When logging on to a workstation, the log-on process should:

A.
Provide a Help mechanism that provides log-on assistance.

B.
Not provide information on the previous successful log-on and on previous unsuccessful log-on
attempts.

C.
Place no limits on the time allotted for log-on or on the number of unsuccessful log-on attempts.

D.
Validate the log-on only after all input data has been supplied.

Explanation:
This approach is necessary to ensure that all the information required for a log-on has been
submitted and to avoid providing information that would aid a cracker in trying to gain unauthorized
access to the workstation or network. If a log-on attempt fails, information as to which part of the
requested log-on information was incorrect should not be supplied to the user. Answer “Provide a
Help mechanism that provides log-on assistance” is incorrect since a Help utility would provide help
to a cracker trying to gain unauthorized access to the network. For answer “Place no limits on the
time allotted for log-on or on the number of unsuccessful log-on attempts”, maximum and minimum

time limits should be placed on the log-on process. Also, the log-on process should limit the number
of unsuccessful log-on attempts and temporarily suspend the log-on capability if that number is
exceeded. One approach is to progressively increase the time interval allowed between unsuccessful
log-on attempts. Answer “Not provide information on the previous successful log-on and on
previous unsuccessful log-on attempts” is incorrect since providing such information will alert an
authorized user if someone has been attempting to gain unauthorized access to the network from
the user’s workstation.