Human resources wants staff to get better at spotting and reporting fake 'payroll update' emails. Which awareness practice best addresses that goal?
Select an answer to reveal the explanation.
Short Explanation
Phishing drills are fire drills for the inbox—practice spotting the fake, then practice pulling the alarm the right way. Recognition plus reporting is the habit you want.
Full Explanation
Improving staff ability to spot and report fake payroll-update emails is a classic phishing awareness goal. The best practice is to run phishing campaigns and simulations that train recognition and reinforce how to report suspicious messages through the approved channel. Simulations create safe failure, teach cues, and measure who needs coaching without waiting for a real compromise.
Disabling email reporting buttons to reduce help-desk volume destroys the human sensor network cities rely on. Public shaming on the intranet for every failed simulation click breeds fear and under-reporting rather than learning. Assuming technical filters make awareness unnecessary ignores residual risk: attackers bypass filters, and municipal workers remain high-value targets for payroll and benefits fraud.
Exam caveat: SY0-701 awareness content favors simulations plus reporting practice, not punishment theater, disabled reporting, or filter-only complacency.
Operational check: schedule recurring campaigns with role-relevant lures, provide just-in-time micro-training on failure, celebrate report rates, ensure the report button creates SOC/help-desk tickets, and trend click-versus-report metrics for HR and the CISO—not public humiliation lists.