CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the password policy for a system that processes sensitive financial data. Which of the following is the MOST effective control to mitigate the risk of password cracking?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement account lockout after 5 failed attempts
Account lockout after a few failed attempts is the most effective control to prevent brute-force password cracking. Complexity and length help but do not prevent automated attacks; 2FA is strong but not specifically for cracking; password history prevents reuse but not cracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement account lockout after 5 failed attempts
Why this is correct
Lockout stops brute-force attacks by limiting the number of attempts.
- ✗
Require passwords of at least 12 characters with complexity
Why it's wrong here
Strong passwords increase difficulty but do not prevent automated brute-force attacks.
- ✗
Maintain a password history to prevent reuse
Why it's wrong here
Password history prevents reuse but does not prevent cracking.
- ✗
Enforce two-factor authentication for all users
Why it's wrong here
2FA provides additional security but does not directly prevent password cracking; it protects against credential theft.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.