During an audit, which action demonstrates that authentication policies are distributed and understood by users?

• A. Examine Documentation And Interview Personnel
• B. Inspect Network Diagrams
• C. Run A Vulnerability Scan
• D. Review Firewall Configurations

Answer: (A)

Understanding authentication policies requires evidence that the policies exist, are accessible, and that users actually understand and can follow them. Examining the documentation confirms that the policies are written, up-to-date, and available to staff. Interviewing personnel then shows whether users understand the requirements in practice—how to authenticate, what credentials are needed, when MFA is required, and how to handle exceptions. This combination demonstrates that authentication policies are both distributed and understood.

The other actions focus on technical controls and configurations (network diagrams, vulnerability scans, firewall settings) and don’t directly show whether users are aware of or following the authentication policies.