IIA-CIA-Part3-KR 문제 126
다음 분석 기술 중 내부 감사인이 조직의 직원 중 누구도 사기 송장 지급을 받지 않았는지 확인하는 데 사용하는 것은 무엇입니까?
정답: C
Duplicate testing is an analytical technique used to detect fraudulent payments, errors, or inefficiencies by identifying repeated transactions within financial records. In this case, an internal auditor would use duplicate testing to ensure that employees are not receiving fraudulent invoice payments by verifying that no invoice has been paid multiple times.
* Detecting Duplicate Payments: Fraudulent employees may submit the same invoice multiple times with slight modifications to avoid detection. Duplicate testing helps find identical or similar transactions.
* Identifying Unusual Patterns: By analyzing payment records, auditors can detect repeat payments to the same vendor, same invoice number, or similar amounts within a short time frame.
* Aligns with Fraud Prevention Practices: As per IIA Standard 2120 - Risk Management, internal auditors must identify and assess fraud risks, including duplicate invoice payments.
* Supports Data Analytics in Auditing: IIA GTAG (Global Technology Audit Guide) 16 - Data Analysis Techniques recommends using duplicate testing to identify fraud, control weaknesses, and errors in financial transactions.
* A. Perform gap testing: Gap testing is used to identify missing data or transactions in a sequence (e.
g., missing invoice numbers), but it does not specifically target duplicate or fraudulent payments.
* B. Join different data sources: This method is useful for cross-checking information across multiple databases, but it is not directly related to identifying duplicate invoice payments.
* D. Calculate statistical parameters: Statistical analysis provides summary insights about data (e.g., mean, median), but it does not specifically detect duplicate payments.
* IIA Standard 2120 - Risk Management: Internal auditors must evaluate fraud risks, including duplicate payments.
* IIA Standard 1220 - Due Professional Care: Requires auditors to apply appropriate data analytics techniques.
* IIA GTAG 16 - Data Analysis Techniques: Recommends duplicate testing as an effective fraud detection method.
Key Reasons Why Option C is Correct:Why Other Options Are Incorrect:IIA References:Thus, the correct answer is C. Perform duplicate testing.
* Detecting Duplicate Payments: Fraudulent employees may submit the same invoice multiple times with slight modifications to avoid detection. Duplicate testing helps find identical or similar transactions.
* Identifying Unusual Patterns: By analyzing payment records, auditors can detect repeat payments to the same vendor, same invoice number, or similar amounts within a short time frame.
* Aligns with Fraud Prevention Practices: As per IIA Standard 2120 - Risk Management, internal auditors must identify and assess fraud risks, including duplicate invoice payments.
* Supports Data Analytics in Auditing: IIA GTAG (Global Technology Audit Guide) 16 - Data Analysis Techniques recommends using duplicate testing to identify fraud, control weaknesses, and errors in financial transactions.
* A. Perform gap testing: Gap testing is used to identify missing data or transactions in a sequence (e.
g., missing invoice numbers), but it does not specifically target duplicate or fraudulent payments.
* B. Join different data sources: This method is useful for cross-checking information across multiple databases, but it is not directly related to identifying duplicate invoice payments.
* D. Calculate statistical parameters: Statistical analysis provides summary insights about data (e.g., mean, median), but it does not specifically detect duplicate payments.
* IIA Standard 2120 - Risk Management: Internal auditors must evaluate fraud risks, including duplicate payments.
* IIA Standard 1220 - Due Professional Care: Requires auditors to apply appropriate data analytics techniques.
* IIA GTAG 16 - Data Analysis Techniques: Recommends duplicate testing as an effective fraud detection method.
Key Reasons Why Option C is Correct:Why Other Options Are Incorrect:IIA References:Thus, the correct answer is C. Perform duplicate testing.
IIA-CIA-Part3-KR 문제 127
한 음식점은 제3자 음식 배달 서비스에 의존하지 않고 배달 서비스를 포함하도록 사업을 확장하기로 결정했습니다. 다음 중 레스토랑 전략을 가장 잘 설명한 것은?
정답: B
Vertical integration occurs when a company expands its operations into a different stage of its supply chain. In this case, the restaurant is moving from relying on third-party delivery services to handling its own delivery operations, which is an example of backward vertical integration (taking control of a process previously handled by an external provider).
* (A) Incorrect - Diversification.
* Diversification refers to entering a completely different industry or market (e.g., a restaurant launching a grocery store).
* In this case, the restaurant is expanding within the same industry by adding delivery services.
* (B) Correct - Vertical integration.
* Vertical integration happens when a company takes control of another step in its supply chain
.
* Since the restaurant is now handling its own deliveries instead of outsourcing, this is an example of backward vertical integration.
* (C) Incorrect - Risk avoidance.
* Risk avoidance means eliminating an activity entirely to prevent exposure to risk (e.g., deciding not to offer delivery at all).
* The restaurant is not avoiding risk but taking on additional responsibilities.
* (D) Incorrect - Differentiation.
* Differentiation is a strategy focused on making a product/service unique to stand out from competitors.
* The restaurant is not introducing a unique feature but integrating delivery operations.
* IIA's Global Internal Audit Standards - Business Strategy and Risk Management
* Defines vertical integration and its impact on operational control.
* COSO's ERM Framework - Strategic Risk Considerations
* Discusses how vertical integration influences business risks and cost control.
* Porter's Competitive Strategies - Vertical Integration Analysis
* Explains backward and forward integration in supply chain management.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:
* (A) Incorrect - Diversification.
* Diversification refers to entering a completely different industry or market (e.g., a restaurant launching a grocery store).
* In this case, the restaurant is expanding within the same industry by adding delivery services.
* (B) Correct - Vertical integration.
* Vertical integration happens when a company takes control of another step in its supply chain
.
* Since the restaurant is now handling its own deliveries instead of outsourcing, this is an example of backward vertical integration.
* (C) Incorrect - Risk avoidance.
* Risk avoidance means eliminating an activity entirely to prevent exposure to risk (e.g., deciding not to offer delivery at all).
* The restaurant is not avoiding risk but taking on additional responsibilities.
* (D) Incorrect - Differentiation.
* Differentiation is a strategy focused on making a product/service unique to stand out from competitors.
* The restaurant is not introducing a unique feature but integrating delivery operations.
* IIA's Global Internal Audit Standards - Business Strategy and Risk Management
* Defines vertical integration and its impact on operational control.
* COSO's ERM Framework - Strategic Risk Considerations
* Discusses how vertical integration influences business risks and cost control.
* Porter's Competitive Strategies - Vertical Integration Analysis
* Explains backward and forward integration in supply chain management.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:
IIA-CIA-Part3-KR 문제 128
다음 중 사용자 개발 애플리케이션(UDA)에 대한 설명으로 옳지 않은 것은?
정답: B
User-Developed Applications (UDAs) are applications, spreadsheets, databases, or tools created and maintained by end-users rather than IT departments. They provide flexibility but also introduce risks related to security, accuracy, and change management.
* Why Option B is Correct:
* UDAs lack formal change management controls.
* Since they are typically not subject to rigorous testing and documentation, modifications may introduce errors.
* Updating or correcting a formula, macro, or script in a UDA may have unintended consequences that go unnoticed, leading to data integrity issues.
* Why Other Options Are Incorrect:
* Option A (UDAs are less flexible and more difficult to configure than traditional IT applications):
* Incorrect. UDAs are more flexible and easier to modify compared to traditional IT applications, which undergo strict change controls.
* Option C (UDAs typically are subjected to application development and change management controls):
* Incorrect. Most UDAs lack formal governance or IT oversight. They are typically developed by business users with little or no structured IT controls.
* Option D (Using UDAs typically enhances the organization's ability to comply with regulatory factors):
* Incorrect. UDAs introduce compliance risks due to lack of security, audit trails, and formal change controls.
* IIA GTAG - "Auditing User-Developed Applications": Discusses risks and controls related to UDAs.
* IIA Practice Advisory 2130-1 (Control Risk Self-Assessment): Highlights the importance of internal controls over UDAs.
* COSO Internal Control - Integrated Framework: Recommends applying IT general controls (ITGCs) to UDAs.
IIA References:Thus, the correct answer is B. Updating UDAs may lead to various errors resulting from changes or corrections.
* Why Option B is Correct:
* UDAs lack formal change management controls.
* Since they are typically not subject to rigorous testing and documentation, modifications may introduce errors.
* Updating or correcting a formula, macro, or script in a UDA may have unintended consequences that go unnoticed, leading to data integrity issues.
* Why Other Options Are Incorrect:
* Option A (UDAs are less flexible and more difficult to configure than traditional IT applications):
* Incorrect. UDAs are more flexible and easier to modify compared to traditional IT applications, which undergo strict change controls.
* Option C (UDAs typically are subjected to application development and change management controls):
* Incorrect. Most UDAs lack formal governance or IT oversight. They are typically developed by business users with little or no structured IT controls.
* Option D (Using UDAs typically enhances the organization's ability to comply with regulatory factors):
* Incorrect. UDAs introduce compliance risks due to lack of security, audit trails, and formal change controls.
* IIA GTAG - "Auditing User-Developed Applications": Discusses risks and controls related to UDAs.
* IIA Practice Advisory 2130-1 (Control Risk Self-Assessment): Highlights the importance of internal controls over UDAs.
* COSO Internal Control - Integrated Framework: Recommends applying IT general controls (ITGCs) to UDAs.
IIA References:Thus, the correct answer is B. Updating UDAs may lead to various errors resulting from changes or corrections.
IIA-CIA-Part3-KR 문제 129
Herzberg의 동기 부여 이론에 따르면 다음 요인 중 만족한 직원이 가장 자주 언급하는 요인은 무엇입니까?
정답: B
Herzberg's Two-Factor Theory of Motivation identifies two categories of workplace factors:
* Hygiene Factors - Prevent dissatisfaction but do not create motivation (e.g., salary, job security, work conditions).
* Motivational Factors - Lead to job satisfaction and motivation (e.g., achievement, responsibility, advancement, recognition).
* (A) Salary and status. # Incorrect.
* Salary is a hygiene factor, meaning it prevents dissatisfaction but does not directly drive job satisfaction.
* Status is also not a strong motivator under Herzberg's theory.
* (B) Responsibility and advancement. # Correct.
* These are motivational factors in Herzberg's theory.
* Employees feel satisfied when they have responsibility, career growth, and promotion opportunities.
* IIA GTAG "Auditing Human Resource Management" highlights career development as a key driver of employee motivation and retention.
* (C) Work conditions and security. # Incorrect.
* These are hygiene factors, which help avoid dissatisfaction but do not actively motivate employees.
* (D) Peer relationships and personal life. # Incorrect.
* Good relationships with coworkers help, but they are not primary motivators under Herzberg' s theory.
* IIA GTAG - "Auditing Human Resource Management"
* IIA Standard 2110 - Governance (Employee Motivation & Engagement)
* Herzberg's Two-Factor Theory of Motivation (Workplace Psychology Research) Analysis of Answer Choices:IIA References:Thus, the correct answer is B, as responsibility and advancement are the key motivational factors leading to employee satisfaction.
* Hygiene Factors - Prevent dissatisfaction but do not create motivation (e.g., salary, job security, work conditions).
* Motivational Factors - Lead to job satisfaction and motivation (e.g., achievement, responsibility, advancement, recognition).
* (A) Salary and status. # Incorrect.
* Salary is a hygiene factor, meaning it prevents dissatisfaction but does not directly drive job satisfaction.
* Status is also not a strong motivator under Herzberg's theory.
* (B) Responsibility and advancement. # Correct.
* These are motivational factors in Herzberg's theory.
* Employees feel satisfied when they have responsibility, career growth, and promotion opportunities.
* IIA GTAG "Auditing Human Resource Management" highlights career development as a key driver of employee motivation and retention.
* (C) Work conditions and security. # Incorrect.
* These are hygiene factors, which help avoid dissatisfaction but do not actively motivate employees.
* (D) Peer relationships and personal life. # Incorrect.
* Good relationships with coworkers help, but they are not primary motivators under Herzberg' s theory.
* IIA GTAG - "Auditing Human Resource Management"
* IIA Standard 2110 - Governance (Employee Motivation & Engagement)
* Herzberg's Two-Factor Theory of Motivation (Workplace Psychology Research) Analysis of Answer Choices:IIA References:Thus, the correct answer is B, as responsibility and advancement are the key motivational factors leading to employee satisfaction.
IIA-CIA-Part3-KR 문제 130
다음 중 스마트 장치에 대한 원격 지우기의 제한 사항은 무엇입니까?
정답: C
* Remote wipe is not always 100% effective: While remote wiping can delete most user data, some residual data may remain on the device, especially in cases where:
* The device has built-in storage redundancies.
* Deleted data can be recovered using forensic tools.
* The remote wipe command fails to execute properly due to network issues or device settings.
* Security Risk: This limitation poses a risk for organizations handling sensitive or confidential data, as unauthorized individuals may recover wiped data.
* IIA Standard 2110 - Governance: Internal auditors must assess how organizations manage IT security risks, including risks related to mobile devices and data protection.
* IIA Practice Guide: Auditing Cybersecurity Risks highlights the need to evaluate mobile security controls and limitations of data removal techniques.
* A. Encrypted data cannot be locked to prevent further access (Incorrect)
* Encrypted data remains secure even if the device is lost.
* Many enterprise security solutions allow organizations to revoke encryption keys remotely, making data inaccessible.
* IIA Standard 2120 - Risk Management advises that effective encryption reduces the impact of data loss.
* B. Default settings cannot be restored on the device. (Incorrect)
* Most remote wipe solutions allow factory reset, restoring the device to default settings.
* Many mobile device management (MDM) tools support full device restoration.
* D. Mobile device management software is required for a successful remote wipe. (Incorrect)
* While MDM enhances remote wiping capabilities, it is not strictly required.
* Some consumer and enterprise mobile operating systems (e.g., iOS, Android) provide built-in remote wipe functionality without MDM.
Explanation of Answer Choice C (Correct Answer):Explanation of Incorrect Answers:Conclusion:Remote wipe has limitations, and the inability to completely remove all data from the device (Option C) is a primary concern.
IIA References:
* IIA Standard 2110 - Governance
* IIA Standard 2120 - Risk Management
* IIA Practice Guide: Auditing Cybersecurity Risks
* The device has built-in storage redundancies.
* Deleted data can be recovered using forensic tools.
* The remote wipe command fails to execute properly due to network issues or device settings.
* Security Risk: This limitation poses a risk for organizations handling sensitive or confidential data, as unauthorized individuals may recover wiped data.
* IIA Standard 2110 - Governance: Internal auditors must assess how organizations manage IT security risks, including risks related to mobile devices and data protection.
* IIA Practice Guide: Auditing Cybersecurity Risks highlights the need to evaluate mobile security controls and limitations of data removal techniques.
* A. Encrypted data cannot be locked to prevent further access (Incorrect)
* Encrypted data remains secure even if the device is lost.
* Many enterprise security solutions allow organizations to revoke encryption keys remotely, making data inaccessible.
* IIA Standard 2120 - Risk Management advises that effective encryption reduces the impact of data loss.
* B. Default settings cannot be restored on the device. (Incorrect)
* Most remote wipe solutions allow factory reset, restoring the device to default settings.
* Many mobile device management (MDM) tools support full device restoration.
* D. Mobile device management software is required for a successful remote wipe. (Incorrect)
* While MDM enhances remote wiping capabilities, it is not strictly required.
* Some consumer and enterprise mobile operating systems (e.g., iOS, Android) provide built-in remote wipe functionality without MDM.
Explanation of Answer Choice C (Correct Answer):Explanation of Incorrect Answers:Conclusion:Remote wipe has limitations, and the inability to completely remove all data from the device (Option C) is a primary concern.
IIA References:
* IIA Standard 2110 - Governance
* IIA Standard 2120 - Risk Management
* IIA Practice Guide: Auditing Cybersecurity Risks
- 최근 업로드
- 107Snowflake.ADA-C02.v2026-06-08.q23
- 115Microsoft.SC-300-KR.v2026-06-08.q173
- 110Microsoft.DP-300-KR.v2026-06-08.q157
- 115Microsoft.MS-102-KR.v2026-06-08.q240
- 111Microsoft.DP-300-KR.v2026-06-08.q176
- 112Microsoft.SC-100-KR.v2026-06-08.q115
- 120TheBerylInstitute.CPXP.v2026-06-06.q56
- 177ACAMS.CAMS7-KR.v2026-06-05.q213
- 181PaloAltoNetworks.XSIAM-Analyst.v2026-06-04.q72
- 152NLN.NEX.v2026-06-04.q54
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-02-16.q207 모의시험 시험자료를 다운 받으세요.