Security Operations and Administration →mediumMultiple ChoiceObjective-mapped

SSCP Security Operations and Administration Practice Question

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The email creates a sense of urgency or threatens negative consequences

Phishing emails often contain urgent or threatening language to prompt immediate action. While other indicators like misspellings can be present, the most reliable is the use of urgency or threats, which is a common social engineering tactic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The email contains an attachment from an unknown sender
Why it's wrong here
Attachments are a common vector, but some legitimate emails have attachments. Urgency is a stronger indicator.
✗
The email has grammatical errors or misspellings
Why it's wrong here
While common, errors are not always present; some phishing emails are well-written.
✓
The email creates a sense of urgency or threatens negative consequences
Why this is correct
Urgency and threats are classic phishing tactics designed to bypass rational thinking.
✗
The email address of the sender closely resembles a legitimate domain
Why it's wrong here
Spoofed domains are common, but not all such emails are phishing. The urgency is more telling.

Go deeper

SSCP Security Operations and Administration Practice Question

Why each option matters

Option-by-option breakdown

Related to this question