IIA-CIA-Part3-KR 문제 101
다음 중 사물 인터넷 개념의 이점으로 옳지 않은 것은?
정답: B
The Internet of Things (IoT) refers to a network of interconnected physical devices that collect and exchange data through the internet. The key benefits of IoT include automation, improved decision-making, cost savings, and efficiency gains.
(A) Employees can choose from a variety of devices they want to utilize to privately read work emails without their employer's knowledge.
This is incorrect because it focuses on unauthorized access rather than a benefit of IoT. Security and monitoring are major concerns in IoT environments.
IIA Standard 2110 - Governance requires organizations to ensure adequate governance structures for IT and data security.
(B) Physical devices, such as thermostats and heat pumps, can be set to react to electricity market changes and reduce costs. # This is correct because IoT enables smart devices to automatically adjust based on real-time data.
Example: Smart thermostats (e.g., Nest, Honeywell) use IoT to track energy prices and consumption, adjusting temperatures to optimize efficiency.
IIA Practice Guide "Assessing the Governance of Risks in IT Projects" highlights IoT as a tool for operational efficiency and cost savings.
(C) Information can be extracted more efficiently from databases and transmitted to relevant applications for in-depth analytics.
This relates more to big data and data analytics, not necessarily IoT.
IIA GTAG "Auditing IT Governance" discusses IoT in operational efficiency but distinguishes it from data extraction.
(D) Data mining and data collection from the internet and social networks is easier, and the results are more comprehensive.
This describes AI and machine learning rather than IoT, which primarily connects physical devices.
IIA GTAG "Auditing Cybersecurity Risk" highlights IoT risks but does not emphasize social media data mining.
IIA GTAG (Global Technology Audit Guide) - "Auditing IT Governance"
IIA GTAG - "Assessing the Governance of Risks in IT Projects"
IIA Standard 2110 - Governance
IIA GTAG - "Auditing Cybersecurity Risk"
Analysis of Answer Choices:IIA References:Thus, the most appropriate answer is B because IoT improves efficiency by automating energy consumption based on market conditions.
(A) Employees can choose from a variety of devices they want to utilize to privately read work emails without their employer's knowledge.
This is incorrect because it focuses on unauthorized access rather than a benefit of IoT. Security and monitoring are major concerns in IoT environments.
IIA Standard 2110 - Governance requires organizations to ensure adequate governance structures for IT and data security.
(B) Physical devices, such as thermostats and heat pumps, can be set to react to electricity market changes and reduce costs. # This is correct because IoT enables smart devices to automatically adjust based on real-time data.
Example: Smart thermostats (e.g., Nest, Honeywell) use IoT to track energy prices and consumption, adjusting temperatures to optimize efficiency.
IIA Practice Guide "Assessing the Governance of Risks in IT Projects" highlights IoT as a tool for operational efficiency and cost savings.
(C) Information can be extracted more efficiently from databases and transmitted to relevant applications for in-depth analytics.
This relates more to big data and data analytics, not necessarily IoT.
IIA GTAG "Auditing IT Governance" discusses IoT in operational efficiency but distinguishes it from data extraction.
(D) Data mining and data collection from the internet and social networks is easier, and the results are more comprehensive.
This describes AI and machine learning rather than IoT, which primarily connects physical devices.
IIA GTAG "Auditing Cybersecurity Risk" highlights IoT risks but does not emphasize social media data mining.
IIA GTAG (Global Technology Audit Guide) - "Auditing IT Governance"
IIA GTAG - "Assessing the Governance of Risks in IT Projects"
IIA Standard 2110 - Governance
IIA GTAG - "Auditing Cybersecurity Risk"
Analysis of Answer Choices:IIA References:Thus, the most appropriate answer is B because IoT improves efficiency by automating energy consumption based on market conditions.
IIA-CIA-Part3-KR 문제 102
미국에 글로벌 본사가 있는 조직은 다른 8개국에 자회사를 두고 있습니다. 조직이 자민족 중심적 태도로 운영되는 경우 다음 설명 중 옳은 것은?
정답: B
An ethnocentric attitude in global business means that the parent company (headquarters) makes all key decisions and expects its foreign subsidiaries to follow directives without much autonomy. This approach often results in centralized control, standardized policies, and minimal local input.
(A) Standards used for evaluation and control are determined at local subsidiaries, not set by headquarters.
Incorrect. In an ethnocentric organization, standards and controls are determined by headquarters, not by local subsidiaries.
IIA Standard 2120 - Risk Management emphasizes that corporate governance should ensure consistent policies across all locations, which aligns with ethnocentric approaches.
(B) Orders, commands, and advice are sent to the subsidiaries from headquarters. # Correct. In ethnocentric organizations, decision-making authority is centralized at headquarters, and subsidiaries are expected to follow orders and policies without deviation.
IIA GTAG "Auditing Global Operations" discusses risks related to centralized control structures, where headquarters enforces policies globally.
(C) People of local nationality are developed for the best positions within their own country.
Incorrect. This describes a polycentric approach, where local talent is developed for leadership roles.
Ethnocentric organizations prefer to assign expatriates from headquarters to key positions in subsidiaries.
(D) There is a significant amount of collaboration between headquarters and subsidiaries.
Incorrect. Collaboration is more common in geocentric or regiocentric models, where decision-making is shared. Ethnocentric organizations have limited collaboration, as headquarters dictates policies.
IIA GTAG - "Auditing Global Operations"
IIA Standard 2120 - Risk Management
COSO Framework - Internal Control and Corporate Governance
Analysis of Answer Choices:IIA References:Thus, the correct answer is B, as ethnocentric organizations enforce top-down control, sending orders, commands, and advice to subsidiaries.
(A) Standards used for evaluation and control are determined at local subsidiaries, not set by headquarters.
Incorrect. In an ethnocentric organization, standards and controls are determined by headquarters, not by local subsidiaries.
IIA Standard 2120 - Risk Management emphasizes that corporate governance should ensure consistent policies across all locations, which aligns with ethnocentric approaches.
(B) Orders, commands, and advice are sent to the subsidiaries from headquarters. # Correct. In ethnocentric organizations, decision-making authority is centralized at headquarters, and subsidiaries are expected to follow orders and policies without deviation.
IIA GTAG "Auditing Global Operations" discusses risks related to centralized control structures, where headquarters enforces policies globally.
(C) People of local nationality are developed for the best positions within their own country.
Incorrect. This describes a polycentric approach, where local talent is developed for leadership roles.
Ethnocentric organizations prefer to assign expatriates from headquarters to key positions in subsidiaries.
(D) There is a significant amount of collaboration between headquarters and subsidiaries.
Incorrect. Collaboration is more common in geocentric or regiocentric models, where decision-making is shared. Ethnocentric organizations have limited collaboration, as headquarters dictates policies.
IIA GTAG - "Auditing Global Operations"
IIA Standard 2120 - Risk Management
COSO Framework - Internal Control and Corporate Governance
Analysis of Answer Choices:IIA References:Thus, the correct answer is B, as ethnocentric organizations enforce top-down control, sending orders, commands, and advice to subsidiaries.
IIA-CIA-Part3-KR 문제 103
내부 감사팀은 협력업체 직원 여러 명이 내부 자산 관리 시스템에 원격으로 접근할 수 있는 권한을 부여받았다는 사실을 발견했습니다.
감사인은 다음 중 무엇을 결정해야 할까요?
감사인은 다음 중 무엇을 결정해야 할까요?
정답: A
The auditor should first determine whether there is a documented business need for the vendor employees' remote access. Access should be granted only when justified by a legitimate operational requirement and supported by authorization. Once the business need is confirmed, the auditor can assess whether access is appropriately limited, monitored, and revoked when no longer needed. Read-only access may still be excessive if no business need exists. Immediately identifying who should remove access is premature without determining whether access is valid. Device management is important but secondary to confirming need and authorization. Internal auditors reviewing third-party access should evaluate business justification, approval, least privilege, authentication, monitoring, and periodic recertification. Therefore, Option A is correct.
IIA-CIA-Part3-KR 문제 104
급여 시스템을 감사하는 동안 내부 감사인은 다음 조건을 식별하고 문서화합니다.
"사용자가 시스템에 로그인하면 사용자는 시스템 내의 모든 기능에 액세스할 수 있습니다." 주석 문제의 가장 가능성 있는 근본 원인은 무엇입니까?
"사용자가 시스템에 로그인하면 사용자는 시스템 내의 모든 기능에 액세스할 수 있습니다." 주석 문제의 가장 가능성 있는 근본 원인은 무엇입니까?
정답: B
The issue described suggests a systemic authorization flaw, where users gain unrestricted access once logged in. This points to an improperly configured authorization system, which should enforce role-based or least- privilege access to restrict users based on their job responsibilities.
(A) Incorrect - The authentication process relies on a simple password only, which is a weak method of authorization.
While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.
(B) Correct - The system authorization of the user does not correctly reflect the access rights intended.
The problem is that users have access to all functionality, which indicates an authorization issue, not an authentication flaw.
Proper role-based access controls (RBAC) should limit user permissions based on job functions.
(C) Incorrect - There was no periodic review to validate access rights.
While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.
(D) Incorrect - The application owner apparently did not approve the access request during the provisioning process.
Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.
IIA's GTAG (Global Technology Audit Guide) - Access Control and Authorization Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.
COBIT Framework - IT Security Governance
Discusses proper authorization mechanisms to align system access with business needs.
NIST Cybersecurity Framework - Access Management Controls
Recommends restricting access rights based on the principle of least privilege (PoLP).
Analysis of Answer Choices:IIA References and Internal Auditing Standards:
(A) Incorrect - The authentication process relies on a simple password only, which is a weak method of authorization.
While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.
(B) Correct - The system authorization of the user does not correctly reflect the access rights intended.
The problem is that users have access to all functionality, which indicates an authorization issue, not an authentication flaw.
Proper role-based access controls (RBAC) should limit user permissions based on job functions.
(C) Incorrect - There was no periodic review to validate access rights.
While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.
(D) Incorrect - The application owner apparently did not approve the access request during the provisioning process.
Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.
IIA's GTAG (Global Technology Audit Guide) - Access Control and Authorization Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.
COBIT Framework - IT Security Governance
Discusses proper authorization mechanisms to align system access with business needs.
NIST Cybersecurity Framework - Access Management Controls
Recommends restricting access rights based on the principle of least privilege (PoLP).
Analysis of Answer Choices:IIA References and Internal Auditing Standards:
IIA-CIA-Part3-KR 문제 105
경영진과의 회의를 통해 조직의 최고감사책임자(CAE)가 정해진 위험 허용 범위를 초과하는 위험을 알게 되었습니다. CAE가 취해야 할 적절한 다음 조치는 무엇일까요?
정답: B
The CAE should first discuss the risk and its implications with the responsible management. This provides management the opportunity to reassess, take corrective action, or explain their position. If the issue remains unresolved and the risk is still deemed excessive, then escalation to senior management or the board may follow.
Option A (designing response) is management's role. Option C (scheduling an audit) may be relevant later, but immediate discussion is the first step. Option D is premature without first engaging management.
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.
Option A (designing response) is management's role. Option C (scheduling an audit) may be relevant later, but immediate discussion is the first step. Option D is premature without first engaging management.
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.
- 다른 버전
- 1879IIA.IIA-CIA-Part3-KR.v2026-05-02.q255
- 1635IIA.IIA-CIA-Part3-KR.v2026-02-16.q207
- 2549IIA.IIA-CIA-Part3-KR.v2025-04-09.q203
- 최근 업로드
- 291PMI.PMP-KR.v2026-08-21.q927
- 151PMI.PMP-KR.v2026-08-21.q86
- 154Microsoft.DP-420-KR.v2026-08-21.q96
- 160Microsoft.AZ-900-KR.v2026-08-21.q220
- 165Microsoft.DP-700-KR.v2026-08-20.q47
- 517ISC.CISSP-KR.v2026-08-20.q862
- 215Microsoft.SC-100-KR.v2026-08-20.q141
- 267Microsoft.AZ-305-KR.v2026-08-20.q223
- 893IIA.IIA-CIA-Part1-KR.v2026-08-19.q374
- 1378IIA.IIA-CIA-Part3-KR.v2026-08-19.q374
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-08-19.q374 모의시험 시험자료를 다운 받으세요.