CRISC Information Systems Control Design and Implementation 1 — Questions and Answers
Question 1: What is the primary objective of designing information systems controls?
- To reduce risk to an acceptable level while enabling business operations to continue efficiently (Correct answer)
- To achieve zero risk across all IT systems and processes
- To satisfy external auditor requirements exclusively
- To maximize the technical complexity of the security architecture
Correct answer: To reduce risk to an acceptable level while enabling business operations to continue efficiently
Controls must balance risk reduction with operational efficiency — overly restrictive controls can impede business processes as much as the risks they are meant to prevent.
Question 2: What is the difference between a general control and an application control?
- General controls govern the overall IT environment; application controls are specific to individual systems or processes (Correct answer)
- Application controls apply to all systems; general controls apply only to databases
- General controls are preventive; application controls are always detective
- There is no functional difference between the two types
Correct answer: General controls govern the overall IT environment; application controls are specific to individual systems or processes
General controls (like change management and access administration) apply broadly across the IT environment, while application controls (like input validation) operate within specific applications.
Question 3: Which principle requires that no single individual has control over all phases of a critical process?
- Segregation of duties (SoD) (Correct answer)
- Least privilege
- Need to know
- Defense in depth
Correct answer: Segregation of duties (SoD)
Segregation of duties ensures that fraud or error requires collusion by splitting critical tasks across multiple individuals so no single person can complete a harmful act alone.
Question 4: What is the principle of least privilege in information systems control?
- Users and systems should have only the minimum access rights required to perform their authorized functions (Correct answer)
- All users should have administrative rights to ensure productivity
- Access should be granted based on seniority rather than job function
- Systems should deny all access by default and never grant permissions
Correct answer: Users and systems should have only the minimum access rights required to perform their authorized functions
Least privilege limits access to the minimum necessary for each role, reducing the attack surface and limiting the damage that can be caused by compromised accounts or insider threats.
Question 5: What is the purpose of input validation controls in application systems?
- To ensure that data entered into a system meets defined criteria before processing, preventing corrupt or malicious data (Correct answer)
- To encrypt data at rest in the database
- To log all user activity for audit trail purposes
- To restrict physical access to server hardware
Correct answer: To ensure that data entered into a system meets defined criteria before processing, preventing corrupt or malicious data
Input validation controls check that data conforms to expected format, type, and range before processing, preventing issues like SQL injection, data corruption, and processing errors.
Question 6: Which control type is designed to reduce the severity of an incident after it has occurred?
- Corrective control (Correct answer)
- Preventive control
- Detective control
- Deterrent control
Correct answer: Corrective control
Corrective controls restore systems and processes to normal after an incident, such as disaster recovery procedures, patch management, and incident response plans.
CRISC Information Systems Control Design and Implementation 1
What is the primary objective of designing information systems controls?