A user receives an email that appears to be from the company's HR department asking the user to click a link and enter their login credentials to view an updated benefits statement. The user suspects this is a phishing attempt. Which characteristic of the email most strongly indicates a phishing attack?

The email contains a generic greeting like 'Dear Employee' instead of the recipient's name.

Generic greetings are common in phishing but can also occur in legitimate mass emails; it is a weak indicator alone.

The email has a few spelling and grammar errors.

While poor spelling may indicate phishing, professional phishing emails can be well-written; it is not the strongest indicator.

The email is sent from an address that looks similar to the company's HR domain but with a slight misspelling.

Spoofed addresses are a strong indicator, but the request for credentials is the most direct evidence of phishing intent.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: The email asks the recipient to click a link and enter their username and password immediately to avoid losing benefits. — Phishing emails often create a sense of urgency and request that the recipient take immediate action (like clicking a link and entering credentials) to avoid a negative consequence or to secure a benefit. Legitimate companies typically do not ask for credentials via email links. While spelling errors and generic greetings can be signs, the request for credentials combined with urgency is a red flag. Checking the sender address is important, but the request itself is the strongest indicator.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.