestions.com/teach/ · How does a website reach your screen? · Name: ____________________
Before the lesson: list what you think happens between pressing Enter and seeing a page.
What does a DNS lookup give your browser?
True or false: once the DNS lookup succeeds, the page has already downloaded. Explain.
In the pretend cache, you updated the original page but still saw version 1. Why?
A lookalike website shows a padlock. What does HTTPS protect, and what does it not prove?
Exit question: put these in order and explain each in one line — receive the page, find the address, protect the connection.
Answer guidance (for the facilitator)
- Any answer is fine. Compare it with question 6 at the end so learners can see what changed.
- An address (for an ordinary website visit, an IP address) the browser can use to connect. It does not return the page.
- False. Finding the address, connecting, and requesting content are separate jobs. The lookup only answers where to go.
- The saved copy was still within its freshness period (30 seconds in the model), so it was reused without asking the original. Stale does not automatically mean broken.
- HTTPS protects the connection so others on the path can’t read or change what is sent. It does not prove the site is honest, or that it is the site you meant to visit. Read the address, not the page design.
- Find the address → protect the connection → receive the page. Accept any answer that keeps the three jobs separate.
Common misconceptions to listen for
- “DNS sends me the website.” It only finds the address.
- “Refresh always fetches a fresh copy.” A cache can reuse a saved copy while it is considered fresh.
- “Padlock means safe.” It means a protected connection to that address, whoever runs it.
Sources to check
Workshop 2 · 40 minutes
Is my account safe?
Learners tell apart three different questions: Is this the right site? Is it really you? What are you allowed to do?
- Who it suits
- Anyone who signs in to work, school or personal accounts.
Before you start
- Open the MFA and permissions lessons. Both run in the browser with pretend accounts.
- Remind the group: never type a real password, code or account name during the session.
- Print one worksheet per learner, or share the download.
Run of show
| 0–5 min | Warm-up Ask: “If someone learned your password today, what could stop them?” Learners write a guess (question 1). |
|---|---|
| 5–12 min | Right site? Recap the lookalike example from the HTTPS lesson in two minutes: check the address before you sign in. |
| 12–24 min | Give away the password In the MFA lesson, give the pretend visitor the correct password. Predict whether they get in, then try it. Discuss independent factors and account recovery. |
| 24–35 min | Pick a role In the permissions lesson, choose a role and try actions on the pretend notebook. Ask: which is the smallest role that still lets this person do their job? |
| 35–40 min | Explain it back Learners write the difference between signing in and being allowed to act (question 7). |
Learner worksheet
noobquestions.com/teach/ · Is my account safe? · Name: ____________________
Before the lesson: if someone learned your password, what could stop them?
In the MFA model, the visitor has the correct password. Can they sign in with the password alone? Why?
A service asks for a password and then a memorised PIN. Is that necessarily multi-factor authentication? Explain.
Name two kinds of factor that are not something you know.
Why should you set up account recovery before you need it?
Jamie only needs to read the notes. Which role fits, and why not a bigger one?
Exit question: what is the difference between signing in and being allowed to do something?
Answer guidance (for the facilitator)
- Any answer is fine. Come back to it after question 2.
- No, not while the account rule requires a second check. The password is one piece of evidence, and the visitor lacks the independent second factor. (Switch the rule to password-only and the same password becomes enough. The rule changed, not the password.)
- Not necessarily. A password and a PIN are both something you know, so one kind of theft or phishing can capture both. MFA relies on independent kinds of evidence.
- Something you have (for example a phone app or a security key) and something you are (for example a fingerprint). Accept any accurate example.
- If you lose a phone or key, recovery is how you get back in. A weak recovery path can also become the easiest way in for someone else, so set it up deliberately.
- Reader. Least privilege means giving only the access a task needs. Editor or Administrator rights would let a mistake or a misuse do more damage.
- Signing in (authentication) checks who you are. Permission (authorisation) decides what you may do, and it should be checked on every action. Hiding a button is not enough.
Common misconceptions to listen for
- “MFA makes an account unhackable.” It raises the bar. Phishing and weak recovery still matter.
- “Two passwords is two-factor.” Both are something you know.
- “Signed in means allowed.” Authentication and authorisation are separate checks.
Sources to check
Workshop 3 · 45 minutes
Will I lose this file? Why is it slow?
Learners explain why sync is not the same as backup, and find the slowest link before deciding what to upgrade.
- Who it suits
- New help-desk staff, small-office helpers, and anyone who looks after a family computer.
Before you start
- Open both lessons. All files and speeds in them are pretend.
- Do not use real important files, or anyone else’s device, for a demonstration.
- Print one worksheet per learner, or share the download.
Run of show
| 0–5 min | Warm-up Ask: “Your files sync to the cloud. You delete one by accident. Is it safe?” Learners write a guess (question 1). |
|---|---|
| 5–18 min | Delete a pretend file In the sync lesson, delete the pretend original, then sync the mirror. Predict first: where is the photo now? Then restore the earlier snapshot. Discuss the difference between a mirror and a copy with history. |
| 18–25 min | Write a recovery note Learners fill in the recovery note on the worksheet (question 3) for a pretend or a sanitised real setup. Don’t collect it. |
| 25–38 min | Upgrade the wrong link In the speed lesson, start at 100 Mb/s Wi-Fi, 50 Mb/s internet and a 200 Mb/s remote service. Raise the Wi-Fi to 300 first, then the internet link above 200. Predict the ceiling each time, then cover bits vs bytes. |
| 38–45 min | Explain it back Learners write one better question to ask before buying an upgrade (question 6). |
Learner worksheet
noobquestions.com/teach/ · Will I lose this file? Why is it slow? · Name: ____________________
Before the lesson: files sync to the cloud and one is deleted by accident. Is it safe?
A mirror faithfully syncs deletions and keeps no history. Will it undo an accidental deletion? Why?
Recovery note — what is protected, where the copy lives, how often it runs, and the date of the last test restore.
Wi-Fi is 300 Mb/s and the internet link is 50 Mb/s. What is the download ceiling in this model?
A plan says 100 Mb/s. Roughly how many megabytes per second is that, at best?
Exit question: before upgrading anything for a slow download, what one question would you ask?
Answer guidance (for the facilitator)
- Any answer is fine. Come back to it after question 2.
- No. Deleting is a change too, and a mirror copies it. You need a copy with history (versions or a separate backup) to go back in time.
- A useful note names the files, where the copy is kept, how often it runs, and when a restore was last tested. A backup nobody has restored from is untested.
- 50 Mb/s. The slowest link sets the ceiling, so faster Wi-Fi alone won’t raise it.
- About 12.5 MB/s at best (8 bits per byte). Real transfers are a little lower because of overhead.
- Accept any question that isolates one link, e.g. “Is it slow on a wired connection too?” or “Which link is slowest?” Change one condition at a time.
Common misconceptions to listen for
- “Sync is a backup.” Sync copies deletions and mistakes too.
- “A faster router fixes everything.” Only if the Wi-Fi is the slowest link.
- “Mb and MB are the same.” Megabits vs megabytes differ by a factor of 8.
Sources to check
Good to know before you run one
- Privacy. Keep worksheets on paper or on the learner’s own device. Don’t collect names or answers you don’t need, and never ask anyone to type a real password, code, account name or workplace detail.
- Accuracy. These plans haven’t been evaluated in a classroom. The lessons simplify on purpose, so point learners to the sources listed with each plan before they change a real system.
- Reuse. No reuse licence has been set for these plans or worksheets. You can run a session with the live pages and print worksheets for your own group. Please ask before republishing or redistributing them.
- Corrections. Found a mistake or a confusing step? Each lesson has a reader discussion. Please don’t include personal or workplace information.