During testing of Req 2.3, what should you verify about admin login?

• A. Password is transmitted in clear text during login
• B. A strong encryption method is invoked before the admin's password is requested
• C. Insecure remote-login commands are allowed for convenience
• D. Encryption is not required for admin login

Answer: (B)

The key idea is protecting admin credentials as they travel over the network. For admin login, you must ensure a strong, encrypted channel is established before any password is sent. This means the login occurs over a secure protocol (like TLS/HTTPS or SSH) with strong cryptography, so the password isn’t exposed in transit. If credentials could be sent over an unencrypted channel, or if insecure remote-login methods are allowed, or if encryption isn’t required at all, the requirement isn’t being met. By validating that encryption is in place before the password request, you confirm the admin login process protects sensitive credentials from interception.