Information Systems Control Design Flashcards

Which IS control framework is MOST widely used for evaluating and designing controls in IT environments?

Answer: COBIT

COBIT is the leading framework for IT governance and control design, providing a comprehensive set of processes and control objectives.

A key logger installed on workstations by an attacker would BEST be detected by which control?

Answer: Endpoint detection and response (EDR) software

EDR solutions monitor endpoint behavior and can detect unauthorized software such as keyloggers through behavioral analysis.

Which control design consideration is MOST important for systems handling Personally Identifiable Information (PII)?

Answer: Data minimization and access controls aligned with privacy regulations

PII systems must implement data minimization (collect only what's needed) and strong access controls to comply with privacy regulations like GDPR and CCPA.

An application that generates an audit log of all privileged user actions is implementing which type of control?

Answer: Detective control

Audit logging is a detective control that creates a record of activities, enabling identification and investigation of unauthorized or suspicious actions.

When designing controls for a third-party vendor relationship, which document BEST defines required security controls?

Answer: Service level agreement with security annexure

An SLA with a security annexure contractually requires the vendor to meet specific security control standards and allows for enforcement.

Which control is MOST effective at preventing unauthorized changes to production systems?

Answer: Change management process with formal approval workflow

A formal change management process requiring approvals before changes reach production prevents unauthorized modifications through procedural controls.