Information Systems Control Design and Implementation Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Information Systems Control Design and Implementation flashcards as text
What is role-based access control (RBAC), and what risk does it help mitigate?
Answer: A model that assigns access rights based on job roles rather than individual users, reducing excessive access risk
RBAC assigns permissions to roles rather than individuals, ensuring access aligns with job functions and making it easier to manage and audit permissions at scale.
What is the purpose of encryption as an information systems control?
Answer: To protect data confidentiality by making it unreadable to unauthorized parties, both at rest and in transit
Encryption transforms data into an unreadable format, protecting confidentiality so that even if data is intercepted or accessed without authorization, it cannot be understood.
Which control is designed to provide an auditable record of all significant system and user activities?
Answer: Audit logging and monitoring
Audit logs record who did what, when, and from where in a system, providing an essential trail for investigations, compliance, and detecting unauthorized activity.
What is the purpose of data masking in information systems control?
Answer: To replace sensitive data with realistic but fictitious values, protecting confidentiality in non-production environments
Data masking protects sensitive information by substituting real values with masked equivalents in test and development environments, preventing exposure of production data.
What is the significance of control testing in the SDLC?
Answer: Testing controls during development ensures security requirements are met before systems are deployed to production
Incorporating control testing into the SDLC identifies weaknesses before deployment, when fixes are cheapest and least disruptive, rather than after production rollout.
What is the primary goal of business continuity planning (BCP) as an information systems control?
Answer: To ensure critical business processes and IT systems can continue operating or recover quickly after a disruption
BCP establishes procedures and capabilities to maintain or rapidly restore critical business functions following a disruption, minimizing operational and financial impact.