What are the effective defenses against phishing?

• A. MFA and email filtering
• B. Phishing simulations
• C. User awareness training, phishing simulations, and technical controls like MFA and email filtering.
• D. None of the above

Answer: (C)

Defending against phishing requires a layered approach that addresses both people and technology. Training builds the habit of spotting suspicious emails, avoiding risky actions, and reporting phishing attempts, which lowers the likelihood of credential theft. Phishing simulations reinforce that training with realistic practice and provide metrics to tailor ongoing education. Technical controls like multi-factor authentication make it much harder for attackers to misuse stolen credentials, since a second factor is needed. Email filtering and security gateways block many phishing messages before they reach users, and proper email authentication standards (such as DMARC, DKIM, SPF) help verify legitimate senders. Put together, these elements create a defense-in-depth that reduces both the chance of a phish succeeding and the damage if one slips through. Relying on only one part leaves gaps, while the full combination provides the strongest protection.