After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Send a reminder email once a year and stop there

A single reminder rarely changes behavior and does not provide meaningful measurement over time.

Disable all external email for every employee

That would disrupt normal business communication and is usually far more restrictive than needed.

Tell users to ignore suspicious messages unless IT calls first

This creates a dangerous reporting delay and can allow real phishing attempts to succeed.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Run role-based phishing awareness training — Role-based phishing training and simulated phishing exercises are the best answer. Training improves employee judgment, while simulations and metrics let the team measure whether behavior is improving over time. Together, they address both awareness and accountability. This is more effective than one-time reminders because it creates a repeatable feedback loop for security culture. Why others are wrong: A yearly reminder is too weak to change behavior on its own. Disabling all external email would hurt business operations and is not a focused training control. Telling users to wait for IT to call can delay reporting and increases risk. The goal is to improve awareness and measure outcomes, which is why structured training plus phishing simulations is the strongest pair.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.