Which of the following is a best practice when browsing the internet?

The answer

The correct best practice is to verify that a website uses an encrypted link (HTTPS / the padlock) before you enter sensitive information such as passwords, card numbers, or personal details. This is the answer the DoD Cyber Awareness Challenge and most security curricula expect.

HTTPS stands for HyperText Transfer Protocol Secure. The "S" means the connection is wrapped in TLS encryption, so anything you type is scrambled between your device and the server. Anyone intercepting the traffic — on public Wi-Fi, for example — sees ciphertext, not your password. Plain HTTP sends the same data in the clear.

Why the other options are wrong

Common distractors on this question fail for concrete reasons:

• "Only the padlock proves a site is legitimate." A padlock means the connection is encrypted, not that the site is trustworthy. Phishing sites can obtain free TLS certificates, so HTTPS is necessary but not sufficient — you must also confirm the domain name is the real one.
• "Disable your browser's security features / turn off updates for speed." Wrong — outdated browsers carry unpatched vulnerabilities that drive-by attacks exploit. Keeping the browser and its plugins current is itself a best practice.
• "Save passwords and let any site auto-fill them." Reusing and freely auto-filling credentials increases blast radius when one site is breached; a reputable password manager with unique passwords is safer.
• "Click links in unsolicited emails to reach your bank." This is exactly how phishing works. Type the address yourself or use a saved bookmark.

The bigger picture

Safe browsing is a checklist, not a single trick:

• Inspect the URL, not just the padlock. Read the domain carefully. paypa1.com or bank-secure-login.com are look-alikes. The real domain sits immediately to the left of the first single slash.
• Keep software patched. Enable automatic updates for the browser, OS, and extensions.
• Be cautious on public Wi-Fi. Avoid banking or shopping on open networks; if you must, use a VPN so the whole session is encrypted end-to-end.
• Watch for phishing cues. Urgency ("act now or your account is closed"), mismatched sender addresses, generic greetings, and requests for credentials are red flags.
• Limit what you share. Only provide sensitive data on pages you reached deliberately and whose identity you have confirmed.

Putting it together: HTTPS protects the transmission of your data, while checking the domain and staying patched protects against who you are actually talking to. Both halves are needed — which is why confirming the encrypted link is the best-practice answer, but never the only step.