Exam CISA Topic 4 Question 89 Discussion

Social engineering exploits human vulnerabilities, and the most effective mitigation is training employees to recognize and respond to these threats. Security awareness programs help build a culture of vigilance, equipping employees with the knowledge to identify phishing attempts, suspicious behavior, and other social engineering tactics.
* Multi-factor Authentication (MFA) (Option A): Enhances access control but does not address the human vulnerability to social engineering.
* Access History Log Review (Option C): Useful for post-incident analysis but does not prevent incidents.
* File Encryption with Password Protection (Option D): Adds security layers but is ineffective if the password is compromised.
Reference: ISACA CISA Review Manual, Job Practice Area 4: Protection of Information Assets.