A parks department GoPhish simulation needs a landing-page outcome that supports learning without endangering production identity. Which design is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
The landing page should be a classroom, not a password vacuum. Teach ‘report this,’ count the click, and leave real IdP credentials alone. Shared spreadsheets of staff passwords are a self-own.
Full Explanation
A parks department GoPhish simulation should use landing pages that teach reporting and record the click without collecting real production passwords. That design preserves learning value—staff see they clicked, learn how to report, and metrics still inform coaching—while avoiding creation of a municipal password store from the exercise itself. Proxying the page to the real parks IdP so clicked passwords can be validated live converts the simulation into live credential testing against production identity and expands compromise risk if pages or logs are mishandled. Storing submitted passwords in a shared spreadsheet for managers to review weekly is an unacceptable credential-handling practice and invites insider abuse. Forcing password reuse testing by requiring staff to enter their current network credentials intentionally harvests production secrets under the banner of training and conflicts with safe civic exercise design. Exam caveat: GOAA phishing-platform items expect educational landing outcomes, not production password capture. Operational check: configure GoPhish landers for teach-and-report content, disable password fields that mirror the real IdP, and verify no production credentials are written to campaign storage.