CRISC Information Systems Control Design

Question 1

Which control design principle ensures that no single individual can complete a sensitive transaction without involvement of another person?

Accepted Answer

Segregation of duties

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 2

The principle of least privilege in access control design means that users should be granted:

Accepted Answer

Only the minimum permissions needed to perform their job functions

Answer

Access to all systems to support business continuity

Answer

Administrative rights to enable self-service IT tasks

Answer

Read-only access to all organizational data

Question 3

Defense in depth is a control design strategy that involves:

Accepted Answer

Layering multiple controls so that failure of one does not expose the entire system

Answer

Installing the strongest single control available at the perimeter

Answer

Relying on encryption as the primary protection mechanism

Answer

Using automated controls exclusively to eliminate human error

Question 4

Which control objective is MOST directly supported by implementing input validation in a web application?

Accepted Answer

Preventing injection attacks and data integrity violations

Answer

Ensuring data availability during peak traffic periods

Answer

Providing non-repudiation for user transactions

Answer

Encrypting sensitive data in transit

Question 5

When designing controls for a high-risk IT process, which approach provides the GREATEST assurance?

Accepted Answer

Implementing both preventive and detective controls in combination

Answer

Relying solely on the most advanced preventive control available

Answer

Using only automated controls to eliminate human error

Answer

Deploying a single comprehensive control covering all risk scenarios

Question 6

A control that automatically locks a user account after five failed login attempts is BEST classified as:

Accepted Answer

Preventive technical control

Answer

Detective administrative control

Answer

Corrective physical control

Answer

Compensating logical control