An organization has learned that several employees recently clicked on a malicious email link that encrypted the employees' files. Which of the following is the BEST preventive control to mitigate…

The correct answer is A. End-user security training. Since the attack succeeded because employees clicked a malicious link, the root cause is human behavior - making end-user security awareness training the most effective preventive control. Training teaches users to recognize phishing and suspicious links before acting on them…

Submitted by helene.fr· Apr 18, 2026Information Security Risk Management

Question

An organization has learned that several employees recently clicked on a malicious email link that encrypted the employees’ files. Which of the following is the BEST preventive control to mitigate the associated risk?

Options

AEnd-user security training
BFile exfiltration monitoring
CMulti-factor authentication (MFA)
DNetwork segmentation

How the community answered

(22 responses)

A
77% (17)
B
14% (3)
C
5% (1)
D
5% (1)

Explanation

Since the attack succeeded because employees clicked a malicious link, the root cause is human behavior - making end-user security awareness training the most effective preventive control. Training teaches users to recognize phishing and suspicious links before acting on them. File exfiltration monitoring (B) is detective, not preventive. MFA (C) protects authentication but would not stop a user from clicking a link that triggers file encryption. Network segmentation (D) can limit lateral movement but does not prevent the initial click.

Topics

#Security awareness training#Preventive controls#Phishing prevention#Ransomware mitigation

Community Discussion

No community discussion yet for this question.

Full CISM Practice