Which of the following are common anti-phishing controls?

• A. Password rotation alone.
• B. Email filtering.
• C. MFA only.
• D. User training, email filtering, MFA, and domain authentication (DKIM/SPF/DMARC).

Answer: (D)

Preventing phishing succeeds when multiple barriers address both people and technology. Training users to recognize suspicious messages reduces the chance they’ll reveal credentials or click on dangerous links. Email filtering acts at the gateway to catch many phishing emails before they reach inboxes. Multi-factor authentication adds a second factor so that stolen passwords alone aren’t enough to access accounts. Domain authentication with DKIM, SPF, and DMARC helps verify that messages actually come from the claimed domain and reduces spoofed emails that impersonate legitimate organizations. When you combine training, filtering, MFA, and domain verification, you create layered defenses that cover awareness, detection, access control, and message integrity.

Relying on password rotation alone doesn’t address phishing itself and can still allow credential theft to lead to compromised accounts. Email filtering by itself helps but may miss targeted or novel phishing so it isn’t sufficient alone. MFA is powerful but not foolproof on its own and doesn’t prevent phishing emails from arriving or domain spoofing. Domain authentication helps reduce spoofing but doesn’t educate users or strengthen login authentication by itself.