220-1102 Question 480
Select 2End-user best practicesA technician is giving a short security awareness briefing to new office employees after several staff members received convincing email messages that appeared to come from the company's payroll provider. One employee clicked a link in a message and entered corporate credentials into a fake login page. The IT manager asks the technician to emphasize end-user best practices that would most effectively reduce the chance of this happening again. Which TWO actions should the technician recommend?
- A
Verify the sender's address and inspect links before clicking, especially when the message asks for urgent action or credential entry.
- B
Reply to the email and ask the sender to confirm the request before opening attachments or signing in.
- C
Use a known-good method, such as typing the payroll site's address manually or using a bookmarked company-approved link, instead of following email links.
- D
Disable spam filtering so suspicious emails are easier to identify without automated interference.
- E
Enter credentials only after confirming the site uses HTTPS, because the lock icon alone proves the site is legitimate.
Show answer and explanation
Correct answers: A, C
Explanation
This scenario focuses on practical end-user anti-phishing behavior, a key A+ Core 2 objective under end-user best practices. The strongest recommendations are to verify message details before acting and to avoid logging in through links embedded in unsolicited or unexpected emails. Security guidance from organizations such as CISA and NIST consistently emphasizes inspecting sender information, being cautious with urgent requests, and navigating to sensitive services through known-good URLs or bookmarks rather than email links. Users should also understand that technical indicators like a lock icon are not sufficient proof of legitimacy, and verification should occur through an independent, trusted channel when a message requests credentials or financial action.
- A. Correct.
Correct. Verifying the sender's actual address and hovering over or otherwise inspecting links are core end-user anti-phishing practices. Phishing messages commonly use display names, look-alike domains, and urgent language to pressure users into acting quickly. Teaching users to slow down and validate the request before clicking directly addresses the scenario.
- B. Incorrect.
Incorrect. Replying to the same email thread is not a reliable verification method because the attacker controls that communication channel. Users may believe they are validating the request, but they are often just engaging with the phisher. Best practice is to use an out-of-band or independently verified contact method instead.
- C. Correct.
Correct. Using a trusted bookmark, company portal, or manually entering the known URL avoids the risk of being redirected to a spoofed login page through a malicious email link. This is a practical and widely recommended end-user habit for payroll, banking, and other sensitive services.
- D. Incorrect.
Incorrect. Spam filtering is a protective control that helps reduce exposure to phishing attempts. Disabling it would increase the number of suspicious emails reaching users and would weaken, not improve, security. End-user best practices should complement technical controls rather than remove them.
- E. Incorrect.
Incorrect. HTTPS only indicates that the connection to the site is encrypted; it does not prove the website itself is legitimate. Phishing sites can also use valid TLS certificates and display a lock icon. Users should verify the full domain and access sensitive sites through trusted methods, not rely on HTTPS alone.