Identifying Phishing via Hovering Links

SY0-701 By islever Editorial Last updated

Given a scenario, implement security awareness practices.

Short answer

A End user training helps the manager identify the phishing attack by teaching them to hover over and verify suspicious URLs.

Question

A manager receives an email that contains a link to receive a refund. After hovering over the link, the manager notices that the domain's URL points to a suspicious link. Which of the following security practices helped the manager to identify the attack?
  1. End user training Correct Answer
  2. Policy review
  3. URL scanning
  4. Plain text email

Key Takeaways

The scenario describes a user behavior (hovering to check a URL) that is a direct outcome of effective end-user security training, not an automated tool.

This question tests the role of security awareness training in helping employees identify phishing attempts by examining suspicious URLs.

Common mistake: Users often select 'URL scanning' because they associate checking links with technical tools, ignoring that the manager's action was manual and behavioral.

Expert Analysis

Why the Answer Is Correct

The correct answer is A — End user training. The manager's ability to recognize a discrepancy in the domain's URL by hovering over the link demonstrates knowledge of phishing tactics. This specific behavior—checking the actual destination of a hyperlink before clicking—is a key component of security awareness training programs designed to educate employees on identifying social engineering attacks.

Why the Other Options Are Wrong

Option C (URL scanning) typically refers to automated technologies that scan web content for malware or malicious indicators, which is not what the manager performed manually. Option B (Policy review) involves analyzing organizational rules rather than executing a defensive action against a threat. Option D (Plain text email) is irrelevant to the act of verifying a link's destination.

Community Comment Notes

The community overwhelmingly voted for A, recognizing that the manager's vigilance stems from training. As one commenter noted, "End user training teaches employees how to recognize phishing attempts." While a minority argued for C, stating "The manager is scanning a URL," this ignores that the practice being demonstrated is the trained behavior of verification, not the technical capability of a scanner.

Exam Strategy

When a question describes an employee performing a specific defensive action (like checking headers, hovering links, or verifying sender addresses), look for answers related to 'Training', 'Awareness', or 'Education' rather than technical controls like firewalls or scanners.

Frequently Asked Questions

Is checking a URL considered 'scanning'?

No. Scanning implies using automated tools or software to analyze content. Hovering is a manual, human-based verification technique taught through training.

Why isn't policy review the answer?

Policy review is an administrative activity to ensure compliance with rules. It does not describe the active identification of a specific malicious link by a user.

More SY0-701 FAQ →

Community Votes

A
83%
C
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. nillie 👍 2 Answered A
    The security practice that helped the manager identify the attack is: A. End user training End user training teaches employees how to recognize phishing attempts and other malicious activities. In this case, the manager's awareness of hovering over links to check for suspicious URLs before clicking is a direct result of effective security awareness training. This is a key aspect of preventing social engineering attacks, like phishing.
  2. chalaka 👍 1 Answered A
    A. End user training Explanation: The manager identified the suspicious link by recognizing a discrepancy in the domain's URL. This ability likely comes from end-user training on phishing and other cybersecurity threats. Such training teaches employees to carefully examine links, avoid clicking on unknown or suspicious URLs, and recognize common red flags of phishing attacks.
  3. Murtuza 👍 1 Answered A
    The correct answer is A. End user training. End user training helps employees recognize phishing attempts and other security threats by teaching them to look for signs such as suspicious URLs. This training empowers users to identify and avoid potential security risks effectively
  4. jsmthy 👍 1 Answered C
    The manager is scanning a URL. End-user training may make the practice of checking URLs more prevalent, but it is not the security practice being demonstrated.
  5. Ina22 👍 2
    A. End user training
Show 2 more comments
  1. 3dk1 👍 1 Answered A
    A, User training
  2. rabid_adobo 👍 1
    A. GPT

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide