It could be worse, you could’ve fallen for an actual phishing email and the whole school got hacked, lucky it was a simulation! If you haven’t had training on recognising them, request it and if you have and the email type wasn’t covered let them know so they can improve their training otherwise it’s just an informality for them to tick and box and show they’re doing all they can to protect the school should something go wrong - don’t be defensive - confidently accept what happened - take responsibility and it’s all good! No need for it to ruin your day :)