Control Identification and Design CISA Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A project team is implementing a new system using a hybrid approach that combines elements of waterfall and agile. The project manager wants to ensure that controls are integrated into the project management processes. Which approach best supports control integration in a hybrid environment?

   • ARelying on the project manager to informally review controls at the end of the project
   • BUsing a separate control plan that is not linked to the project schedule
   • CDeferring all control testing to the post-implementation review
   • DDefining control checkpoints at the end of each phase and within each sprint
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A project team is using a traditional waterfall methodology to develop a new billing system. The project manager wants to ensure that security controls are integrated into the system development lifecycle (SDLC). Which approach best aligns with the waterfall model?

   • AIncluding security requirements in the design phase and performing security testing during the testing phase
   • BConducting security reviews only after the system is deployed to production
   • CDeferring all security controls to the operations team after go-live
   • DUsing an agile approach for security testing while the rest of the project follows waterfall
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   A healthcare organization is implementing a new patient portal that will allow patients to view their medical records and schedule appointments. The project team has identified the following risks: (1) unauthorized access to patient data, (2) data breaches due to insecure APIs, and (3) non-compliance with data protection regulations. The organization has a limited budget and must prioritize controls. Which control design provides the most balanced mitigation across all three risks?

   • AFocusing only on compliance audits and data encryption, assuming that encryption alone will prevent unauthorized access
   • BImplementing a single sign-on (SSO) solution and relying on the cloud provider's security controls for API security
   • CInvesting heavily in a state-of-the-art firewall and intrusion detection system, but deferring compliance audits
   • DImplementing multi-factor authentication (MFA) for all users, conducting regular API security testing, and performing compliance audits
   Reveal Solution Discussion Select an answer first