CRISC Information Systems Control Design 1 — Questions and Answers
Question 1: Which control design principle ensures that no single individual can complete a sensitive transaction without involvement of another person?
- Segregation of duties (Correct answer)
- Least privilege
- Defense in depth
- Need to know
Correct answer: Segregation of duties
Segregation of duties divides critical tasks among multiple people, preventing any single person from committing and concealing fraud or error.
Question 2: The principle of least privilege in access control design means that users should be granted:
- Only the minimum permissions needed to perform their job functions (Correct answer)
- Access to all systems to support business continuity
- Administrative rights to enable self-service IT tasks
- Read-only access to all organizational data
Correct answer: Only the minimum permissions needed to perform their job functions
Least privilege limits each user's access to only what is required for their role, reducing the attack surface if credentials are compromised.
Question 3: Defense in depth is a control design strategy that involves:
- Layering multiple controls so that failure of one does not expose the entire system (Correct answer)
- Installing the strongest single control available at the perimeter
- Relying on encryption as the primary protection mechanism
- Using automated controls exclusively to eliminate human error
Correct answer: Layering multiple controls so that failure of one does not expose the entire system
Defense in depth uses multiple overlapping controls so that if one layer fails, subsequent layers still protect the asset.
Question 4: Which control objective is MOST directly supported by implementing input validation in a web application?
- Preventing injection attacks and data integrity violations (Correct answer)
- Ensuring data availability during peak traffic periods
- Providing non-repudiation for user transactions
- Encrypting sensitive data in transit
Correct answer: Preventing injection attacks and data integrity violations
Input validation prevents malicious inputs (e.g., SQL injection, XSS) from compromising data integrity or allowing unauthorized system access.
Question 5: When designing controls for a high-risk IT process, which approach provides the GREATEST assurance?
- Implementing both preventive and detective controls in combination (Correct answer)
- Relying solely on the most advanced preventive control available
- Using only automated controls to eliminate human error
- Deploying a single comprehensive control covering all risk scenarios
Correct answer: Implementing both preventive and detective controls in combination
Combining preventive controls (to stop threats) with detective controls (to catch what gets through) provides layered assurance for high-risk processes.
Question 6: A control that automatically locks a user account after five failed login attempts is BEST classified as:
- Preventive technical control (Correct answer)
- Detective administrative control
- Corrective physical control
- Compensating logical control
Correct answer: Preventive technical control
An account lockout policy is a preventive technical control that automatically blocks brute-force login attempts.
CRISC Information Systems Control Design 1
Which control design principle ensures that no single individual can complete a sensitive transaction without involvement of another person?