Information Systems Control Design Flashcards

Which control type is MOST appropriate for enforcing compliance with data retention policies?

Answer: Both directive and technical controls together

Effective data retention requires both a directive control (policy defining retention periods) and a technical control (automated deletion/archiving) to ensure consistent enforcement.

A preventive control that stops a database administrator from accessing production data without a second approver is an example of:

Answer: Dual control

Dual control requires two authorized individuals to act together to access sensitive resources, preventing single-person abuse of privileged access.

Which IS control objective is addressed by implementing multi-factor authentication (MFA)?

Answer: Ensuring only authorized users gain access to systems

MFA strengthens authentication by requiring multiple verification factors, ensuring that stolen credentials alone are insufficient for unauthorized access.

Which technique is used to verify that a software application's controls function as designed before deployment to production?

Answer: User acceptance testing (UAT)

UAT verifies that an application's controls and functions meet business requirements and work as designed before the system goes live.

The concept of 'privacy by design' in IS control design means that:

Answer: Privacy controls are built into systems from the start rather than added later

Privacy by design embeds privacy protections into system architecture and processes from inception, making privacy an inherent feature rather than an afterthought.

When a critical control fails, which response is MOST aligned with CRISC best practices?

Answer: Immediately activate compensating controls and assess residual risk

When a primary control fails, compensating controls should be activated immediately to maintain protection while assessing and addressing the increased residual risk.