CISM Information Security Programme Practice Question
A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Role-based access control (RBAC) with least privilege
Defense-in-depth requires multiple layers; input validation prevents injection attacks, and access control ensures least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Weekly vulnerability scans
Why it's wrong here
Scans are detective, not preventive.
- ✓
Role-based access control (RBAC) with least privilege
Why this is correct
Restricts access to authorized users only.
- ✗
Single sign-on (SSO) implementation
Why it's wrong here
SSO improves user experience but is not a core defense-in-depth control.
- ✗
Encryption of data at rest
Why it's wrong here
Important but more about data protection than defense-in-depth for the application layer.
- ✓
Input validation and sanitization
Why this is correct
Essential to prevent injection attacks like SQLi.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.