CompTIA 220-1202 Exam - Topic 4 Question 29 Discussion

Among the options, threat (end-user) education most directly addresses both preventing malware installation and preventing accidental disclosure of sensitive information, because it changes user behavior---the number one target of many attacks. Quentin Docter emphasizes: ''By far the best prevention of security threats is the education of your end users regarding common threats,'' explaining that the most effective method is teaching users not to open suspicious files and to open only those they're reasonably sure are malware-free. Docter adds that trained users can better identify Trojans and phishing scams and should also learn guidelines for protecting sensitive information and recognizing social engineering threats.

Docter also states clearly that even when antimalware tools exist, ''user education is much more effective'' in preventing certain notification-based and trick-based malware installs. While Secure Boot, firewalls, and email gateways are valuable technical controls, they don't cover the broad human-risk dimension of both malware installs and sensitive data disclosure as effectively as education/training. Hence B is correct.