Identifying Phishing via Hovering Links

Given a scenario, implement security awareness practices.

A manager receives an email that contains a link to receive a refund. After hovering over the link, the manager notices that the domain's URL points to a suspicious link. Which of the following security practices helped the manager to identify the attack?

  1. End user training Correct Answer
  2. Policy review
  3. URL scanning
  4. Plain text email
Answer Correct answer: A — End user training helps the manager identify the phishing attack by teaching them to hover over and verify suspicious URLs.

Community Votes

A
83%
C
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The scenario describes a user behavior (hovering to check a URL) that is a direct outcome of effective end-user security training, not an automated tool.

This question tests the role of security awareness training in helping employees identify phishing attempts by examining suspicious URLs.

Users often select 'URL scanning' because they associate checking links with technical tools, ignoring that the manager's action was manual and behavioral.

Community Discussion (7 comments)

chalaka 👍 1 Selected: A
A. End user training Explanation: The manager identified the suspicious link by recognizing a discrepancy in the domain's URL. This ability likely comes from end-user training on phishing and other cybersecurity threats. Such training teaches employees to carefully examine links, avoid clicking on unknown or suspicious URLs, and recognize common red flags of phishing attacks.
3dk1 👍 1 Selected: A
A, User training
Murtuza 👍 1 Selected: A
The correct answer is A. End user training. End user training helps employees recognize phishing attempts and other security threats by teaching them to look for signs such as suspicious URLs. This training empowers users to identify and avoid potential security risks effectively
nillie 👍 2 Selected: A
The security practice that helped the manager identify the attack is: A. End user training End user training teaches employees how to recognize phishing attempts and other malicious activities. In this case, the manager's awareness of hovering over links to check for suspicious URLs before clicking is a direct result of effective security awareness training. This is a key aspect of preventing social engineering attacks, like phishing.
jsmthy 👍 1 Selected: C
The manager is scanning a URL. End-user training may make the practice of checking URLs more prevalent, but it is not the security practice being demonstrated.
rabid_adobo 👍 1
A. GPT
Ina22 👍 2
A. End user training

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The correct answer is A — End user training. The manager's ability to recognize a discrepancy in the domain's URL by hovering over the link demonstrates knowledge of phishing tactics. This specific behavior—checking the actual destination of a hyperlink before clicking—is a key component of security awareness training programs designed to educate employees on identifying social engineering attacks.

Why the Other Options Are Wrong

Option C (URL scanning) typically refers to automated technologies that scan web content for malware or malicious indicators, which is not what the manager performed manually. Option B (Policy review) involves analyzing organizational rules rather than executing a defensive action against a threat. Option D (Plain text email) is irrelevant to the act of verifying a link's destination.

Community Comment Notes

The community overwhelmingly voted for A, recognizing that the manager's vigilance stems from training. As one commenter noted, "End user training teaches employees how to recognize phishing attempts." While a minority argued for C, stating "The manager is scanning a URL," this ignores that the practice being demonstrated is the trained behavior of verification, not the technical capability of a scanner.

Exam Strategy

When a question describes an employee performing a specific defensive action (like checking headers, hovering links, or verifying sender addresses), look for answers related to 'Training', 'Awareness', or 'Education' rather than technical controls like firewalls or scanners.

Frequently Asked Questions

Is checking a URL considered 'scanning'?

No. Scanning implies using automated tools or software to analyze content. Hovering is a manual, human-based verification technique taught through training.

Why isn't policy review the answer?

Policy review is an administrative activity to ensure compliance with rules. It does not describe the active identification of a specific malicious link by a user.

More SY0-701 FAQ →

Related Analysis

Which of the following methods to secure credit card data is

S-Grade

After an audit, an administrator discovers all users have ac

A-Grade

A security analyst locates a potentially malicious video fil

A-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide