End user training is the correct answer because the manager identified the suspicious link by applying safe email-handling behavior. Security awareness training teaches users to hover over links, inspect destination URLs, recognize mismatched domains, avoid clicking unknown refund links, and report suspected phishing. This is a human detection control that reduces successful social engineering attacks. URL scanning is a technical control that automatically analyzes links for malicious destinations; the question describes the manager personally recognizing the suspicious URL, not a tool scanning it. Policy review does not directly help a user identify a malicious email in real time. Plain text email can reduce clickable links, but it does not explain the manager’s ability to identify the suspicious domain.

================