What best describes phishing and what controls help prevent it?

• A. A social engineering attack to steal credentials; controls include user training, email filtering, MFA, and URL/attachment scanning.
• B. A malware that encrypts files for ransom.
• C. A process to update software automatically.
• D. A method to physically secure servers.

Answer: (A)

Phishing is a social engineering tactic that tries to steal credentials or sensitive information by pretending to be a trusted source, usually through email or messages that lead to fake login pages or requests for data. Preventing it relies on layered controls: educating users to recognize suspicious senders, urgent or unusual requests, and mismatched URLs; using email filtering to block or quarantine phishing messages before they reach people; requiring multi-factor authentication so an attacker cannot access accounts with stolen passwords alone; and implementing URL and attachment scanning to detect and block malicious links and files. The other options describe different issues: one is ransomware, which encrypts files for ransom; another is automatic software updates; another is physical security of servers.