Which of the following is NOT a recommended phishing mitigation?

• A. Training and awareness
• B. Email filtering and URL checking
• C. Enabling only single-factor authentication
• D. Multi-factor authentication

Answer: (C)

Defending against phishing works best with layered controls that both reduce exposure and limit what happens if credentials are stolen. Training and awareness prime users to recognize suspicious messages, risky links, and spoofed domains, lowering the chance of a successful phishing attempt. Email filtering and URL checking act as gates that block many phishing emails and destinations before users even see them. Multi-factor authentication adds a second form of verification, so even if a password is captured through phishing, the attacker still can’t easily access the account without the additional factor.

Enabling only single-factor authentication relies entirely on a password. If that password is phished, the attacker gains access directly, defeating the protection offered by phishing-resistant controls. That’s why single-factor authentication is not recommended as a mitigation.