CRISC Information Systems Control Design and Implementation 2 — Questions and Answers
Question 1: What is change management control, and why is it important in IT risk management?
- A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes (Correct answer)
- An HR process for managing employee role transitions
- A method for tracking vendor contract renewals
- A financial process for approving IT budget requests
Correct answer: A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes
Change management controls prevent unauthorized, untested, or poorly planned changes from introducing new vulnerabilities or disruptions to IT systems.
Question 2: What is the purpose of a configuration management database (CMDB)?
- To maintain a centralized record of all IT assets and their relationships, supporting change and incident management (Correct answer)
- To store user credentials for authentication purposes
- To hold copies of all application source code
- To track employee IT training completions
Correct answer: To maintain a centralized record of all IT assets and their relationships, supporting change and incident management
A CMDB provides a comprehensive inventory of IT assets and their interdependencies, enabling better change impact analysis and faster incident resolution.
Question 3: Which control ensures that only tested and approved software is deployed in the production environment?
- Separation of development, testing, and production environments (Correct answer)
- Full access for developers to the production environment
- Using the same credentials across all environments
- Allowing direct code deployment without peer review
Correct answer: Separation of development, testing, and production environments
Maintaining separate environments ensures that code is tested in a controlled setting before reaching production, preventing untested changes from causing incidents.
Question 4: What is the concept of 'privacy by design' in information systems control?
- Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later (Correct answer)
- Restricting system access to only the privacy officer
- Installing privacy software after a system is already deployed
- Documenting privacy policies without implementing technical controls
Correct answer: Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later
Privacy by design embeds privacy protections into the architecture and processes of systems from the ground up, making privacy a default feature rather than an afterthought.
Question 5: What is an access control matrix?
- A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination (Correct answer)
- A physical keycard reader installed at server room entrances
- A network diagram showing firewall rule configurations
- A list of all user accounts ordered by their access level
Correct answer: A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination
An access control matrix provides a structured view of who or what can access which resources and what actions they are permitted to perform, supporting the principle of least privilege.
Question 6: What is the purpose of an IT general control (ITGC) review?
- To assess the effectiveness of controls that govern the overall IT environment supporting financial and operational systems (Correct answer)
- To evaluate the performance of individual business applications
- To conduct a security assessment of external-facing web applications
- To verify user satisfaction with IT services
Correct answer: To assess the effectiveness of controls that govern the overall IT environment supporting financial and operational systems
ITGC reviews examine controls like change management, access administration, and operations management that underpin all systems and are fundamental to reliable financial and operational reporting.
CRISC Information Systems Control Design and Implementation 2
What is change management control, and why is it important in IT risk management?