Control Identification and Design CISA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A project team is implementing a new payroll system. They have identified a risk that a payroll administrator could accidentally overpay an employee. The team has implemented a control that requires a second administrator to approve any payroll run before it is processed. How should this control be classified?

   • ACompensating control
   • BCorrective control
   • CPreventive control
   • DDetective control
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational corporation is implementing a new HR system that will store employee data for all regions. The project team has identified the following risks: (1) unauthorized access to sensitive employee data, (2) data loss due to a natural disaster in one region, and (3) non-compliance with GDPR for EU employees. The team has a limited budget and must choose a set of controls. Which set of controls provides the most comprehensive risk coverage?

   • AMulti-factor authentication (MFA), a redundant data center in the same region, and a GDPR compliance audit
   • BA single sign-on (SSO) system, daily backups stored on-site, and a legal review of the system's terms of service
   • CStrong encryption for all data, a disaster recovery plan, and a privacy impact assessment
   • DRole-based access control (RBAC), off-site backups in a different region, and data residency controls for EU data
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When designing a control to mitigate the risk of unauthorized changes to program code during development, which control design is most effective?

   • ARequiring two authorized developers to approve and implement code changes
   • BDocumenting the change management procedure
   • CBacking up the code repository daily
   • DReviewing code changes after they are implemented
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An organization implements a control that requires two signatures before a purchase order is released. How should this control be classified?

   • ADetective
   • BCompensating
   • CCorrective
   • DPreventive
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is the primary objective of designing controls for an information systems development project?

   • ATo document the system's functional requirements
   • BTo mitigate the risks identified during the project to an acceptable level
   • CTo eliminate all risks associated with the project
   • DTo ensure the project is completed on time and within budget
   Reveal Solution Discussion Select an answer first