An employee receives an e-mail claiming to be from the IT department, demanding an urgent password 'validation' via a link to a look-alike page with a subtly misspelled domain. This is an example of:

1. Phishing — a social-engineering attempt to steal credentials through urgency and a fraudulent link
2. A legitimate security awareness training measure that must always be obeyed
3. A software update that requires immediate execution
4. A firewall rule being applied to the user's inbox