Exam SY0-701 topic 1 question 524 discussion

I wont lie, I'm confused. CompTIA's definition of Phishing is a form of social engineering that involves communication via email, phone or text requesting a user take action, such as navigating to a fake website. On one hand, I think how did the employees know about the website in the first place? Probably an email. And the question asks how to REDUCE the number of visits. This makes me think a campaign just because it isnt asking to outright eliminate the amount of visits like a deny list would. On the other, my first reaction was a deny list just due to the lack of the word "email" in the question.

CompTIA expects for similar questions, that a "user training" is the best solution against phishing or similar activities. That's why I tend slightly to B over D.

The question says that the employees disclosed credentials when visiting an external website, not necessarily thorugh email (phishing). To prevent employees from visiting similar websites, it'd be best to implement a deny list of similar websites.

company delivered a fake Honeypot internal website to catch the staff who disbursed the SSO. So the activities relevant to phishing.