IIA-CIA-Part3-KR 문제 191
다음 데이터 속성 중 주로 보호하기 위해 설계된 사이버 보안 제어는 무엇입니까?
정답: B
Cybersecurity controls are primarily designed to protect the Confidentiality, Integrity, and Availability (CIA) of data. These are the three fundamental principles of cybersecurity and are essential for protecting organizational information assets. Let's analyze each option:
Option A: Veracity, velocity, and variety.
Incorrect. These attributes are commonly associated with big data and data analytics rather than cybersecurity.
Cybersecurity controls focus on ensuring that data is secure, rather than on its volume, speed, or diversity.
IIA Reference: Cybersecurity risk management frameworks emphasize the CIA triad over big data attributes.
(IIA GTAG: Auditing Cybersecurity Risk)
Option B: Integrity, availability, and confidentiality.
Correct. These three principles are at the core of cybersecurity:
Confidentiality: Ensures that sensitive information is only accessible to authorized individuals.
Integrity: Protects data from unauthorized modifications or corruption.
Availability: Ensures that data and systems are accessible when needed.
IIA Reference: The IIA's guidance on IT governance highlights the CIA triad as the foundation of cybersecurity. (IIA GTAG: Information Security Governance) Option C: Accessibility, accuracy, and effectiveness.
Incorrect. While these attributes are important in data management and usability, they do not directly define cybersecurity controls.
Option D: Authorization, logical access, and physical access.
Incorrect. While these are essential security components, they fall under broader IT security measures rather than forming the fundamental principles of cybersecurity.
Option A: Veracity, velocity, and variety.
Incorrect. These attributes are commonly associated with big data and data analytics rather than cybersecurity.
Cybersecurity controls focus on ensuring that data is secure, rather than on its volume, speed, or diversity.
IIA Reference: Cybersecurity risk management frameworks emphasize the CIA triad over big data attributes.
(IIA GTAG: Auditing Cybersecurity Risk)
Option B: Integrity, availability, and confidentiality.
Correct. These three principles are at the core of cybersecurity:
Confidentiality: Ensures that sensitive information is only accessible to authorized individuals.
Integrity: Protects data from unauthorized modifications or corruption.
Availability: Ensures that data and systems are accessible when needed.
IIA Reference: The IIA's guidance on IT governance highlights the CIA triad as the foundation of cybersecurity. (IIA GTAG: Information Security Governance) Option C: Accessibility, accuracy, and effectiveness.
Incorrect. While these attributes are important in data management and usability, they do not directly define cybersecurity controls.
Option D: Authorization, logical access, and physical access.
Incorrect. While these are essential security components, they fall under broader IT security measures rather than forming the fundamental principles of cybersecurity.
IIA-CIA-Part3-KR 문제 192
내부 감사 과정에서 여러 공급업체가 정부 제재 목록에 등재되어 더 이상 거래가 금지되어 있는 것으로 확인되었습니다. 다음 중 정기적으로 업데이트되는 제재 목록을 준수하지 않을 위험을 가장 효과적으로 완화할 수 있는 방법은 무엇입니까?
정답: C
The most effective mitigation is to embed ongoing controls within vendor management processes to ensure that both new and existing vendors are continuously screened against updated sanctions lists. This creates a sustainable and automated compliance mechanism.
Option A is reactive and does not address future compliance. Option B only addresses onboarding of new vendors but ignores existing ones. Option D undermines compliance obligations and does not mitigate risk.
Reference:
IIA Global Technology Audit Guide (GTAG): Auditing Third-Party Risk; IIA Standards - Standard 2130:
Control.
Option A is reactive and does not address future compliance. Option B only addresses onboarding of new vendors but ignores existing ones. Option D undermines compliance obligations and does not mitigate risk.
Reference:
IIA Global Technology Audit Guide (GTAG): Auditing Third-Party Risk; IIA Standards - Standard 2130:
Control.
IIA-CIA-Part3-KR 문제 193
조직의 CEO로 가장한 침입자가 이메일을 보내 급여 직원을 속여 직원의 개인 세금 정보를 제공하도록 했습니다. 어떤 유형의 공격이 수행되었습니까?
정답: B
A spear phishing attack is a highly targeted email-based attack where an attacker impersonates a trusted individual (e.g., the CEO) to trick recipients into providing sensitive information.
* In this scenario, an intruder posed as the CEO and deceived payroll staff into sharing employees' private tax information.
* Spear phishing is more targeted than general phishing, often using personal details to make the fraudulent request seem legitimate.
* A. Boundary attack. (Incorrect)
* A boundary attack refers to attempts to breach an organization's network perimeter defenses, such as firewalls and intrusion detection systems.
* This scenario describes a social engineering attack, not a technical boundary attack.
* B. Spear phishing attack. (Correct)
* Spear phishing attacks are highly personalized email attacks, usually targeting specific employees within an organization.
* Attackers research their targets and use realistic messages to trick them into divulging sensitive data.
* This fits the scenario, as the attacker impersonated the CEO to steal tax information.
* C. Brute force attack. (Incorrect)
* A brute force attack involves systematically guessing passwords to gain unauthorized access to systems.
* This attack was based on deception, not password cracking.
* D. Spoofing attack. (Incorrect, but closely related)
* Email spoofing is a technique where an attacker falsifies the sender's email address.
* While spear phishing often includes spoofing, the broader technique used here is spear phishing, as it involved social engineering and deception.
* IIA GTAG 16 - Security Risk: IT and Cybersecurity discusses phishing and social engineering threats, emphasizing internal controls to mitigate them.
* IIA Standard 2120 - Risk Management highlights the need for risk assessments in cybersecurity, including employee awareness training for phishing attacks.
* National Institute of Standards and Technology (NIST) Special Publication 800-61 classifies spear phishing as a high-risk cyber threat to organizations.
Explanation of Answer Choices:IIA References:
* In this scenario, an intruder posed as the CEO and deceived payroll staff into sharing employees' private tax information.
* Spear phishing is more targeted than general phishing, often using personal details to make the fraudulent request seem legitimate.
* A. Boundary attack. (Incorrect)
* A boundary attack refers to attempts to breach an organization's network perimeter defenses, such as firewalls and intrusion detection systems.
* This scenario describes a social engineering attack, not a technical boundary attack.
* B. Spear phishing attack. (Correct)
* Spear phishing attacks are highly personalized email attacks, usually targeting specific employees within an organization.
* Attackers research their targets and use realistic messages to trick them into divulging sensitive data.
* This fits the scenario, as the attacker impersonated the CEO to steal tax information.
* C. Brute force attack. (Incorrect)
* A brute force attack involves systematically guessing passwords to gain unauthorized access to systems.
* This attack was based on deception, not password cracking.
* D. Spoofing attack. (Incorrect, but closely related)
* Email spoofing is a technique where an attacker falsifies the sender's email address.
* While spear phishing often includes spoofing, the broader technique used here is spear phishing, as it involved social engineering and deception.
* IIA GTAG 16 - Security Risk: IT and Cybersecurity discusses phishing and social engineering threats, emphasizing internal controls to mitigate them.
* IIA Standard 2120 - Risk Management highlights the need for risk assessments in cybersecurity, including employee awareness training for phishing attacks.
* National Institute of Standards and Technology (NIST) Special Publication 800-61 classifies spear phishing as a high-risk cyber threat to organizations.
Explanation of Answer Choices:IIA References:
IIA-CIA-Part3-KR 문제 194
다음 중 사물 인터넷 개념의 이점으로 옳지 않은 것은?
정답: B
The Internet of Things (IoT) refers to a network of interconnected physical devices that collect and exchange data through the internet. The key benefits of IoT include automation, improved decision-making, cost savings, and efficiency gains.
(A) Employees can choose from a variety of devices they want to utilize to privately read work emails without their employer's knowledge.
This is incorrect because it focuses on unauthorized access rather than a benefit of IoT. Security and monitoring are major concerns in IoT environments.
IIA Standard 2110 - Governance requires organizations to ensure adequate governance structures for IT and data security.
(B) Physical devices, such as thermostats and heat pumps, can be set to react to electricity market changes and reduce costs. # This is correct because IoT enables smart devices to automatically adjust based on real-time data.
Example: Smart thermostats (e.g., Nest, Honeywell) use IoT to track energy prices and consumption, adjusting temperatures to optimize efficiency.
IIA Practice Guide "Assessing the Governance of Risks in IT Projects" highlights IoT as a tool for operational efficiency and cost savings.
(C) Information can be extracted more efficiently from databases and transmitted to relevant applications for in-depth analytics.
This relates more to big data and data analytics, not necessarily IoT.
IIA GTAG "Auditing IT Governance" discusses IoT in operational efficiency but distinguishes it from data extraction.
(D) Data mining and data collection from the internet and social networks is easier, and the results are more comprehensive.
This describes AI and machine learning rather than IoT, which primarily connects physical devices.
IIA GTAG "Auditing Cybersecurity Risk" highlights IoT risks but does not emphasize social media data mining.
IIA GTAG (Global Technology Audit Guide) - "Auditing IT Governance"
IIA GTAG - "Assessing the Governance of Risks in IT Projects"
IIA Standard 2110 - Governance
IIA GTAG - "Auditing Cybersecurity Risk"
Analysis of Answer Choices:IIA References:Thus, the most appropriate answer is B because IoT improves efficiency by automating energy consumption based on market conditions.
(A) Employees can choose from a variety of devices they want to utilize to privately read work emails without their employer's knowledge.
This is incorrect because it focuses on unauthorized access rather than a benefit of IoT. Security and monitoring are major concerns in IoT environments.
IIA Standard 2110 - Governance requires organizations to ensure adequate governance structures for IT and data security.
(B) Physical devices, such as thermostats and heat pumps, can be set to react to electricity market changes and reduce costs. # This is correct because IoT enables smart devices to automatically adjust based on real-time data.
Example: Smart thermostats (e.g., Nest, Honeywell) use IoT to track energy prices and consumption, adjusting temperatures to optimize efficiency.
IIA Practice Guide "Assessing the Governance of Risks in IT Projects" highlights IoT as a tool for operational efficiency and cost savings.
(C) Information can be extracted more efficiently from databases and transmitted to relevant applications for in-depth analytics.
This relates more to big data and data analytics, not necessarily IoT.
IIA GTAG "Auditing IT Governance" discusses IoT in operational efficiency but distinguishes it from data extraction.
(D) Data mining and data collection from the internet and social networks is easier, and the results are more comprehensive.
This describes AI and machine learning rather than IoT, which primarily connects physical devices.
IIA GTAG "Auditing Cybersecurity Risk" highlights IoT risks but does not emphasize social media data mining.
IIA GTAG (Global Technology Audit Guide) - "Auditing IT Governance"
IIA GTAG - "Assessing the Governance of Risks in IT Projects"
IIA Standard 2110 - Governance
IIA GTAG - "Auditing Cybersecurity Risk"
Analysis of Answer Choices:IIA References:Thus, the most appropriate answer is B because IoT improves efficiency by automating energy consumption based on market conditions.
IIA-CIA-Part3-KR 문제 195
다음 중 1회용 비밀번호가 가장 많이 생성되는 상황은?
정답: D
A one-time password (OTP) is a unique, temporary password that is valid for a single login session or transaction. It is commonly used in multi-factor authentication (MFA) systems to enhance security.
Correct Answer (D - When an Employee Uses a Key Fob to Produce a Token) Key fobs generate a time-sensitive one-time password (OTP), which is used in conjunction with a traditional password to enhance security.
These devices are part of two-factor authentication (2FA) or multi-factor authentication (MFA) methods.
The IIA GTAG 9: Identity and Access Management discusses OTP tokens as a strong security control to prevent unauthorized access.
Why Other Options Are Incorrect:
Option A (When an employee accesses an online digital certificate):
Digital certificates authenticate users or devices, but they do not generate one-time passwords.
Option B (When an employee's biometrics have been accepted):
Biometric authentication (e.g., fingerprint, facial recognition) grants access based on biological traits, not an OTP.
Option C (When an employee creates a unique digital signature):
Digital signatures authenticate documents and transactions, but they are not time-sensitive one-time passwords.
IIA GTAG 9: Identity and Access Management - Covers OTP tokens as a security measure.
IIA Practice Guide: Auditing IT Security Controls - Recommends OTPs as part of secure authentication.
Step-by-Step Explanation:IIA References for Validation:Thus, D is the correct answer because key fobs generate one-time passwords for secure authentication.
Correct Answer (D - When an Employee Uses a Key Fob to Produce a Token) Key fobs generate a time-sensitive one-time password (OTP), which is used in conjunction with a traditional password to enhance security.
These devices are part of two-factor authentication (2FA) or multi-factor authentication (MFA) methods.
The IIA GTAG 9: Identity and Access Management discusses OTP tokens as a strong security control to prevent unauthorized access.
Why Other Options Are Incorrect:
Option A (When an employee accesses an online digital certificate):
Digital certificates authenticate users or devices, but they do not generate one-time passwords.
Option B (When an employee's biometrics have been accepted):
Biometric authentication (e.g., fingerprint, facial recognition) grants access based on biological traits, not an OTP.
Option C (When an employee creates a unique digital signature):
Digital signatures authenticate documents and transactions, but they are not time-sensitive one-time passwords.
IIA GTAG 9: Identity and Access Management - Covers OTP tokens as a security measure.
IIA Practice Guide: Auditing IT Security Controls - Recommends OTPs as part of secure authentication.
Step-by-Step Explanation:IIA References for Validation:Thus, D is the correct answer because key fobs generate one-time passwords for secure authentication.
- 최근 업로드
- 111TheBerylInstitute.CPXP.v2026-06-06.q56
- 134ACAMS.CAMS7-KR.v2026-06-05.q213
- 162PaloAltoNetworks.XSIAM-Analyst.v2026-06-04.q72
- 134NLN.NEX.v2026-06-04.q54
- 178Microsoft.AZ-500-KR.v2026-06-04.q213
- 165Microsoft.DP-600-KR.v2026-06-04.q98
- 182Microsoft.AZ-204-KR.v2026-06-04.q237
- 163Microsoft.PL-600-KR.v2026-06-04.q112
- 225Microsoft.SC-300-KR.v2026-06-03.q151
- 194Microsoft.DP-600-KR.v2026-06-03.q70
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-05-02.q255 모의시험 시험자료를 다운 받으세요.