IIA-CIA-Part3-KR 문제 196
다음 중 국제 재무 보고 기준에 따른 연결의 기준을 나타내는 것은 무엇입니까?
정답: B
Under International Financial Reporting Standards (IFRS 10 - Consolidated Financial Statements), an entity is required to consolidate its financial statements based on the control principle rather than ownership percentage alone.
* Why Option B (Control ownership) is Correct:
* According to IFRS 10, consolidation is required when an entity has control over another entity.
* Control is defined as having power over the investee, exposure to variable returns, and the ability to influence those returns.
* Even if an entity owns less than 50% of voting rights, it may still have control through contractual arrangements, rights over key decisions, or majority board influence.
* Why Other Options Are Incorrect:
* Option A (Variable entity approach):
* This is a concept used in U.S. GAAP (ASC 810 - Variable Interest Entities) rather than IFRS. IFRS focuses on the broader control model.
* Option C (Risk and reward):
* IFRS previously considered risk and reward under IAS 27/SIC-12, but IFRS 10 replaced this with the control model.
* Option D (Voting interest):
* Voting rights alone do not determine consolidation under IFRS. Control can exist even without majority voting rights through contractual arrangements or potential voting rights.
* IFRS 10 - Consolidated Financial Statements: Defines the principle of control for consolidation.
* IIA GTAG - "Auditing Financial Reporting Risks": Discusses the impact of IFRS consolidation principles.
* COSO ERM Framework: Emphasizes risk assessment in financial reporting, including consolidation decisions.
IIA References:Thus, the correct answer is B. Control ownership.
* Why Option B (Control ownership) is Correct:
* According to IFRS 10, consolidation is required when an entity has control over another entity.
* Control is defined as having power over the investee, exposure to variable returns, and the ability to influence those returns.
* Even if an entity owns less than 50% of voting rights, it may still have control through contractual arrangements, rights over key decisions, or majority board influence.
* Why Other Options Are Incorrect:
* Option A (Variable entity approach):
* This is a concept used in U.S. GAAP (ASC 810 - Variable Interest Entities) rather than IFRS. IFRS focuses on the broader control model.
* Option C (Risk and reward):
* IFRS previously considered risk and reward under IAS 27/SIC-12, but IFRS 10 replaced this with the control model.
* Option D (Voting interest):
* Voting rights alone do not determine consolidation under IFRS. Control can exist even without majority voting rights through contractual arrangements or potential voting rights.
* IFRS 10 - Consolidated Financial Statements: Defines the principle of control for consolidation.
* IIA GTAG - "Auditing Financial Reporting Risks": Discusses the impact of IFRS consolidation principles.
* COSO ERM Framework: Emphasizes risk assessment in financial reporting, including consolidation decisions.
IIA References:Thus, the correct answer is B. Control ownership.
IIA-CIA-Part3-KR 문제 197
내부 감사 기능이 조직 구조, 성과물, 커뮤니케이션 프로토콜 및 리소스 모델을 정의하기 위해 취해야 할 첫 번째 단계는 무엇입니까?
정답: D
The first step in defining the internal audit function's structure and processes is to understand the needs and expectations of the board, senior management, and external stakeholders. This ensures alignment with organizational priorities and risk appetite.
Option A (recommend improvements) is a later activity. Option B (hiring plan) comes after the structure and resourcing needs are identified. Option C (quality assessments) occurs after processes are established.
Reference:
IIA Standards - Standard 1000: Purpose, Authority, and Responsibility.
Option A (recommend improvements) is a later activity. Option B (hiring plan) comes after the structure and resourcing needs are identified. Option C (quality assessments) occurs after processes are established.
Reference:
IIA Standards - Standard 1000: Purpose, Authority, and Responsibility.
IIA-CIA-Part3-KR 문제 198
다음 중 스피어 피싱 공격을 가장 잘 보여주는 시나리오는 무엇입니까?
정답: C
A spear phishing attack is a targeted email attack aimed at a specific individual, organization, or business.
Unlike general phishing, which casts a wide net, spear phishing is highly personalized and designed to deceive the recipient into providing sensitive information.
* Personalization - The email references a golf membership renewal, making it relevant and believable to the recipient.
* Social Engineering - The attacker exploits the victim's trust by pretending to be a legitimate entity.
* Malicious Link - The victim clicks a fraudulent hyperlink and enters sensitive credit card details.
* Financial Fraud - The goal is to steal payment information, leading to unauthorized transactions.
* A. Numerous and consistent attacks on the company's website caused the server to crash.
* This describes a Denial-of-Service (DoS) attack, not spear phishing.
* B. A person posing as an IT help desk representative called employees and played a generic message requesting passwords.
* This describes vishing (voice phishing) rather than spear phishing.
* D. Many users of a social network service received fake notifications about a new investment opportunity.
* This is general phishing, as it targets multiple users instead of one individual.
* IIA's GTAG (Global Technology Audit Guide) on Cybersecurity - Emphasizes the risk of spear phishing in cyber fraud.
* NIST SP 800-61 (Computer Security Incident Handling Guide) - Defines spear phishing as a highly targeted attack method.
* COBIT 2019 (Governance and Management of IT) - Highlights social engineering risks in IT security.
Why Option C is Correct?Why Not the Other Options?IIA References:# Final Answer: C. A person received a personalized email regarding a golf membership renewal, and he clicked a hyperlink to enter his credit card data into a fake website.
Unlike general phishing, which casts a wide net, spear phishing is highly personalized and designed to deceive the recipient into providing sensitive information.
* Personalization - The email references a golf membership renewal, making it relevant and believable to the recipient.
* Social Engineering - The attacker exploits the victim's trust by pretending to be a legitimate entity.
* Malicious Link - The victim clicks a fraudulent hyperlink and enters sensitive credit card details.
* Financial Fraud - The goal is to steal payment information, leading to unauthorized transactions.
* A. Numerous and consistent attacks on the company's website caused the server to crash.
* This describes a Denial-of-Service (DoS) attack, not spear phishing.
* B. A person posing as an IT help desk representative called employees and played a generic message requesting passwords.
* This describes vishing (voice phishing) rather than spear phishing.
* D. Many users of a social network service received fake notifications about a new investment opportunity.
* This is general phishing, as it targets multiple users instead of one individual.
* IIA's GTAG (Global Technology Audit Guide) on Cybersecurity - Emphasizes the risk of spear phishing in cyber fraud.
* NIST SP 800-61 (Computer Security Incident Handling Guide) - Defines spear phishing as a highly targeted attack method.
* COBIT 2019 (Governance and Management of IT) - Highlights social engineering risks in IT security.
Why Option C is Correct?Why Not the Other Options?IIA References:# Final Answer: C. A person received a personalized email regarding a golf membership renewal, and he clicked a hyperlink to enter his credit card data into a fake website.
IIA-CIA-Part3-KR 문제 199
투자자는 성숙기에 지배적인 위치에 있는 조직을 인수했습니다. 슬로우 성장 산업과 지속적으로 긍정적인 금융 소득을 창출합니다.
다음 중 투자자가 자신의 포트폴리오에서 이 투자에 이름을 붙일 가능성이 가장 높은 용어는 무엇입니까?
다음 중 투자자가 자신의 포트폴리오에서 이 투자에 이름을 붙일 가능성이 가장 높은 용어는 무엇입니까?
정답: B
* Understanding the BCG Matrix and Investment Classifications:
* The Boston Consulting Group (BCG) Matrix classifies business investments into four categories:
* Stars: High growth, high market share.
* Cash Cows: Low growth, high market share.
* Question Marks: High growth, low market share.
* Dogs: Low growth, low market share.
* Why the Investment is a Cash Cow:
* The organization operates in a mature, slow-growth industry but has a dominant market position and generates consistent positive financial income.
* This aligns with the definition of a Cash Cow, as it represents a stable and profitable business with low reinvestment needs.
* Investors typically use Cash Cows to fund other investments, as they generate steady cash flow with minimal risk.
* Why Other Options Are Incorrect:
* A. A star:
* A Star requires high growth and high market share, but the organization operates in a slow-growth industry, disqualifying it from this category.
* C. A question mark:
* A Question Mark is in a high-growth industry but lacks market dominance. Since this company is already dominant, it does not fit this category.
* D. A dog:
* A Dog has low growth and low market share, meaning it does not generate strong financial returns. The company described produces positive income, ruling out this category.
* IIA's Perspective on Business Strategy and Portfolio Management:
* IIA Standard 2120 - Risk Management states that internal auditors must assess the strategic positioning of business investments.
* COSO ERM Framework supports the use of strategic models like the BCG Matrix to evaluate investment performance and risk exposure.
IIA References:
* IIA Standard 2120 - Risk Management and Strategic Planning
* COSO Enterprise Risk Management (ERM) Framework
* Boston Consulting Group (BCG) Matrix in Investment Analysis
Thus, the correct and verified answer is B. A cash cow.
* The Boston Consulting Group (BCG) Matrix classifies business investments into four categories:
* Stars: High growth, high market share.
* Cash Cows: Low growth, high market share.
* Question Marks: High growth, low market share.
* Dogs: Low growth, low market share.
* Why the Investment is a Cash Cow:
* The organization operates in a mature, slow-growth industry but has a dominant market position and generates consistent positive financial income.
* This aligns with the definition of a Cash Cow, as it represents a stable and profitable business with low reinvestment needs.
* Investors typically use Cash Cows to fund other investments, as they generate steady cash flow with minimal risk.
* Why Other Options Are Incorrect:
* A. A star:
* A Star requires high growth and high market share, but the organization operates in a slow-growth industry, disqualifying it from this category.
* C. A question mark:
* A Question Mark is in a high-growth industry but lacks market dominance. Since this company is already dominant, it does not fit this category.
* D. A dog:
* A Dog has low growth and low market share, meaning it does not generate strong financial returns. The company described produces positive income, ruling out this category.
* IIA's Perspective on Business Strategy and Portfolio Management:
* IIA Standard 2120 - Risk Management states that internal auditors must assess the strategic positioning of business investments.
* COSO ERM Framework supports the use of strategic models like the BCG Matrix to evaluate investment performance and risk exposure.
IIA References:
* IIA Standard 2120 - Risk Management and Strategic Planning
* COSO Enterprise Risk Management (ERM) Framework
* Boston Consulting Group (BCG) Matrix in Investment Analysis
Thus, the correct and verified answer is B. A cash cow.
IIA-CIA-Part3-KR 문제 200
다음 IT 재해 복구 계획 중 인터넷 및 통신과 같은 기본 서비스에 사용할 수 있는 공간이 있는 복구용으로 지정된 원격 사이트가 포함되지만 서버나 인프라 장비가 없는 것은 무엇입니까?
정답: B
A Cold Site is a remote disaster recovery facility that provides physical space and basic utilities such as electricity, internet, and telecommunications but does not include pre-installed servers, networking equipment, or other IT infrastructure. It requires a longer recovery time since the organization must procure, install, and configure necessary hardware and software before resuming operations.
* A. Frozen Site - This is not a recognized term in IT disaster recovery planning.
* C. Warm Site - A warm site has some pre-installed hardware and infrastructure but requires additional setup before full operation.
* D. Hot Site - A hot site is a fully functional duplicate of the original site, with real-time data replication, allowing for immediate recovery.
* The IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management emphasizes that organizations should classify recovery sites based on risk tolerance and recovery time objectives (RTO).
* The IIA's International Professional Practices Framework (IPPF) - Practice Advisory 2110-2 discusses IT continuity and disaster recovery as a critical element of internal audit assessments.
* NIST Special Publication 800-34 (Contingency Planning Guide for Information Technology Systems) defines and categorizes disaster recovery sites, aligning with the cold site definition.
Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is B. Cold Site.
* A. Frozen Site - This is not a recognized term in IT disaster recovery planning.
* C. Warm Site - A warm site has some pre-installed hardware and infrastructure but requires additional setup before full operation.
* D. Hot Site - A hot site is a fully functional duplicate of the original site, with real-time data replication, allowing for immediate recovery.
* The IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management emphasizes that organizations should classify recovery sites based on risk tolerance and recovery time objectives (RTO).
* The IIA's International Professional Practices Framework (IPPF) - Practice Advisory 2110-2 discusses IT continuity and disaster recovery as a critical element of internal audit assessments.
* NIST Special Publication 800-34 (Contingency Planning Guide for Information Technology Systems) defines and categorizes disaster recovery sites, aligning with the cold site definition.
Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is B. Cold Site.
- 최근 업로드
- 113WGU.Data-Driven-Decision-Making.v2026-06-17.q46
- 130HP.HPE7-A05.v2026-06-17.q115
- 107HP.HPE7-A02.v2026-06-17.q96
- 108SAP.C_S4PM_2601.v2026-06-17.q38
- 109Oracle.1Z0-1072-25.v2026-06-17.q18
- 158VMware.6V0-22.25.v2026-06-16.q98
- 150NetworkAppliance.NS0-901.v2026-06-16.q35
- 145Cisco.300-220.v2026-06-16.q145
- 135Huawei.H20-923_V1.0.v2026-06-16.q21
- 161Google.Professional-Cloud-DevOps-Engineer.v2026-06-16.q142
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-02-16.q207 모의시험 시험자료를 다운 받으세요.