Control Identification and Design CISA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During the design of a new inventory management system, the project team identified the following risks: (1) unauthorized changes to inventory records, (2) loss of data due to system failure, and (3) inaccurate data entry by warehouse staff. Which control mapping provides the most comprehensive coverage for these risks?

   • AAudit logging of all transactions, a redundant server, and a data entry manual
   • BRole-based access controls, automated daily backups, and input validation checks
   • CEncryption of data at rest, a firewall, and a spell-checker in the data entry form
   • DA single sign-on system, a disaster recovery plan, and user training on data entry
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A project team is designing a new system for a hospital that will store patient health records. They have identified a risk that a nurse could accidentally view another patient's records. Which control design would best mitigate this risk?

   • AImplementing role-based access controls that restrict access to only the records a nurse needs for their current patients
   • BImplementing a firewall to protect the network
   • CConducting regular security awareness training for nurses
   • DEncrypting all patient records at rest
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During the control identification phase for a new e-commerce platform, the project team has documented a control that requires two-factor authentication (2FA) for all administrator accounts. Which risk is this control primarily designed to mitigate?

   • AInaccurate data entry by customers
   • BUnauthorized access to the administration console
   • CData loss due to a server failure
   • DSlow system performance during peak hours
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of mapping controls to risks in an information systems project?

   • ATo assign a risk rating to each control
   • BTo prioritize controls based on cost
   • CTo eliminate the need for further risk assessments
   • DTo ensure that all identified risks are addressed by at least one control
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A project team is using a DevOps approach to develop a new mobile application. The team wants to integrate security controls into the CI/CD pipeline. Which control integration strategy best aligns with DevOps principles while ensuring effective risk mitigation?

   • AA manual security review by a security specialist before each release
   • BA separate security testing phase after the CI/CD pipeline completes
   • CAutomated security scanning tools integrated into the pipeline that fail the build on critical vulnerabilities
   • DRelying on the cloud provider's security features without additional controls
   Reveal Solution Discussion Select an answer first