CISA-KR 문제 306
다음 중 전략적 프로그램 관리를 용이하게 하는 가장 좋은 것은 무엇입니까?
정답: C
Explanation
The best option that facilitates strategic program management is aligning projects with business portfolios (option C). This is because:
Strategic program management is the coordinated planning, management, and execution of multiple related projects that are directed toward the same strategic goals12.
Aligning projects with business portfolios means ensuring that the projects within a program are aligned with the organization's strategic objectives, vision, and mission .
Aligning projects with business portfolios helps to prioritize the most valuable and impactful projects, optimize the allocation of resources, monitor the progress and performance of the program, and deliver the expected benefits and outcomes .
Implementing stage gates (option A) is a process of reviewing and approving projects at predefined points in their lifecycle to ensure that they meet the quality, scope, time, and cost criteria. While this can help to control and improve the project management process, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Establishing a quality assurance (QA) process (option B) is a process of ensuring that the project deliverables meet the quality standards and requirements of the stakeholders. While this can help to enhance the quality and satisfaction of the project outcomes, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Tracking key project milestones (option D) is a process of monitoring and reporting the completion of significant events or deliverables in a project. While this can help to measure and communicate the progress and status of the project, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Therefore, the best option that facilitates strategic program management is aligning projects with business portfolios (option C), as this ensures that the projects within a program are consistent with the organization's strategic goals and objectives.
References: 1: Program Management: The Key to Strategic Execution 2: The Ultimate Guide to Program Management [2023] * Asana : Project Portfolio Management - PMI : Aligning Projects with Strategy - Harvard Business Review : What Is Stage-Gate Process? - ProjectManager.com : Quality Assurance in Project Management - PMI : What Is a Milestone in Project Management? - TeamGantt
The best option that facilitates strategic program management is aligning projects with business portfolios (option C). This is because:
Strategic program management is the coordinated planning, management, and execution of multiple related projects that are directed toward the same strategic goals12.
Aligning projects with business portfolios means ensuring that the projects within a program are aligned with the organization's strategic objectives, vision, and mission .
Aligning projects with business portfolios helps to prioritize the most valuable and impactful projects, optimize the allocation of resources, monitor the progress and performance of the program, and deliver the expected benefits and outcomes .
Implementing stage gates (option A) is a process of reviewing and approving projects at predefined points in their lifecycle to ensure that they meet the quality, scope, time, and cost criteria. While this can help to control and improve the project management process, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Establishing a quality assurance (QA) process (option B) is a process of ensuring that the project deliverables meet the quality standards and requirements of the stakeholders. While this can help to enhance the quality and satisfaction of the project outcomes, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Tracking key project milestones (option D) is a process of monitoring and reporting the completion of significant events or deliverables in a project. While this can help to measure and communicate the progress and status of the project, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Therefore, the best option that facilitates strategic program management is aligning projects with business portfolios (option C), as this ensures that the projects within a program are consistent with the organization's strategic goals and objectives.
References: 1: Program Management: The Key to Strategic Execution 2: The Ultimate Guide to Program Management [2023] * Asana : Project Portfolio Management - PMI : Aligning Projects with Strategy - Harvard Business Review : What Is Stage-Gate Process? - ProjectManager.com : Quality Assurance in Project Management - PMI : What Is a Milestone in Project Management? - TeamGantt
CISA-KR 문제 307
다음 중 조직의 비즈니스 연속성 계획(BCP)을 검토할 때 IS 감사인의 가장 큰 관심사는 무엇입니까?
정답: A
Explanation
A business continuity plan (BCP) is a document that outlines how an organization will continue its critical functions in the event of a disruption or disaster. A BCP should include the following elements1:
Business impact analysis: This is the process of identifying and prioritizing the key business processes and assets that are essential for the organization's survival and recovery.
Risk assessment: This is the process of identifying and evaluating the potential threats and vulnerabilities that could affect the organization's business continuity.
Recovery strategies: These are the actions and procedures that the organization will implement to restore its normal operations as quickly and effectively as possible after a disruption or disaster.
Recovery objectives: These are the metrics that define the acceptable level of recovery for the organization's business processes and assets. The two main recovery objectives are:
Recovery point objective (RPO): This is the maximum amount of data loss that the organization can tolerate in terms of time. For example, an RPO of one hour means that the organization can afford to lose up to one hour's worth of data after a disruption or disaster.
Recovery time objective (RTO): This is the maximum amount of time that the organization can tolerate to restore its normal operations after a disruption or disaster. For example, an RTO of four hours means that the organization must resume its normal operations within four hours after a disruption or disaster.
Testing and validation: This is the process of verifying and evaluating the effectiveness and efficiency of the BCP and its components. Testing and validation can include various methods, such as:
Tabletop exercises: These are discussion-based sessions where team members meet in an informal setting to review and discuss their roles and responsibilities during a disruption or disaster scenario. A facilitator guides participants through a discussion of one or more scenarios2.
Simulation exercises: These are more realistic and interactive sessions where team members perform their roles and responsibilities during a simulated disruption or disaster scenario. A facilitator controls and monitors the simulation and injects events and challenges3.
Full-scale exercises: These are the most complex and realistic sessions where team members perform their roles and responsibilities during a real-life disruption or disaster scenario. A facilitator coordinates and evaluates the exercise with external stakeholders, such as emergency services, media, or customers4.
As an IS auditor, your greatest concern when reviewing the organization's BCP would be A. The recovery plan does not contain the process and application dependencies.
A business continuity plan (BCP) is a document that outlines how an organization will continue its critical functions in the event of a disruption or disaster. A BCP should include the following elements1:
Business impact analysis: This is the process of identifying and prioritizing the key business processes and assets that are essential for the organization's survival and recovery.
Risk assessment: This is the process of identifying and evaluating the potential threats and vulnerabilities that could affect the organization's business continuity.
Recovery strategies: These are the actions and procedures that the organization will implement to restore its normal operations as quickly and effectively as possible after a disruption or disaster.
Recovery objectives: These are the metrics that define the acceptable level of recovery for the organization's business processes and assets. The two main recovery objectives are:
Recovery point objective (RPO): This is the maximum amount of data loss that the organization can tolerate in terms of time. For example, an RPO of one hour means that the organization can afford to lose up to one hour's worth of data after a disruption or disaster.
Recovery time objective (RTO): This is the maximum amount of time that the organization can tolerate to restore its normal operations after a disruption or disaster. For example, an RTO of four hours means that the organization must resume its normal operations within four hours after a disruption or disaster.
Testing and validation: This is the process of verifying and evaluating the effectiveness and efficiency of the BCP and its components. Testing and validation can include various methods, such as:
Tabletop exercises: These are discussion-based sessions where team members meet in an informal setting to review and discuss their roles and responsibilities during a disruption or disaster scenario. A facilitator guides participants through a discussion of one or more scenarios2.
Simulation exercises: These are more realistic and interactive sessions where team members perform their roles and responsibilities during a simulated disruption or disaster scenario. A facilitator controls and monitors the simulation and injects events and challenges3.
Full-scale exercises: These are the most complex and realistic sessions where team members perform their roles and responsibilities during a real-life disruption or disaster scenario. A facilitator coordinates and evaluates the exercise with external stakeholders, such as emergency services, media, or customers4.
As an IS auditor, your greatest concern when reviewing the organization's BCP would be A. The recovery plan does not contain the process and application dependencies.
CISA-KR 문제 308
SQL 인젝션 취약점을 해결하기 위한 최선의 제어는 무엇입니까?
정답: C
Explanation
Input validation is the best control to address SQL injection vulnerabilities, because it can prevent malicious users from entering SQL commands or statements into input fields that are intended for data entry, such as usernames or passwords. SQL injection is a technique that exploits a security vulnerability in an application's software by inserting SQL code into a query string that can execute commands on a database server. Unicode translation, SSL encryption, and digital signatures are not effective controls against SQL injection, because they do not prevent or detect SQL code injection into input fields. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.2
Input validation is the best control to address SQL injection vulnerabilities, because it can prevent malicious users from entering SQL commands or statements into input fields that are intended for data entry, such as usernames or passwords. SQL injection is a technique that exploits a security vulnerability in an application's software by inserting SQL code into a query string that can execute commands on a database server. Unicode translation, SSL encryption, and digital signatures are not effective controls against SQL injection, because they do not prevent or detect SQL code injection into input fields. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.2
CISA-KR 문제 309
IS 감사인은 여러 사업부에 서비스를 제공하는 IT 조직이 모든 이니셔티브에 동일한 우선 순위를 할당하여 프로젝트 자금 확보가 지연될 위험이 있음을 발견했습니다. 비즈니스 목표를 지원합니까?
정답: D
Explanation
The most helpful tool in matching demand for projects and services with available resources in a way that supports business objectives is portfolio management. Portfolio management is the process of selecting, prioritizing, balancing and aligning IT projects and services with the strategic goals and value proposition of the organization3. Portfolio management helps the IT organization to allocate resources efficiently and effectively, to deliver value to the business units, and to align IT initiatives with business strategies. Project management, risk assessment results and IT governance framework are also important tools, but they are not as helpful as portfolio management in matching demand and supply of IT projects and services. References:
CISA Review Manual, 27th Edition, page 721
CISA Review Questions, Answers & Explanations Database - 12 Month Subscription
The most helpful tool in matching demand for projects and services with available resources in a way that supports business objectives is portfolio management. Portfolio management is the process of selecting, prioritizing, balancing and aligning IT projects and services with the strategic goals and value proposition of the organization3. Portfolio management helps the IT organization to allocate resources efficiently and effectively, to deliver value to the business units, and to align IT initiatives with business strategies. Project management, risk assessment results and IT governance framework are also important tools, but they are not as helpful as portfolio management in matching demand and supply of IT projects and services. References:
CISA Review Manual, 27th Edition, page 721
CISA Review Questions, Answers & Explanations Database - 12 Month Subscription
CISA-KR 문제 310
개인정보의 보유 기간 및 파기 조건은 회사가 정합니다.
정답: D
Explanation
The business owner is the person or entity that has the authority and responsibility for defining the purpose and scope of the processing of personal data, as well as the expected outcomes and benefits. The business owner is also accountable for ensuring that the processing of personal data complies with the applicable laws and regulations, such as the General Data Protection Regulation (GDPR) or the Data Protection Act 2018 (DPA 2018).
One of the requirements of the GDPR and the DPA 2018 is to adhere to the principle of storage limitation, which states that personal data should be kept for no longer than is necessary for the purposes for which it is processed1. This means that the business owner should determine and justify how long they need to retain personal data, based on factors such as:
The nature and sensitivity of the personal data
The legal or contractual obligations or rights that apply to the personal data The business or operational needs and expectations that depend on the personal data The risks and impacts that may arise from retaining or deleting the personal data The business owner should also establish and document the conditions and methods for the destruction of personal data, such as:
The criteria and triggers for deciding when to destroy personal data
The procedures and tools for securely erasing or anonymising personal data The roles and responsibilities for carrying out and overseeing the destruction of personal data The records and reports for verifying and evidencing the destruction of personal data Therefore, retention periods and conditions for the destruction of personal data should be determined by the business owner, as they are in charge of defining and managing the processing of personal data, as well as ensuring its compliance with the law.
The business owner is the person or entity that has the authority and responsibility for defining the purpose and scope of the processing of personal data, as well as the expected outcomes and benefits. The business owner is also accountable for ensuring that the processing of personal data complies with the applicable laws and regulations, such as the General Data Protection Regulation (GDPR) or the Data Protection Act 2018 (DPA 2018).
One of the requirements of the GDPR and the DPA 2018 is to adhere to the principle of storage limitation, which states that personal data should be kept for no longer than is necessary for the purposes for which it is processed1. This means that the business owner should determine and justify how long they need to retain personal data, based on factors such as:
The nature and sensitivity of the personal data
The legal or contractual obligations or rights that apply to the personal data The business or operational needs and expectations that depend on the personal data The risks and impacts that may arise from retaining or deleting the personal data The business owner should also establish and document the conditions and methods for the destruction of personal data, such as:
The criteria and triggers for deciding when to destroy personal data
The procedures and tools for securely erasing or anonymising personal data The roles and responsibilities for carrying out and overseeing the destruction of personal data The records and reports for verifying and evidencing the destruction of personal data Therefore, retention periods and conditions for the destruction of personal data should be determined by the business owner, as they are in charge of defining and managing the processing of personal data, as well as ensuring its compliance with the law.
프리미엄 번들
DumpTop 에서 공유하는 최신 CISA-KR 시험 덤프는 CISA-KR 시험패스를 도와드릴수 있습니다! DumpTop 은 최근 업데이트된 CISA-KR 시험자료를 제공해드립니다. DumpTop CISA-KR 덤프도 시험문제 변경에 따라 업데이트되었으며 오답도 수정되었습니다. DumpTop CISA-KR 덤프 최신버전을 공유받아보세요.
(1562 Q&As 덤프, 30%OFF할인코드: KrDump)
- 다른 버전
- 4005ISACA.CISA-KR.v2026-05-16.q709
- 1797ISACA.CISA-KR.v2026-05-06.q261
- 3121ISACA.CISA-KR.v2026-03-16.q665
- 4489ISACA.CISA-KR.v2026-03-07.q651
- 9220ISACA.CISA-KR.v2025-04-07.q633
- 4453ISACA.CISA-KR.v2025-04-03.q628
- 3680ISACA.CISA-KR.v2025-04-02.q544
- 4222ISACA.CISA-KR.v2025-03-31.q534
- 5321ISACA.CISA-KR.v2025-03-28.q617
- 3152ISACA.CISA-KR.v2025-03-19.q581
- 3985ISACA.CISA-KR.v2025-03-03.q807
- 5135ISACA.CISA-KR.v2024-02-07.q421
- 5275ISACA.CISA-KR.v2023-10-24.q329
- 5215ISACA.CISA-KR.v2023-07-31.q266
- 3123ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 116Microsoft.AZ-305-KR.v2026-08-14.q177
- 155Microsoft.DP-900-KR.v2026-08-13.q130
- 244Microsoft.PL-600.v2026-08-11.q206
- 183Microsoft.DP-100.v2026-08-11.q160
- 177Oracle.1Z0-1048-25.v2026-08-11.q68
- 145ISQI.CTAL-TAE.v2026-08-11.q37
- 195ServiceNow.CIS-HR.v2026-08-11.q84
- 259Salesforce.Plat-Arch-201.v2026-08-10.q101
- 245Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 192F5.F5CAB2.v2026-08-10.q41
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-01-31.q392 모의시험 시험자료를 다운 받으세요.