Section: Protection of Information Assets
Explanation:
If the IS auditor finds that there are effective staging and job set up processes, this can be accepted as a compensating control. Choice B is a detective control while choices C and D are corrective controls, none of which would serve as good compensating controls.

An integrated test facility creates a fictitious entity in the database to process test transactions simultaneously with live input. Its advantage is that periodic testing does not require separate test processes. However, careful planning is necessary, and test data must be isolated from production data.

Explanation/Reference:
Explanation: Sniffing is an attack that can be used to capture sensitive pieces of information (e.g., a password) passing through the network. Encryption is a method of scrambling information to prevent unauthorized individuals from understanding the transmission. Spoofing is forging an address and inserting it into a packet to disguise the origin of the communication. Data destruction is erasing information or removing it from its original location.

Section: Protection of Information Assets
Explanation:
Passwords are the first defensive line in protecting your data and information. Your users need to be made
aware of what a password provides them and what can be done with their password. They also need to be
made aware of the things that make up a good password versus a bad password. A good password has
mixed-case alphabetic characters, numbers, and symbols. Do use a password that is at least eight or more
characters.