Social engineering exploits human vulnerabilities, and the most effective mitigation is training employees to recognize and respond to these threats. Security awareness programs help build a culture of vigilance, equipping employees with the knowledge to identify phishing attempts, suspicious behavior, and other social engineering tactics.
* Multi-factor Authentication (MFA) (Option A):Enhances access control but does not address the human vulnerability to social engineering.
* Access History Log Review (Option C):Useful for post-incident analysis but does not prevent incidents.
* File Encryption with Password Protection (Option D):Adds security layers but is ineffective if the password is compromised.
Reference:ISACA CISA Review Manual, Job Practice Area 4: Protection of Information Assets.