Which of the following is an example of an application control?

Question

Options

• AEmployees in the data center must always wear identification badges
• BOperating system updates must be installed within 48 hours.
• CA two stage authentication process must be used to access customer information
• DSystem backup and recovery testing must be done monthly

• A
  13% (4)
• B
  3% (1)
• C
  78% (25)
• D
  6% (2)

Explanation

Option C is correct because application controls are security and processing controls embedded within a specific software application - two-stage authentication to access customer information is enforced by the application itself, governing who can interact with the data it manages.

Why the distractors are wrong:

• A is a physical security control - it governs access to a physical space (the data center), not an application.
• B is an IT general control (specifically patch management) - it applies to the underlying operating system infrastructure, not to a particular application.
• D is an operational/IT general control related to business continuity - backup and recovery processes support the environment, not a specific application's internal logic.

Memory tip: Think of application controls as living inside the app - they control inputs, processing, outputs, and access within that application. If the control would still exist even if you replaced the application (like a badge policy or OS patching), it's a general control, not an application control.

No community discussion yet for this question.