A security report shows that during a two-week test period, 80% of employees unwittingly disclosed their SSO credentials when accessing an external website. The organization purposely created the…

Question

Options

• ABlock all outbound traffic from the intranet.
• BIntroduce a campaign to recognize phishing attempts.
• CRestrict internet access for the employees who disclosed credentials.
• DImplement a deny list of websites.

• A
  2% (1)
• B
  84% (38)
• C
  4% (2)
• D
  9% (4)

Explanation

Option B is correct because the root cause of the problem is that employees couldn't recognize a social engineering/phishing attempt - 80% were deceived by a fake "password complexity test" site. A security awareness campaign teaches employees to identify and avoid such deceptive sites in the future, addressing the human vulnerability directly.

Why the distractors fail:

• A (Block all outbound traffic): This is far too broad and would cripple legitimate business operations - employees couldn't access the internet at all.
• C (Restrict access for offenders): This is reactive and punitive, targeting only those already caught rather than preventing future incidents across the whole organization.
• D (Deny list): Attackers constantly register new domains; a deny list can't keep up with every new phishing site and only blocks known bad URLs, not future ones.

Memory tip: When a security question involves employees falling for deception or manipulation, the answer almost always involves user education/awareness training - technical controls can't fix a human behavior problem. Think: "You can't firewall stupidity, but you can train it out."

No community discussion yet for this question.