CRISC Information Systems Control Design 2

Question 1

Which IS control framework is MOST widely used for evaluating and designing controls in IT environments?

Accepted Answer

COBIT

Answer

COBIT is the leading framework for IT governance and control design, providing a comprehensive set of processes and control objectives.

Question 2

A key logger installed on workstations by an attacker would BEST be detected by which control?

Accepted Answer

Endpoint detection and response (EDR) software

Answer

EDR solutions monitor endpoint behavior and can detect unauthorized software such as keyloggers through behavioral analysis.

Question 3

Which control design consideration is MOST important for systems handling Personally Identifiable Information (PII)?

Accepted Answer

Data minimization and access controls aligned with privacy regulations

Answer

PII systems must implement data minimization (collect only what's needed) and strong access controls to comply with privacy regulations like GDPR and CCPA.

Question 4

An application that generates an audit log of all privileged user actions is implementing which type of control?

Accepted Answer

Detective control

Answer

Audit logging is a detective control that creates a record of activities, enabling identification and investigation of unauthorized or suspicious actions.

Question 5

When designing controls for a third-party vendor relationship, which document BEST defines required security controls?

Accepted Answer

Service level agreement with security annexure

Answer

An SLA with a security annexure contractually requires the vendor to meet specific security control standards and allows for enforcement.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Information Systems Control Design 2