IIA-CIA-Part3-KR 문제 91
은행 담당자로 가장한 공격자는 직원에게 특정 금융 정보를 공개하도록 설득하여 궁극적으로 사기로 이어졌습니다. 다음 중 이 사이버 보안 위험을 가장 잘 설명하는 것은 무엇입니까?
정답: D
Social engineering is a psychological manipulation technique used by attackers to trick individuals into divulging sensitive information. Instead of exploiting technical vulnerabilities, it targets human weaknesses such as trust, fear, or urgency.
* Manipulates Human Behavior - The attacker impersonates a trusted entity (a bank representative) to deceive the employee.
* Leads to Unauthorized Information Disclosure - The employee unknowingly provides sensitive financial data.
* Results in Fraud - The stolen information is misused, causing financial loss.
* A. Shoulder Surfing - This occurs when an attacker physically observes someone entering sensitive data (e.g., watching a person type a password).
* B. Pharming - This involves redirecting users to a fraudulent website to steal their credentials, not direct impersonation.
* C. Phishing - This is a broad category of social engineering that typically involves emails or fake websites, whereas this scenario describes a direct impersonation attack.
* IIA's GTAG on Cybersecurity - Discusses social engineering as a key risk for organizations.
* NIST SP 800-61 (Incident Handling Guide) - Identifies social engineering as a common attack vector.
* COBIT 2019 (IT Governance Framework) - Highlights human-related cybersecurity risks.
Why Social Engineering is the Correct Answer?Why Not the Other Options?IIA References:
* Manipulates Human Behavior - The attacker impersonates a trusted entity (a bank representative) to deceive the employee.
* Leads to Unauthorized Information Disclosure - The employee unknowingly provides sensitive financial data.
* Results in Fraud - The stolen information is misused, causing financial loss.
* A. Shoulder Surfing - This occurs when an attacker physically observes someone entering sensitive data (e.g., watching a person type a password).
* B. Pharming - This involves redirecting users to a fraudulent website to steal their credentials, not direct impersonation.
* C. Phishing - This is a broad category of social engineering that typically involves emails or fake websites, whereas this scenario describes a direct impersonation attack.
* IIA's GTAG on Cybersecurity - Discusses social engineering as a key risk for organizations.
* NIST SP 800-61 (Incident Handling Guide) - Identifies social engineering as a common attack vector.
* COBIT 2019 (IT Governance Framework) - Highlights human-related cybersecurity risks.
Why Social Engineering is the Correct Answer?Why Not the Other Options?IIA References:
IIA-CIA-Part3-KR 문제 92
사이버 보안 감사를 계획하고 위험 평가를 수행하는 제약 회사의 내부 감사. 다음 중 조직에 가장 중요한 사이버 위협으로 간주되는 것은 무엇입니까?
정답: B
When conducting a cybersecurity risk assessment, an internal auditor must evaluate the most significant threats based on their potential impact on the organization. In the pharmaceutical industry, intellectual property (IP), such as research and development (R&D) data, is one of the most valuable and sensitive assets.
* (A) Cybercriminals hacking into the organization's time and expense system to collect employee personal data:While the loss of employee personal data is a serious concern due to privacy and regulatory implications (e.g., GDPR, CCPA), it does not pose as critical a threat as the loss of proprietary pharmaceutical research.
* (B) Hackers breaching the organization's network to access research and development reports (Correct Answer):R&D reports contain proprietary drug formulas, clinical trial results, and patent- pending innovations, making them highly valuable to competitors and cybercriminals. A breach could lead to intellectual property theft, financial losses, loss of competitive advantage, and regulatory non- compliance (e.g., FDA, EMA requirements). This is considered the most significant threat because:
* It could result in billions of dollars in lost revenue.
* Competitors or state-sponsored hackers could exploit stolen research.
* It could disrupt drug development and approval processes.
* (C) A denial-of-service (DoS) attack that prevents access to the organization's website:While DoS attacks can damage an organization's reputation and disrupt operations, they generally do not cause the same level of financial or strategic harm as the loss of critical R&D data. Most organizations have cybersecurity measures (e.g., load balancers, CDNs) to mitigate DoS risks.
* (D) A hacker accessing the financial information of the company:Unauthorized access to financial data can be serious, leading to fraud or reputational damage. However, publicly traded companies already disclose much of their financial data, and financial breaches typically have a lower long-term impact compared to intellectual property theft.
* IIA Global Technology Audit Guide (GTAG) 15: Information Security Governance: Recommends that internal auditors prioritize risks that impact strategic assets, such as intellectual property.
* IIA Standard 2120 - Risk Management: Requires internal auditors to evaluate the organization's risk management processes, emphasizing risks with significant financial and operational consequences.
* IIA Practice Advisory 2110-2: Assessing the Adequacy of Risk Management Processes: Highlights that internal auditors must identify risks that could threaten the organization's long-term objectives, such as IP theft.
* COSO ERM Framework: Encourages prioritization of risks that have high impact on an organization' s value and strategic objectives, such as cyber threats to proprietary research.
Analysis of Each Option:IIA References:Conclusion:Given the pharmaceutical industry's reliance on proprietary R&D, a breach compromising research reports represents the most significant cyber threat.
Therefore, option (B) is the correct answer.
* (A) Cybercriminals hacking into the organization's time and expense system to collect employee personal data:While the loss of employee personal data is a serious concern due to privacy and regulatory implications (e.g., GDPR, CCPA), it does not pose as critical a threat as the loss of proprietary pharmaceutical research.
* (B) Hackers breaching the organization's network to access research and development reports (Correct Answer):R&D reports contain proprietary drug formulas, clinical trial results, and patent- pending innovations, making them highly valuable to competitors and cybercriminals. A breach could lead to intellectual property theft, financial losses, loss of competitive advantage, and regulatory non- compliance (e.g., FDA, EMA requirements). This is considered the most significant threat because:
* It could result in billions of dollars in lost revenue.
* Competitors or state-sponsored hackers could exploit stolen research.
* It could disrupt drug development and approval processes.
* (C) A denial-of-service (DoS) attack that prevents access to the organization's website:While DoS attacks can damage an organization's reputation and disrupt operations, they generally do not cause the same level of financial or strategic harm as the loss of critical R&D data. Most organizations have cybersecurity measures (e.g., load balancers, CDNs) to mitigate DoS risks.
* (D) A hacker accessing the financial information of the company:Unauthorized access to financial data can be serious, leading to fraud or reputational damage. However, publicly traded companies already disclose much of their financial data, and financial breaches typically have a lower long-term impact compared to intellectual property theft.
* IIA Global Technology Audit Guide (GTAG) 15: Information Security Governance: Recommends that internal auditors prioritize risks that impact strategic assets, such as intellectual property.
* IIA Standard 2120 - Risk Management: Requires internal auditors to evaluate the organization's risk management processes, emphasizing risks with significant financial and operational consequences.
* IIA Practice Advisory 2110-2: Assessing the Adequacy of Risk Management Processes: Highlights that internal auditors must identify risks that could threaten the organization's long-term objectives, such as IP theft.
* COSO ERM Framework: Encourages prioritization of risks that have high impact on an organization' s value and strategic objectives, such as cyber threats to proprietary research.
Analysis of Each Option:IIA References:Conclusion:Given the pharmaceutical industry's reliance on proprietary R&D, a breach compromising research reports represents the most significant cyber threat.
Therefore, option (B) is the correct answer.
IIA-CIA-Part3-KR 문제 93
다음 중 발전소에 대한 무단 액세스 방지에 가장 중점을 둔 보안 제어는 무엇입니까?
정답: C
Preventive security controls proactively stop unauthorized access before it occurs. The most effective method is strict access management, where new or additional access rights require formal validation before being granted.
* Prevents Unauthorized Entry - Ensures that only approved personnel have access to the power plant.
* Implements Segregation of Duties (SoD) - Supervisors validate access requests, reducing insider threats.
* Aligns with Least Privilege Principle - Employees get only the minimum access necessary for their role.
* Prevents Security Risks Before They Happen - Unlike detective or corrective controls, this method stops unauthorized access before it occurs.
* A. Offboarding procedure (monthly review) - This is a detective control, identifying issues after access is granted, not preventing them.
* B. Smart lock anomaly scanning - Also detective, as it identifies suspicious behavior after access has been used.
* D. Automatic notifications for after-hours entry - A corrective control, responding to potential violations instead of preventing them.
* IIA's GTAG on Identity and Access Management - Recommends pre-approval processes for sensitive locations.
* ISO 27001 Annex A.9 (Access Control) - Requires role-based access management for critical infrastructures.
* NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) - Defines supervisor approval as a key preventive measure.
Why Approval-Based Access Control is the Best Preventive Measure?Why Not the Other Options?IIA References:
* Prevents Unauthorized Entry - Ensures that only approved personnel have access to the power plant.
* Implements Segregation of Duties (SoD) - Supervisors validate access requests, reducing insider threats.
* Aligns with Least Privilege Principle - Employees get only the minimum access necessary for their role.
* Prevents Security Risks Before They Happen - Unlike detective or corrective controls, this method stops unauthorized access before it occurs.
* A. Offboarding procedure (monthly review) - This is a detective control, identifying issues after access is granted, not preventing them.
* B. Smart lock anomaly scanning - Also detective, as it identifies suspicious behavior after access has been used.
* D. Automatic notifications for after-hours entry - A corrective control, responding to potential violations instead of preventing them.
* IIA's GTAG on Identity and Access Management - Recommends pre-approval processes for sensitive locations.
* ISO 27001 Annex A.9 (Access Control) - Requires role-based access management for critical infrastructures.
* NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) - Defines supervisor approval as a key preventive measure.
Why Approval-Based Access Control is the Best Preventive Measure?Why Not the Other Options?IIA References:
IIA-CIA-Part3-KR 문제 94
IT에 대한 lIA 지침에 따르면 다음 계획 중 중요한 비즈니스 프로세스 식별과 복구 시간 목표를 연결하는 계획은 무엇입니까?
정답: C
The Business Impact Analysis (BIA) plan is a key component of business continuity planning that identifies critical business processes and determines their Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
* Correct Answer (C - Business Impact Analysis Plan)
* The BIA is a systematic process that identifies essential functions, assesses potential disruptions, and determines the recovery time requirements to ensure business continuity.
* The Recovery Time Objective (RTO) defines the maximum acceptable downtime for critical business functions.
* The Recovery Point Objective (RPO) identifies how much data loss is tolerable.
* According to the IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management, a BIA is essential for assessing the financial, operational, and reputational impact of disruptions.
* Why Other Options Are Incorrect:
* Option A (Business Continuity Management Charter):
* A charter defines the governance, responsibilities, and overall framework of business continuity but does not focus on RTOs or critical business processes.
* Option B (Business Continuity Risk Assessment Plan):
* A risk assessment identifies threats and vulnerabilities but does not define recovery time objectives.
* While risk assessments inform the BIA, they do not replace it.
* Option D (Business Case for Business Continuity Planning):
* A business case justifies investment in continuity planning but does not map business processes to RTOs.
* GTAG 10: Business Continuity Management - Defines BIA as the process for identifying critical business functions and their RTOs.
* IIA Practice Guide: Auditing Business Continuity - Emphasizes the role of BIA in business resilience.
Step-by-Step Explanation:IIA References for Validation:Thus, the Business Impact Analysis (BIA) Plan (C) is the correct answer because it pairs critical business processes with recovery time objectives.
* Correct Answer (C - Business Impact Analysis Plan)
* The BIA is a systematic process that identifies essential functions, assesses potential disruptions, and determines the recovery time requirements to ensure business continuity.
* The Recovery Time Objective (RTO) defines the maximum acceptable downtime for critical business functions.
* The Recovery Point Objective (RPO) identifies how much data loss is tolerable.
* According to the IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management, a BIA is essential for assessing the financial, operational, and reputational impact of disruptions.
* Why Other Options Are Incorrect:
* Option A (Business Continuity Management Charter):
* A charter defines the governance, responsibilities, and overall framework of business continuity but does not focus on RTOs or critical business processes.
* Option B (Business Continuity Risk Assessment Plan):
* A risk assessment identifies threats and vulnerabilities but does not define recovery time objectives.
* While risk assessments inform the BIA, they do not replace it.
* Option D (Business Case for Business Continuity Planning):
* A business case justifies investment in continuity planning but does not map business processes to RTOs.
* GTAG 10: Business Continuity Management - Defines BIA as the process for identifying critical business functions and their RTOs.
* IIA Practice Guide: Auditing Business Continuity - Emphasizes the role of BIA in business resilience.
Step-by-Step Explanation:IIA References for Validation:Thus, the Business Impact Analysis (BIA) Plan (C) is the correct answer because it pairs critical business processes with recovery time objectives.
IIA-CIA-Part3-KR 문제 95
대형 병원에 의약품을 공급하는 회사는 24시간 이내에 부족분을 보충하기 위해 하청업체에 크게 의존합니다. 내부 감사인은 이 의무에 대해 하청업체가 책임이 있다는 증거를 어디에서 찾아야 합니까?
정답: C
- 최근 업로드
- 106Snowflake.ADA-C02.v2026-06-08.q23
- 107Microsoft.SC-300-KR.v2026-06-08.q173
- 106Microsoft.DP-300-KR.v2026-06-08.q157
- 105Microsoft.MS-102-KR.v2026-06-08.q240
- 105Microsoft.DP-300-KR.v2026-06-08.q176
- 105Microsoft.SC-100-KR.v2026-06-08.q115
- 119TheBerylInstitute.CPXP.v2026-06-06.q56
- 175ACAMS.CAMS7-KR.v2026-06-05.q213
- 181PaloAltoNetworks.XSIAM-Analyst.v2026-06-04.q72
- 152NLN.NEX.v2026-06-04.q54
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-02-16.q207 모의시험 시험자료를 다운 받으세요.