function QuizPage({ onNavigate, toast }) {
const questions = [
{
q: "You receive an email from 'chief.radiology@hosp1tal.com' asking you to urgently share a patient's MRI. What do you do?",
options: [
{ letter: 'A', text: 'Reply with the file attached — the chief is in a hurry.' },
{ letter: 'B', text: 'Forward to a colleague to verify before sending.' },
{ letter: 'C', text: 'Report as phishing and contact the chief by phone using a known number.' },
{ letter: 'D', text: 'Click the attached verification link to check the request.' },
],
correct: 2,
explain: "Correct. The domain 'hosp1tal.com' swaps an 'i' for a '1' — a classic typosquat. Always verify urgent requests by an out-of-band channel like a known phone number.",
wrongExplain: {
0: "Never send patient data based on an unverified email — especially one with a suspicious domain.",
1: "Forwarding spreads the phish. Report it, then verify via a known channel.",
3: "The link itself could harvest credentials or install malware. Don't click — report."
}
},
{
q: "A visitor asks to charge their phone via the USB port on a nursing workstation. What is the safest action?",
options: [
{ letter: 'A', text: 'Allow it briefly — it\'s just charging.' },
{ letter: 'B', text: 'Redirect them to a public outlet — never USB on medical workstations.' },
{ letter: 'C', text: 'Ask a colleague what they think.' },
{ letter: 'D', text: 'Lock the screen and allow charging.' },
],
correct: 1,
explain: "Correct. 'Juice jacking' devices can exfiltrate data or install malware through USB. Medical workstations must never accept unknown USB peripherals, even for charging.",
wrongExplain: {
0: "USB ports transmit data, not just power. This is a known attack vector (BadUSB, juice jacking).",
2: "Policy is already clear — no unknown USB devices on clinical workstations. Don't wait.",
3: "Locking the screen doesn't prevent USB-level attacks, which operate below the OS login."
}
},
{
q: "You see a colleague's credentials written on a sticky note under their keyboard. Best first step?",
options: [
{ letter: 'A', text: 'Ignore — it\'s their problem.' },
{ letter: 'B', text: 'Take the note and throw it away.' },
{ letter: 'C', text: 'Privately remind the colleague and report to compliance.' },
{ letter: 'D', text: 'Post about it in the staff chat as a warning.' },
],
correct: 2,
explain: "Correct. A private reminder preserves the working relationship; reporting to compliance triggers the required password rotation and creates the audit trail.",
wrongExplain: {
0: "Shared credentials risk breach of every patient record that account can access — not just theirs.",
1: "Removing evidence without telling them leaves them locked out and removes the audit trail.",
3: "Public shaming damages trust. Private resolution + official reporting is the right workflow."
}
}
];
const [idx, setIdx] = useState(0);
const [selected, setSelected] = useState(null);
const [locked, setLocked] = useState(false);
const [score, setScore] = useState(0);
const [done, setDone] = useState(false);
const [introOpen, setIntroOpen] = useState(() => {
try { return !localStorage.getItem('medishield_quiz_intro_seen'); } catch { return true; }
});
const dismissIntro = () => {
setIntroOpen(false);
try { localStorage.setItem('medishield_quiz_intro_seen', '1'); } catch {}
};
const q = questions[idx];
const choose = (i) => {
if (locked) return;
setSelected(i);
setLocked(true);
if (i === q.correct) setScore(s => s + 1);
};
const next = () => {
if (idx + 1 < questions.length) {
setIdx(idx + 1);
setSelected(null);
setLocked(false);
} else {
setDone(true);
}
};
if (done) {
const pct = Math.round((score / questions.length) * 100);
const passed = pct >= 80;
return (
This quiz has {questions.length} questions. You'll see the correct answer and a short explanation after each one.
You need 80% to pass. There is no time limit.