Control Identification and Design CISA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services firm is implementing a new customer onboarding system. The project team has identified a risk that unauthorized users could access customer data through a misconfigured web application firewall (WAF). During the control identification phase, which control would be most appropriate to document as a preventive control for this specific risk?

   • AA compensating control that requires manual approval for all customer data access requests
   • BA rule that automatically blocks traffic from IP addresses that trigger WAF alerts
   • CA weekly review of WAF logs to identify any unauthorized access attempts
   • DA corrective procedure to restore customer data from backups after a breach
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   During a control mapping exercise, the IS auditor discovers that a high-risk area has no corresponding control. What is the most appropriate action?

   • AReclassify the risk as low to avoid the need for a control
   • BIgnore the gap because it is not material
   • CDocument the gap and recommend that a control be designed for that risk
   • DAssume the risk is acceptable without further analysis
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A project team is designing a new online banking system. They have identified a risk of fraudulent transactions. The team is considering two controls: (1) a real-time transaction monitoring system that flags suspicious transactions and (2) a rule that requires additional verification for transactions above a certain amount. The team has a limited budget and must choose one. Which control should they choose to best balance risk mitigation and user experience?

   • AReal-time transaction monitoring, because it detects fraud without adding friction to all transactions
   • BNeither control, because fraud is a low-probability risk
   • CBoth controls, because they address different aspects of fraud
   • DAdditional verification for high-value transactions, because it is a stronger preventive control
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A project team is designing a new customer-facing web application. They have identified a risk of SQL injection attacks. The team is considering two controls: (1) parameterized queries and (2) a web application firewall (WAF). The team has a limited budget and must choose one. Which control should they choose to best mitigate the risk?

   • ANeither control, because SQL injection is a low-risk vulnerability
   • BBoth controls, because they provide defense in depth
   • CA WAF, because it provides a broader layer of protection
   • DParameterized queries, because they address the root cause of SQL injection
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following best describes the integration of controls into the system development lifecycle (SDLC)?

   • ADocumenting controls after the system is implemented
   • BOutsourcing control design to the vendor
   • CAdding controls only during the testing phase
   • DIncorporating control requirements and activities into each phase of the SDLC
   Reveal Solution Discussion Select an answer first