CISA-KR 문제 11
An employee is induced to reveal confidential IP addresses and passwords by answering questions over the phone. This is a social engineering attack method that exploits the trust or curiosity of the employee to obtain sensitive information that can be used to access or compromise the network. According to the web search results, social engineering is a technique that uses psychological manipulation to trick users into making security mistakes or giving away sensitive information1. Phishing, whaling, baiting, and pretexting are some of the common forms of social engineering attacks2. Social engineering attacks are often more effective and profitable than purely technical attacks, as they rely on human error rather than system vulnerabilities
CISA-KR 문제 12
An external assessment of network vulnerability is a process of identifying and evaluating the weaknesses and risks that affect the security and availability of a network from an outsider's perspective. The most important factor to verify during this process is the completeness of network asset inventory, which is a list of all the devices, systems, and software that are connected to or part of the network. A complete and accurate network asset inventory can help identify the scope and boundaries of the network, the potential attack vectors and entry points, the critical assets and dependencies, and the existing security controls and gaps. Without a complete network asset inventory, an external assessment of network vulnerability may miss some important assets or vulnerabilities, leading to inaccurate or incomplete results and recommendations.
References:
1 explains what is an external vulnerability scan and why it is important to have a complete network asset inventory.
2 provides a guide on how to conduct a full network vulnerability assessment and emphasizes the importance of knowing the network assets.
3 compares internal and external vulnerability scanning and highlights the need for a comprehensive network asset inventory for both types.
CISA-KR 문제 13
A benefits realization process is a systematic way of identifying, defining, planning, tracking and realizing the benefits from a project or program. Benefits are the measurable improvements that result from the delivery of project outputs and outcomes. Benefits realization management (BRM) is the practice of ensuring that benefits are derived from outputs and outcomes.
One of the best practices for BRM is to select metrics for the project before it begins. Metrics are the indicators that measure the performance and value of the project and its benefits. By selecting metrics in advance, the project team can align the project objectives with the expected benefits, establish a baseline for comparison, and monitor and evaluate the progress and results of the project. Metrics also help to communicate the value of the project to stakeholders and justify the investment.
The other options are not as effective as selecting metrics before the project begins. Project budget is an important factor for BRM, but it does not enable the benefits realization process by itself. It only reflects the costs of executing the project and delivering the solution, not the benefits or value that are expected from them. Estimates of business benefits are useful for planning and forecasting, but they are not sufficient for BRM. They need to be validated by actual data and evidence from similar projects or other sources. Metrics are evaluated after the project has been implemented, but this is only one part of the benefits realization process. BRM requires continuous monitoring and evaluation throughout the project life cycle and beyond, to ensure that benefits are sustained and optimized.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 3261
PMI, Benefits Realization Management: A Practice Guide, 20192
APM, What is benefits management and project success?, 20213
CISA-KR 문제 14
The most important thing for an IS auditor to verify when reviewing the use of an outsourcer for disposal of storage media is that the vendor's process appropriately sanitizes the media before disposal. As explained in the previous question, storage media may contain sensitive or confidential information that needs to be protected from unauthorized access, disclosure, or misuse. The IS auditor should verify that the vendor has a process that appropriately sanitizes the media before disposal, such as wiping, degaussing, shredding, or incinerating, and that the process is effective and compliant with the organization's policies and standards. The other options are not as important as verifying the vendor's process, because they either do not ensure the security and privacy of the information on the media, or they are secondary to the vendor's process.
References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.7
CISA-KR 문제 15
The auditor's best recommendation prior to go-live is to conduct a mock conversion test. This is because a mock conversion test can help to verify the accuracy, completeness, and validity of the data conversion process. A mock conversion test can also help to identify and resolve any issues or errors before the actual conversion takes place. A mock conversion test can also provide assurance that the converted data meets the business requirements and expectations. References:
CISA Review Manual (Digital Version), Chapter 3, Section 3.3.21
CISA Online Review Course, Domain 2, Module 2, Lesson 22
- 다른 버전
- 2269ISACA.CISA-KR.v2026-08-27.q676
- 4287ISACA.CISA-KR.v2026-08-15.q712
- 6803ISACA.CISA-KR.v2026-05-16.q709
- 2703ISACA.CISA-KR.v2026-05-06.q261
- 4557ISACA.CISA-KR.v2026-03-16.q665
- 6497ISACA.CISA-KR.v2026-03-07.q651
- 10939ISACA.CISA-KR.v2025-04-07.q633
- 5649ISACA.CISA-KR.v2025-04-03.q628
- 4706ISACA.CISA-KR.v2025-04-02.q544
- 5241ISACA.CISA-KR.v2025-03-31.q534
- 6617ISACA.CISA-KR.v2025-03-28.q617
- 4241ISACA.CISA-KR.v2025-03-19.q581
- 5383ISACA.CISA-KR.v2025-03-03.q807
- 5954ISACA.CISA-KR.v2024-02-07.q421
- 5907ISACA.CISA-KR.v2023-10-24.q329
- 5698ISACA.CISA-KR.v2023-07-31.q266
- 3755ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 122Microsoft.AB-210.v2026-10-14.q58
- 120Huawei.H12-893_V1.0.v2026-10-14.q46
- 133UiPath.UiPath-ADPv1.v2026-10-14.q114
- 133Salesforce.MCE-Dev-201.v2026-10-14.q64
- 121PMI.PMI-RMP.v2026-10-14.q125
- 171HP.HPE7-A01.v2026-10-13.q163
- 134PaloAltoNetworks.XDR-Analyst.v2026-10-13.q30
- 145Snowflake.DAA-C01.v2026-10-13.q66
- 151Salesforce.Salesforce-Loyalty-Management.v2026-10-13.q71
- 141Oracle.1z0-1033-25.v2026-10-13.q44
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-01-31.q392 모의시험 시험자료를 다운 받으세요.