Email Phish Threat

Good Morning, 

I am creating a campaign and I'm having troubles finding a few things.  My HR department needs to vet all Sophos text for the users and I 'm having troubles finding examples of the landing pages after a user clicks the link (not credential harvesting landing page).  For the phishing category when sending a test email the link leads to a 404 Sophos page.  An example of the page after a user would enter their credentials would be needed as well.

Question 2.

For email attachment campaign strategies does the customized attachment open in outlook with the custom attachment?  

Question 3.

is this all correct for steps to do.

Whitelist links on firewall

whitelist domains on O365 and email security gateways

whitelist attachments in O365