IIA-CIA-Part3-KR 문제 101
다음 네트워크 중 여러 도시와 국가에서 운영되는 조직에 적합한 네트워크는 무엇입니까?
정답: A
A Wide Area Network (WAN) is the most suitable type of network for an organization that has operations in multiple cities and countries. WANs connect multiple local area networks (LANs) and other types of networks across long geographical distances, enabling seamless communication and data sharing among remote offices and branches.
A). Wide Area Network (WAN) (Correct Answer)
WANs cover extensive geographical areas, such as multiple cities, countries, or even continents.
They use various communication technologies, including leased lines, satellite connections, VPNs, and MPLS.
WANs enable organizations with distributed operations to centralize data management and enhance business continuity.
Example: An international corporation like a multinational bank or a global retail chain relies on a WAN to link its offices worldwide.
B). Local Area Network (LAN) (Incorrect Answer)
LANs are confined to a small area, such as an office building, factory, or campus.
They provide high-speed connectivity but are not designed for geographically dispersed locations.
Example: A single office using Ethernet and Wi-Fi to connect employees' devices.
C). Metropolitan Area Network (MAN) (Incorrect Answer)
MANs span a city or a large campus but do not extend to multiple countries.
Example: A city's government agencies using a fiber-optic MAN for interdepartmental communication.
D). Storage Area Network (SAN) (Incorrect Answer)
SANs are dedicated high-speed networks designed for large-scale data storage and retrieval.
They are not meant for interconnecting geographically dispersed locations.
Example: A financial institution using a SAN for high-speed access to critical databases.
The IIA's Global Technology Audit Guide (GTAG) - IT Risks and Controls emphasizes the importance of network infrastructure in securing and managing organizational data across multiple locations.
IIA Standard 2110 - Governance requires internal auditors to evaluate whether the organization's IT strategy (including WAN infrastructure) supports business objectives and risk management.
IIA GTAG 17 - Auditing Network Security highlights the importance of WAN security, VPNs, and encryption when managing international operations.
Explanation of Answer Choices:IIA References:Thus, the correct answer is A. Wide Area Network (WAN).
A). Wide Area Network (WAN) (Correct Answer)
WANs cover extensive geographical areas, such as multiple cities, countries, or even continents.
They use various communication technologies, including leased lines, satellite connections, VPNs, and MPLS.
WANs enable organizations with distributed operations to centralize data management and enhance business continuity.
Example: An international corporation like a multinational bank or a global retail chain relies on a WAN to link its offices worldwide.
B). Local Area Network (LAN) (Incorrect Answer)
LANs are confined to a small area, such as an office building, factory, or campus.
They provide high-speed connectivity but are not designed for geographically dispersed locations.
Example: A single office using Ethernet and Wi-Fi to connect employees' devices.
C). Metropolitan Area Network (MAN) (Incorrect Answer)
MANs span a city or a large campus but do not extend to multiple countries.
Example: A city's government agencies using a fiber-optic MAN for interdepartmental communication.
D). Storage Area Network (SAN) (Incorrect Answer)
SANs are dedicated high-speed networks designed for large-scale data storage and retrieval.
They are not meant for interconnecting geographically dispersed locations.
Example: A financial institution using a SAN for high-speed access to critical databases.
The IIA's Global Technology Audit Guide (GTAG) - IT Risks and Controls emphasizes the importance of network infrastructure in securing and managing organizational data across multiple locations.
IIA Standard 2110 - Governance requires internal auditors to evaluate whether the organization's IT strategy (including WAN infrastructure) supports business objectives and risk management.
IIA GTAG 17 - Auditing Network Security highlights the importance of WAN security, VPNs, and encryption when managing international operations.
Explanation of Answer Choices:IIA References:Thus, the correct answer is A. Wide Area Network (WAN).
IIA-CIA-Part3-KR 문제 102
외국 자회사에 제품을 판매하는 조직이 수입 관세를 낮추는 가격을 청구하고자 합니다. 다음 중 조직에 가장 적합한 행동 방침은 무엇입니까?
정답: A
Comprehensive and Detailed In-Depth Explanation:
Transfer pricing refers to the pricing of goods, services, and intangibles transferred between related entities. In international transactions, companies often adjust transfer prices to minimize tax liabilities and import tariffs.
Decreasing the transfer price (Option A) results in a lower declared customs value, reducing import tariffs paid to the foreign country.
Increasing the transfer price (Option B) would raise import tariffs, making it less favorable.
Charging the arm's length price (Option C) ensures compliance with tax regulations but does not necessarily reduce import tariffs.
Optimal transfer pricing (Option D) is a general term that does not specifically focus on reducing tariffs.
Thus, decreasing the transfer price is the best approach.
Reference: IIA Business Acumen - Transfer Pricing Strategies
Transfer pricing refers to the pricing of goods, services, and intangibles transferred between related entities. In international transactions, companies often adjust transfer prices to minimize tax liabilities and import tariffs.
Decreasing the transfer price (Option A) results in a lower declared customs value, reducing import tariffs paid to the foreign country.
Increasing the transfer price (Option B) would raise import tariffs, making it less favorable.
Charging the arm's length price (Option C) ensures compliance with tax regulations but does not necessarily reduce import tariffs.
Optimal transfer pricing (Option D) is a general term that does not specifically focus on reducing tariffs.
Thus, decreasing the transfer price is the best approach.
Reference: IIA Business Acumen - Transfer Pricing Strategies
IIA-CIA-Part3-KR 문제 103
조직의 사이버 보안 위험 평가 프레임워크의 어떤 구성 요소를 통해 경영진이 사용자 역할에 따라 사용자 제어를 구현할 수 있습니까?
정답: C
Information access management is the component of an organization's cybersecurity risk assessment framework that allows management to implement user controls based on a user's role. This principle, often referred to as Role-Based Access Control (RBAC), ensures that individuals have access only to the data and systems necessary for their job responsibilities.
Definition of Role-Based Access Control (RBAC):
RBAC assigns permissions based on an individual's role within the organization.
For example, a finance employee may access financial records, but not HR data.
Minimization of Insider Threats:
By limiting access to sensitive data, information access management helps reduce the risk of fraud, data breaches, and unauthorized modifications.
Regulatory Compliance:
Many regulations (e.g., GDPR, SOX, HIPAA) require companies to implement access control measures to protect sensitive information.
Internal auditors assess whether access management policies are enforced properly.
Alignment with Cybersecurity Risk Frameworks:
NIST Cybersecurity Framework - Access Control (AC) Family: Establishes guidelines for restricting access based on user identity and role.
ISO/IEC 27001 - Information Security Management System (ISMS): Requires organizations to implement access control policies to protect data integrity.
A). Prompt response and remediation policy: Focuses on incident response rather than proactive access control.
B). Inventory of information assets: Important for tracking IT assets but does not define access privileges.
D). Standard security configurations: Enforce security settings but do not manage access based on user roles.
IIA GTAG (Global Technology Audit Guide) on Information Security: Recommends implementing access control policies to restrict unauthorized access.
IIA Standard 2110 - Governance: Emphasizes the importance of cybersecurity governance, including role- based access management.
COBIT Framework - DSS05.04 (Manage User Identity and Access): Defines best practices for controlling user access based on organizational roles.
Step-by-Step Justification:Why Not the Other Options?IIA References:
Definition of Role-Based Access Control (RBAC):
RBAC assigns permissions based on an individual's role within the organization.
For example, a finance employee may access financial records, but not HR data.
Minimization of Insider Threats:
By limiting access to sensitive data, information access management helps reduce the risk of fraud, data breaches, and unauthorized modifications.
Regulatory Compliance:
Many regulations (e.g., GDPR, SOX, HIPAA) require companies to implement access control measures to protect sensitive information.
Internal auditors assess whether access management policies are enforced properly.
Alignment with Cybersecurity Risk Frameworks:
NIST Cybersecurity Framework - Access Control (AC) Family: Establishes guidelines for restricting access based on user identity and role.
ISO/IEC 27001 - Information Security Management System (ISMS): Requires organizations to implement access control policies to protect data integrity.
A). Prompt response and remediation policy: Focuses on incident response rather than proactive access control.
B). Inventory of information assets: Important for tracking IT assets but does not define access privileges.
D). Standard security configurations: Enforce security settings but do not manage access based on user roles.
IIA GTAG (Global Technology Audit Guide) on Information Security: Recommends implementing access control policies to restrict unauthorized access.
IIA Standard 2110 - Governance: Emphasizes the importance of cybersecurity governance, including role- based access management.
COBIT Framework - DSS05.04 (Manage User Identity and Access): Defines best practices for controlling user access based on organizational roles.
Step-by-Step Justification:Why Not the Other Options?IIA References:
IIA-CIA-Part3-KR 문제 104
다음 중 데이터 분석 과정에서 획득한 도트로 가장 먼저 해야 할 일은 무엇입니까?
정답: A
In the data analytics process, the first step after obtaining data is to ensure its completeness and accuracy. If data is incomplete or inaccurate, the entire analysis process is compromised, leading to unreliable results.
Let's analyze each option:
Option A: Verify completeness and accuracy.
Correct.
Completeness ensures that all necessary data points are included, preventing missing or incomplete datasets.
Accuracy ensures that data values are correct and free from errors, ensuring reliability for analysis.
IIA Reference: Internal auditors use data validation techniques to confirm completeness and accuracy before analysis. (IIA GTAG: Auditing with Data Analytics) Option B: Verify existence and accuracy.
Incorrect. While existence is important (ensuring data is valid and not fabricated), completeness is more critical in the initial step to avoid missing data.
Option C: Verify completeness and integrity.
Incorrect. Integrity refers to the reliability and consistency of data across systems, which is a later step after verifying completeness and accuracy.
Option D: Verify existence and completeness.
Incorrect. Existence is less relevant at the initial stage than accuracy, which is crucial for avoiding misinterpretation of results.
Thus, the verified answer is A. Verify completeness and accuracy.
Let's analyze each option:
Option A: Verify completeness and accuracy.
Correct.
Completeness ensures that all necessary data points are included, preventing missing or incomplete datasets.
Accuracy ensures that data values are correct and free from errors, ensuring reliability for analysis.
IIA Reference: Internal auditors use data validation techniques to confirm completeness and accuracy before analysis. (IIA GTAG: Auditing with Data Analytics) Option B: Verify existence and accuracy.
Incorrect. While existence is important (ensuring data is valid and not fabricated), completeness is more critical in the initial step to avoid missing data.
Option C: Verify completeness and integrity.
Incorrect. Integrity refers to the reliability and consistency of data across systems, which is a later step after verifying completeness and accuracy.
Option D: Verify existence and completeness.
Incorrect. Existence is less relevant at the initial stage than accuracy, which is crucial for avoiding misinterpretation of results.
Thus, the verified answer is A. Verify completeness and accuracy.
IIA-CIA-Part3-KR 문제 105
다음 중 스팸 필터 성능의 "가양성"을 가장 잘 나타내는 상황은 무엇입니까?
정답: D
A false positive occurs when a system incorrectly identifies a legitimate item as a threat or an unwanted entity. In the case of a spam filter, a false positive happens when the filter mistakenly classifies a genuine email as spam, even though it is legitimate.
Option A: "The spam filter removed incoming communication that included certain keywords and domains." This describes a general filtering mechanism but does not indicate a mistake. If the filter was correctly configured, it is not necessarily a false positive. (Incorrect) Option B: "The spam filter deleted commercial ads automatically, as they were recognized as unwanted." If the ads were indeed unwanted, this is a true positive, meaning the system worked correctly. (Incorrect) Option C: "The spam filter routed to the 'junk' folder a newsletter that appeared to include links to fake websites." If the newsletter contained suspicious links, the filter was functioning as designed. This is not necessarily an error. (Incorrect) Option D: "The spam filter blocked a fitness club gift card that coworkers sent to an employee for her birthday." This is a clear example of a false positive because the email was not spam or malicious, yet the filter mistakenly blocked it. (Correct Answer) IIA GTAG (Global Technology Audit Guide) on Cybersecurity and IT Risks: Discusses false positives and negatives in automated security controls.
IIA's "Auditing IT Security Controls" Report: Emphasizes the need for tuning security filters to reduce false positives.
COBIT 2019 - DSS05.07 (Manage Security Services): Highlights the importance of minimizing false positives to ensure business communication is not disrupted.
Analysis of Each Option:IIA References:Thus, the correct answer is D. The spam filter blocked a fitness club gift card that coworkers sent to an employee for her birthday.
Option A: "The spam filter removed incoming communication that included certain keywords and domains." This describes a general filtering mechanism but does not indicate a mistake. If the filter was correctly configured, it is not necessarily a false positive. (Incorrect) Option B: "The spam filter deleted commercial ads automatically, as they were recognized as unwanted." If the ads were indeed unwanted, this is a true positive, meaning the system worked correctly. (Incorrect) Option C: "The spam filter routed to the 'junk' folder a newsletter that appeared to include links to fake websites." If the newsletter contained suspicious links, the filter was functioning as designed. This is not necessarily an error. (Incorrect) Option D: "The spam filter blocked a fitness club gift card that coworkers sent to an employee for her birthday." This is a clear example of a false positive because the email was not spam or malicious, yet the filter mistakenly blocked it. (Correct Answer) IIA GTAG (Global Technology Audit Guide) on Cybersecurity and IT Risks: Discusses false positives and negatives in automated security controls.
IIA's "Auditing IT Security Controls" Report: Emphasizes the need for tuning security filters to reduce false positives.
COBIT 2019 - DSS05.07 (Manage Security Services): Highlights the importance of minimizing false positives to ensure business communication is not disrupted.
Analysis of Each Option:IIA References:Thus, the correct answer is D. The spam filter blocked a fitness club gift card that coworkers sent to an employee for her birthday.
- 최근 업로드
- 111TheBerylInstitute.CPXP.v2026-06-06.q56
- 134ACAMS.CAMS7-KR.v2026-06-05.q213
- 162PaloAltoNetworks.XSIAM-Analyst.v2026-06-04.q72
- 134NLN.NEX.v2026-06-04.q54
- 178Microsoft.AZ-500-KR.v2026-06-04.q213
- 165Microsoft.DP-600-KR.v2026-06-04.q98
- 182Microsoft.AZ-204-KR.v2026-06-04.q237
- 163Microsoft.PL-600-KR.v2026-06-04.q112
- 225Microsoft.SC-300-KR.v2026-06-03.q151
- 194Microsoft.DP-600-KR.v2026-06-03.q70
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-05-02.q255 모의시험 시험자료를 다운 받으세요.