Which of the following controls would BEST detect intrusion?

A. User IDs and user privileges are granted through authorized procedures.

B. Automatic logoff is used when a workstation is inactive for a particular period of time.

C. Automatic logoff of the system occurs after a specified number of unsuccessful attempts.

D. Unsuccessful logon attempts are monitored by the security administrator.

Explanation:

Intrusion is detected by the active monitoring and review of unsuccessful logons. User IDs and the granting of user privileges define a policy, not a control. Automatic logoff is a method of preventing access on inactive terminals and is not a detective control. Unsuccessful attempts to log on are a method for preventing intrusion, not detecting.