During a visit to an oil production plant, an internal auditor was surprised to see...

The auditor should next study the company’s firewall configuration rules because the observation indicates that employees can access websites that policy prohibits. Firewall or web-filtering rules should restrict access to unauthorized categories such as shopping sites, social media, gambling, or malicious domains. A training policy may help awareness but does not explain why access was technically allowed. Access point encryption relates to wireless network security, not web filtering. Software installation controls prevent unauthorized software but do not directly block website access. Internal auditors should compare acceptable-use policy requirements with actual network filtering, firewall rules, proxy settings, exception lists, and monitoring reports. Since the control failure appears to be web access restriction, Option B is correct.