Section: Protection of Information Assets
Explanation:
If a user writes their PIN on a slip of paper, an individual with the token, the slip of paper, and the computer
could access the corporate network. A token and the PIN is a two-factor authentication method. Access to
the token is of no value without the PIN; one cannot work without the other. The PIN does not need to be
random as long as it is secret.

The best recommendation to reduce the risk of data leakage from employee use of social networking sites for business purposes is to provide education and guidelines to employees on use of social networking sites.
Education and guidelines can help employees understand the benefits and risks of using social media for business purposes, such as enhancing brand awareness, engaging with customers, or sharing industry insights.
They can also inform employees about the dos and don'ts of social media etiquette, such as respecting privacy, protecting intellectual property, avoiding conflicts of interest, or complying with legal obligations.
Education and guidelines can also raise awareness of potential data leakage scenarios, such as phishing attacks, malicious links, fake profiles, or oversharing sensitive information, and provide tips on how to prevent or respond to them.

Section: Protection of Information Assets
Explanation:
Only reviewing transaction and application logs directly addresses the threat posed by poor segregation of
duties. The review is a means of detecting inappropriate behavior and also discourages abuse, because
people who may otherwise be tempted to exploit the situation are aware of the likelihood of being caught.
Inadequate segregation of duties is more likely to be exploited via logical access to data and computing
resources rather than physical access. Choice C is a useful control to ensure IT staff are trustworthy and
competent but does not directly address the lack of an optimal segregation of duties. Choice D acts to
prevent unauthorized users from gaining system access, but the issue of a lack of segregation of duties is
more the misuse (deliberately or inadvertently} of access privileges that have officially been granted.