CRISC Information Systems Control Design and Implementation 2

Question 1

What is change management control, and why is it important in IT risk management?

Accepted Answer

A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes

Answer

Change management controls prevent unauthorized, untested, or poorly planned changes from introducing new vulnerabilities or disruptions to IT systems.

Question 2

What is the purpose of a configuration management database (CMDB)?

Accepted Answer

To maintain a centralized record of all IT assets and their relationships, supporting change and incident management

Answer

A CMDB provides a comprehensive inventory of IT assets and their interdependencies, enabling better change impact analysis and faster incident resolution.

Question 3

Which control ensures that only tested and approved software is deployed in the production environment?

Accepted Answer

Separation of development, testing, and production environments

Answer

Maintaining separate environments ensures that code is tested in a controlled setting before reaching production, preventing untested changes from causing incidents.

Question 4

What is the concept of 'privacy by design' in information systems control?

Accepted Answer

Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later

Answer

Privacy by design embeds privacy protections into the architecture and processes of systems from the ground up, making privacy a default feature rather than an afterthought.

Question 5

What is an access control matrix?

Accepted Answer

A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination

Answer

An access control matrix provides a structured view of who or what can access which resources and what actions they are permitted to perform, supporting the principle of least privilege.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Information Systems Control Design and Implementation 2