Control Identification and Design CISA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A project team is identifying controls for a new system that will process credit card payments. They have identified the following risks: (1) unauthorized access to cardholder data, (2) data breaches due to insecure code, and (3) non-compliance with PCI DSS. The team has a limited budget and must prioritize controls. Which set of controls provides the most comprehensive coverage?

   • AEncryption of cardholder data, secure coding practices, and PCI DSS compliance audits
   • BMulti-factor authentication (MFA), a web application firewall (WAF), and a privacy impact assessment
   • CRole-based access controls, regular backups, and a disaster recovery plan
   • DA firewall, a vulnerability scanner, and a data retention policy
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A project team is developing a new customer relationship management (CRM) system. They have identified a risk that customer data could be lost due to a hardware failure. Which control would be most directly mapped to this risk?

   • AImplementing a firewall to protect the network
   • BImplementing role-based access controls
   • CConducting security awareness training for employees
   • DRegular automated backups of the CRM database
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which document is the primary output of the control identification process in an information systems acquisition project?

   • AA project schedule with milestones
   • BA vendor contract with service level agreements
   • CA detailed system architecture diagram
   • DA list of controls that address the identified risks
   Reveal Solution Discussion Select an answer first
5. 4application · medium · select all that apply

   A project team is identifying controls for a new document management system. The system will store sensitive legal documents. Which of the following controls should be documented as part of the control identification phase? (Select all that apply.)

   • AEncryption of documents at rest and in transit
   • BAudit logging of all document access and modifications
   • CRegular backups of the document repository
   • DA marketing plan for the new system
   • ERole-based access controls to restrict document access to authorized personnel
   Check answers Discussion Select an answer first
6. 5application · medium

   A project team is implementing a new financial reporting system. They have identified a risk that a developer could accidentally introduce a logic error that produces incorrect financial statements. Which control would be classified as a detective control for this risk?

   • AImplementing a change management process that requires approval for all code changes
   • BProviding training to developers on financial reporting standards
   • CRequiring a second developer to review all code changes before they are merged
   • DRunning automated tests that compare the system's output to expected results
   Reveal Solution Discussion Select an answer first