To ensure compliance with a security policy requiring that passwords be a combination of letters
and numbers, an IS auditor should recommend that:

An information security policy stating that ‘the display of passwords must be masked or suppressed’
addresses which of the following attack methods?

Which of the following would MOST effectively reduce social engineering incidents?

Which of the following would be the BEST access control procedure?

Which of the following is an example of the defense in-depth security principle?

The implementation of access controls FIRST requires:

An IS auditor performing an independent classification of systems should consider a situation
where functions could be performed manually at a tolerable cost for an extended period of time as:

Which of the following user profiles should be of MOST concern to an IS auditor when performing
an audit of an EFT system?

The reliability of an application system’s audit trail may be questionable if:

A hacker could obtain passwords without the use of computer tools or programs through the
technique of: