IIA-CIA-Part3-KR 문제 281
위험 관리 방식 중 가장 효과가 떨어지는 것은 무엇입니까?
정답: D
Preventive controls are generally stronger than detective controls because they stop errors, fraud, or noncompliance before they occur. Systems-based controls are also usually more reliable than people-based controls because automated controls operate consistently, are less subject to fatigue or judgment errors, and can be embedded directly into business processes. A systems-based preventive control is therefore typically the strongest form. A people-based detective control is the weakest because it depends on individuals noticing an issue after it has already occurred and then responding appropriately. Such controls are vulnerable to oversight, workload pressure, poor training, bias, or intentional override. From an internal audit perspective, people-based detective controls may still be useful, but they provide weaker risk management assurance than automated or preventive controls. Therefore, Option D is correct.
IIA-CIA-Part3-KR 문제 282
IT에 대한 lIA 지침에 따르면 다음 계획 중 중요한 비즈니스 프로세스 식별과 복구 시간 목표를 연결하는 계획은 무엇입니까?
정답: C
The Business Impact Analysis (BIA) plan is a key component of business continuity planning that identifies critical business processes and determines their Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
* Correct Answer (C - Business Impact Analysis Plan)
* The BIA is a systematic process that identifies essential functions, assesses potential disruptions, and determines the recovery time requirements to ensure business continuity.
* The Recovery Time Objective (RTO) defines the maximum acceptable downtime for critical business functions.
* The Recovery Point Objective (RPO) identifies how much data loss is tolerable.
* According to the IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management, a BIA is essential for assessing the financial, operational, and reputational impact of disruptions.
* Why Other Options Are Incorrect:
* Option A (Business Continuity Management Charter):
* A charter defines the governance, responsibilities, and overall framework of business continuity but does not focus on RTOs or critical business processes.
* Option B (Business Continuity Risk Assessment Plan):
* A risk assessment identifies threats and vulnerabilities but does not define recovery time objectives.
* While risk assessments inform the BIA, they do not replace it.
* Option D (Business Case for Business Continuity Planning):
* A business case justifies investment in continuity planning but does not map business processes to RTOs.
* GTAG 10: Business Continuity Management - Defines BIA as the process for identifying critical business functions and their RTOs.
* IIA Practice Guide: Auditing Business Continuity - Emphasizes the role of BIA in business resilience.
Step-by-Step Explanation:IIA References for Validation:Thus, the Business Impact Analysis (BIA) Plan (C) is the correct answer because it pairs critical business processes with recovery time objectives.
* Correct Answer (C - Business Impact Analysis Plan)
* The BIA is a systematic process that identifies essential functions, assesses potential disruptions, and determines the recovery time requirements to ensure business continuity.
* The Recovery Time Objective (RTO) defines the maximum acceptable downtime for critical business functions.
* The Recovery Point Objective (RPO) identifies how much data loss is tolerable.
* According to the IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management, a BIA is essential for assessing the financial, operational, and reputational impact of disruptions.
* Why Other Options Are Incorrect:
* Option A (Business Continuity Management Charter):
* A charter defines the governance, responsibilities, and overall framework of business continuity but does not focus on RTOs or critical business processes.
* Option B (Business Continuity Risk Assessment Plan):
* A risk assessment identifies threats and vulnerabilities but does not define recovery time objectives.
* While risk assessments inform the BIA, they do not replace it.
* Option D (Business Case for Business Continuity Planning):
* A business case justifies investment in continuity planning but does not map business processes to RTOs.
* GTAG 10: Business Continuity Management - Defines BIA as the process for identifying critical business functions and their RTOs.
* IIA Practice Guide: Auditing Business Continuity - Emphasizes the role of BIA in business resilience.
Step-by-Step Explanation:IIA References for Validation:Thus, the Business Impact Analysis (BIA) Plan (C) is the correct answer because it pairs critical business processes with recovery time objectives.
IIA-CIA-Part3-KR 문제 283
IT 감사자가 새로 구입한 정보 시스템의 IT 제어를 평가하고 있습니다. 감사자는 로깅이 데이터베이스 및 애플리케이션 수준으로 구성되지 않았음을 발견합니다. 운영 관리는 로그를 관리할 인력이 충분하지 않고 로그를 유지하는 데 아무런 이점이 없다고 설명합니다. 다음 응답 중 불충분하거나 없는 로깅 관행과 관련된 위험을 가장 잘 설명하는 것은 무엇입니까?
정답: C
Logging at the database and application levels is a critical security control that enables monitoring, detecting, and investigating potential security incidents. The absence of logging significantly increases cybersecurity risks and can leave an organization vulnerable to undetected attacks.
Incident Response & Forensics: Without logs, the organization will be unable to determine the cause, origin, and impact of cyber incidents or system intrusions.
Compliance Requirements: Many regulatory frameworks (e.g., ISO 27001, NIST 800-53, GDPR, PCI-DSS, SOX) require logging for security monitoring and auditability.
Threat Detection: Logs help in identifying malicious activities, unauthorized access, and data breaches.
Accountability: Ensures that actions taken within the system can be traced back to specific users or administrators.
Option A (The organization will be unable to develop preventative actions based on analytics): While logging helps in analytics, its primary function is incident detection and forensic investigation.
Option B (The organization will not be able to trace and monitor the activities of database administrators):
This is partially correct, but logging is not just for administrators-it is essential for monitoring all system activities, including unauthorized access attempts.
Option D (The organization will be unable to upgrade the system to newer versions): Logging does not impact system upgrades; upgrades are related to software lifecycle management, not logging practices.
IIA's Global Technology Audit Guide (GTAG) - Information Security Controls recommends logging as a fundamental security control.
IIA Standard 2110 - IT Governance: Emphasizes the need for adequate IT risk management, including logging.
COSO Framework (Monitoring Component): Highlights the importance of system monitoring, which includes logging.
Why Option C is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is C. The organization will be unable to determine why intrusions and cyber incidents took place.
Incident Response & Forensics: Without logs, the organization will be unable to determine the cause, origin, and impact of cyber incidents or system intrusions.
Compliance Requirements: Many regulatory frameworks (e.g., ISO 27001, NIST 800-53, GDPR, PCI-DSS, SOX) require logging for security monitoring and auditability.
Threat Detection: Logs help in identifying malicious activities, unauthorized access, and data breaches.
Accountability: Ensures that actions taken within the system can be traced back to specific users or administrators.
Option A (The organization will be unable to develop preventative actions based on analytics): While logging helps in analytics, its primary function is incident detection and forensic investigation.
Option B (The organization will not be able to trace and monitor the activities of database administrators):
This is partially correct, but logging is not just for administrators-it is essential for monitoring all system activities, including unauthorized access attempts.
Option D (The organization will be unable to upgrade the system to newer versions): Logging does not impact system upgrades; upgrades are related to software lifecycle management, not logging practices.
IIA's Global Technology Audit Guide (GTAG) - Information Security Controls recommends logging as a fundamental security control.
IIA Standard 2110 - IT Governance: Emphasizes the need for adequate IT risk management, including logging.
COSO Framework (Monitoring Component): Highlights the importance of system monitoring, which includes logging.
Why Option C is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is C. The organization will be unable to determine why intrusions and cyber incidents took place.
IIA-CIA-Part3-KR 문제 284
다음 중 조직에서 수립한 새로운 전략적 이니셔티브의 생성 및 홍보의 주요 동인은 무엇입니까?
정답: C
Strategic Initiatives and Their Drivers:
Organizations create and prioritize new strategic initiatives based on internal and external factors that affect their success.
Threats and opportunities, identified through strategic planning and risk assessment, are the primary drivers for launching new initiatives.
This aligns with the SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis framework, which helps organizations identify external risks and growth opportunities.
Why Threats and Opportunities Drive Strategic Initiatives:
Opportunities: Organizations may invest in new products, markets, or technologies to capitalize on emerging trends and gain a competitive edge.
Threats: External challenges such as regulatory changes, market competition, and economic downturns necessitate proactive strategies to mitigate potential risks.
Why Other Options Are Incorrect:
A). Risk tolerance:
While risk tolerance defines an organization's willingness to accept risk, it is not the primary driver for creating new initiatives.
B). Performance:
Performance evaluation helps measure the success of initiatives, but it does not directly drive new strategies.
D). Governance:
Governance ensures oversight and compliance but does not initiate strategic changes unless influenced by external threats and opportunities.
IIA's Perspective on Strategic Planning and Risk Management:
IIA Standard 2010 - Planning states that internal auditors must assess how organizations identify and respond to threats and opportunities when developing strategic initiatives.
COSO Enterprise Risk Management (ERM) Framework highlights that strategic planning should integrate risk management, ensuring that organizations adapt to evolving external conditions.
IIA References:
IIA Standard 2010 - Planning
COSO Enterprise Risk Management (ERM) Framework
SWOT Analysis in Strategic Decision-Making
Thus, the correct and verified answer is C. Threats and opportunities.
Organizations create and prioritize new strategic initiatives based on internal and external factors that affect their success.
Threats and opportunities, identified through strategic planning and risk assessment, are the primary drivers for launching new initiatives.
This aligns with the SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis framework, which helps organizations identify external risks and growth opportunities.
Why Threats and Opportunities Drive Strategic Initiatives:
Opportunities: Organizations may invest in new products, markets, or technologies to capitalize on emerging trends and gain a competitive edge.
Threats: External challenges such as regulatory changes, market competition, and economic downturns necessitate proactive strategies to mitigate potential risks.
Why Other Options Are Incorrect:
A). Risk tolerance:
While risk tolerance defines an organization's willingness to accept risk, it is not the primary driver for creating new initiatives.
B). Performance:
Performance evaluation helps measure the success of initiatives, but it does not directly drive new strategies.
D). Governance:
Governance ensures oversight and compliance but does not initiate strategic changes unless influenced by external threats and opportunities.
IIA's Perspective on Strategic Planning and Risk Management:
IIA Standard 2010 - Planning states that internal auditors must assess how organizations identify and respond to threats and opportunities when developing strategic initiatives.
COSO Enterprise Risk Management (ERM) Framework highlights that strategic planning should integrate risk management, ensuring that organizations adapt to evolving external conditions.
IIA References:
IIA Standard 2010 - Planning
COSO Enterprise Risk Management (ERM) Framework
SWOT Analysis in Strategic Decision-Making
Thus, the correct and verified answer is C. Threats and opportunities.
IIA-CIA-Part3-KR 문제 285
금융 기관은 고객으로부터 계좌에서 자금을 인출해 달라는 다양한 이메일 요청을 자주 받습니다. 기관이 피싱 피해를 입지 않도록 하는 데 가장 도움이 되는 확인 활동은 무엇입니까?
정답: B
Phishing attacks often target financial institutions by impersonating customers and requesting fraudulent fund transfers. The best way to verify such requests is to independently contact the customer using a trusted communication channel, such as the phone number on record.
Verbal confirmation via a trusted number prevents fraudsters from exploiting email spoofing or compromised accounts.
This aligns with industry best practices, including multi-factor verification for high-risk transactions.
A). Reviewing the customer's wire activity to determine whether the request is typical. (Incorrect) While reviewing transaction history can help detect anomalies, fraudsters can mimic previous transaction patterns, making this method unreliable on its own.
B). Calling the customer at the phone number on record to validate the request. (Correct) Direct phone verification ensures that the actual account owner is making the request.
This is a widely recommended anti-fraud measure in financial institutions.
C). Replying to the customer via email to validate the sender and request. (Incorrect) If the email account is compromised, the fraudster will control the response.
Email validation is not secure for financial transactions.
D). Reviewing the customer record to verify whether the customer has authorized wire requests from that email address. (Incorrect) While this can help identify unregistered emails, attackers often spoof or hack real customer emails.
Email-based verification alone is not sufficient.
IIA GTAG 16 - Security Risk: IT and Cybersecurity recommends multi-factor authentication for high-risk financial transactions.
IIA Standard 2120 - Risk Management highlights the need for robust fraud prevention mechanisms, including direct customer verification.
FFIEC (Federal Financial Institutions Examination Council) Cybersecurity Guidelines emphasize the importance of out-of-band authentication for wire transfers.
Explanation of Answer Choices:IIA References:Thus, the correct answer is B. Calling the customer at the phone number on record to validate the request.
Verbal confirmation via a trusted number prevents fraudsters from exploiting email spoofing or compromised accounts.
This aligns with industry best practices, including multi-factor verification for high-risk transactions.
A). Reviewing the customer's wire activity to determine whether the request is typical. (Incorrect) While reviewing transaction history can help detect anomalies, fraudsters can mimic previous transaction patterns, making this method unreliable on its own.
B). Calling the customer at the phone number on record to validate the request. (Correct) Direct phone verification ensures that the actual account owner is making the request.
This is a widely recommended anti-fraud measure in financial institutions.
C). Replying to the customer via email to validate the sender and request. (Incorrect) If the email account is compromised, the fraudster will control the response.
Email validation is not secure for financial transactions.
D). Reviewing the customer record to verify whether the customer has authorized wire requests from that email address. (Incorrect) While this can help identify unregistered emails, attackers often spoof or hack real customer emails.
Email-based verification alone is not sufficient.
IIA GTAG 16 - Security Risk: IT and Cybersecurity recommends multi-factor authentication for high-risk financial transactions.
IIA Standard 2120 - Risk Management highlights the need for robust fraud prevention mechanisms, including direct customer verification.
FFIEC (Federal Financial Institutions Examination Council) Cybersecurity Guidelines emphasize the importance of out-of-band authentication for wire transfers.
Explanation of Answer Choices:IIA References:Thus, the correct answer is B. Calling the customer at the phone number on record to validate the request.
- 다른 버전
- 1865IIA.IIA-CIA-Part3-KR.v2026-05-02.q255
- 1625IIA.IIA-CIA-Part3-KR.v2026-02-16.q207
- 2545IIA.IIA-CIA-Part3-KR.v2025-04-09.q203
- 최근 업로드
- 146Microsoft.DP-700-KR.v2026-08-20.q47
- 214ISC.CISSP-KR.v2026-08-20.q862
- 189Microsoft.SC-100-KR.v2026-08-20.q141
- 221Microsoft.AZ-305-KR.v2026-08-20.q223
- 823IIA.IIA-CIA-Part1-KR.v2026-08-19.q374
- 1313IIA.IIA-CIA-Part3-KR.v2026-08-19.q374
- 180Microsoft.DP-700-KR.v2026-08-19.q59
- 234AMP.CRL.v2026-08-18.q46
- 891Microsoft.AZ-305-KR.v2026-08-17.q162
- 233IIA.IAA-IAP-KR.v2026-08-17.q41
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-08-19.q374 모의시험 시험자료를 다운 받으세요.