A manager receives an email that contains a link to receive a refund. After hovering over the link, the manager notices that the domain's URL points to a suspicious link. Which of the following security practices helped the manager to identify the attack?

End-user training is the correct answer because it educates employees on how to recognize and respond to security threats, such as phishing attempts. In this scenario, the manager applied knowledge gained from training to identify a suspicious link by hovering over it, a common technique taught in security awareness programs. Policy review is incorrect because while policies define security rules, they don't directly equip users with the skills to detect attacks in real-time. URL scanning is a technical control that might be implemented by security systems, but the manager's action was a manual, human-driven detection. Plain text email is incorrect; while it can sometimes reduce certain types of exploits, it doesn't inherently reveal a malicious URL in the same way a user's trained eye does.