Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

Mandating security policy acceptance is a compliance-based administrative control that does not guarantee employees will internalize or act on the policy, leaving human behavior unchanged against social engineering tactics.

Changing individual behavior directly addresses the human element that social engineering exploits, such as susceptibility to manipulation, trust exploitation, and poor decision-making under pressure. Unlike policies or training evaluations alone, actual behavioral change means employees instinctively verify identities, question unusual requests, and resist manipulation tactics. This is the only countermeasure that modifies the attack surface itself - the human - rather than addressing symptoms or procedural compliance.

Evaluating security awareness training measures the effectiveness of a program but is an assessment activity, not a direct countermeasure; it does not itself change how individuals respond to social engineering attempts.

Filtering malicious e-mail content is a technical control that addresses only one delivery channel (phishing emails) and does not protect against other social engineering vectors such as vishing, impersonation, or in-person pretexting.