CISA-KR 문제 26
다음 중 클라우드 환경에서 데이터 유출 위험이 가장 큰 것은 무엇입니까?
정답: B
Explanation
Multi-tenancy within the same database (B) presents the greatest risk of data leakage in the cloud environment, because it means that multiple customers share the same physical database and resources. This can lead to data isolation and security issues, such as unauthorized access, cross-tenant attacks, or data leakage due to misconfiguration or human error. To prevent data leakage in a multi-tenant database, cloud providers need to implement strict access control policies, encryption, isolation mechanisms, and auditing tools.
Lack of data retention policy (A) is not the greatest risk of data leakage in the cloud environment, because it mainly affects the availability and compliance of data, not its confidentiality or integrity. Data retention policy defines how long data should be stored and when it should be deleted or archived. Without a data retention policy, cloud customers may face legal or regulatory issues, storage costs, or performance degradation.
Lack of role-based access is not the greatest risk of data leakage in the cloud environment, because it can be mitigated by implementing proper authentication and authorization mechanisms. Role-based access control (RBAC) is a security model that assigns permissions and privileges to users based on their roles and responsibilities. Without RBAC, cloud customers may face unauthorized access, privilege escalation, or data misuse.
Expiration of security certificate (D) is not the greatest risk of data leakage in the cloud environment, because it can be easily detected and renewed. A security certificate is a digital document that verifies the identity and authenticity of a website or service. It also enables secure communication using encryption. If a security certificate expires, it may cause trust issues, warning messages, or connection errors, but not necessarily data leakage.
References:
7 Ways to Prevent Data Leaks in the Cloud | OTAVA
An analysis of data leakage and prevention techniques in cloud environment
Multi-tenancy within the same database (B) presents the greatest risk of data leakage in the cloud environment, because it means that multiple customers share the same physical database and resources. This can lead to data isolation and security issues, such as unauthorized access, cross-tenant attacks, or data leakage due to misconfiguration or human error. To prevent data leakage in a multi-tenant database, cloud providers need to implement strict access control policies, encryption, isolation mechanisms, and auditing tools.
Lack of data retention policy (A) is not the greatest risk of data leakage in the cloud environment, because it mainly affects the availability and compliance of data, not its confidentiality or integrity. Data retention policy defines how long data should be stored and when it should be deleted or archived. Without a data retention policy, cloud customers may face legal or regulatory issues, storage costs, or performance degradation.
Lack of role-based access is not the greatest risk of data leakage in the cloud environment, because it can be mitigated by implementing proper authentication and authorization mechanisms. Role-based access control (RBAC) is a security model that assigns permissions and privileges to users based on their roles and responsibilities. Without RBAC, cloud customers may face unauthorized access, privilege escalation, or data misuse.
Expiration of security certificate (D) is not the greatest risk of data leakage in the cloud environment, because it can be easily detected and renewed. A security certificate is a digital document that verifies the identity and authenticity of a website or service. It also enables secure communication using encryption. If a security certificate expires, it may cause trust issues, warning messages, or connection errors, but not necessarily data leakage.
References:
7 Ways to Prevent Data Leaks in the Cloud | OTAVA
An analysis of data leakage and prevention techniques in cloud environment
CISA-KR 문제 27
다음 중 기업 애플리케이션에 시각화 기술을 사용할 때의 주요 이점은 무엇입니까?
정답: B
Explanation
Visualization technology is the use of software and hardware to create graphical representations of data, such as charts, graphs, maps, images, etc. Visualization technology can help users to understand, analyze, and communicate complex and large amounts of data in an intuitive and engaging way1.
One of the primary advantages of using visualization technology for corporate applications is that it can improve the utilization of resources, such as time, money, human capital, and physical assets. Some of the ways that visualization technology can achieve this are:
Visualization technology can help users to quickly and easily explore, filter, and interact with data, reducing the need for manual data processing and analysis1. This can save time and effort for both data producers and consumers, and allow them to focus on more value-added tasks.
Visualization technology can help users to discover patterns, trends, outliers, correlations, and causations in data that may otherwise be hidden or overlooked in traditional reports or tables1. This can enable users to make better and faster decisions based on data-driven insights, and optimize their strategies and actions accordingly.
Visualization technology can help users to communicate and share data more effectively and persuasively with different audiences, such as customers, partners, investors, regulators, etc1. This can enhance the reputation and credibility of the organization, and foster collaboration and innovation among stakeholders.
Visualization technology can help users to monitor and measure the performance and impact of their activities, products, services, or processes1. This can help users to identify problems or opportunities for improvement, and adjust their plans or actions accordingly.
Visualization technology can help users to create engaging and interactive experiences for their customers or end-users1. This can increase customer satisfaction and loyalty, and generate more revenue or value for the organization.
Therefore, using visualization technology for corporate applications can help organizations to better utilize their resources and achieve their goals.
References:
ISACA, CISA Review Manual, 27th Edition, 2019
ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription TechRadar Blog, Best data visualization tools of 20232 IBM Blog, What is Data Visualization?3 TDWI Blog, Data Visualization Technology4 Tableau Blog, What are the advantages and disadvantages of data visualization?
Visualization technology is the use of software and hardware to create graphical representations of data, such as charts, graphs, maps, images, etc. Visualization technology can help users to understand, analyze, and communicate complex and large amounts of data in an intuitive and engaging way1.
One of the primary advantages of using visualization technology for corporate applications is that it can improve the utilization of resources, such as time, money, human capital, and physical assets. Some of the ways that visualization technology can achieve this are:
Visualization technology can help users to quickly and easily explore, filter, and interact with data, reducing the need for manual data processing and analysis1. This can save time and effort for both data producers and consumers, and allow them to focus on more value-added tasks.
Visualization technology can help users to discover patterns, trends, outliers, correlations, and causations in data that may otherwise be hidden or overlooked in traditional reports or tables1. This can enable users to make better and faster decisions based on data-driven insights, and optimize their strategies and actions accordingly.
Visualization technology can help users to communicate and share data more effectively and persuasively with different audiences, such as customers, partners, investors, regulators, etc1. This can enhance the reputation and credibility of the organization, and foster collaboration and innovation among stakeholders.
Visualization technology can help users to monitor and measure the performance and impact of their activities, products, services, or processes1. This can help users to identify problems or opportunities for improvement, and adjust their plans or actions accordingly.
Visualization technology can help users to create engaging and interactive experiences for their customers or end-users1. This can increase customer satisfaction and loyalty, and generate more revenue or value for the organization.
Therefore, using visualization technology for corporate applications can help organizations to better utilize their resources and achieve their goals.
References:
ISACA, CISA Review Manual, 27th Edition, 2019
ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription TechRadar Blog, Best data visualization tools of 20232 IBM Blog, What is Data Visualization?3 TDWI Blog, Data Visualization Technology4 Tableau Blog, What are the advantages and disadvantages of data visualization?
CISA-KR 문제 28
다음 중 최근에 발견된 제로 데이 공격의 영향을 관리하는 첫 번째 단계는 무엇입니까?
정답: C
Explanation
The first step in managing the impact of a recently discovered zero-day attack is to identify vulnerable assets.
A zero-day attack is a cyberattack that exploits a previously unknown or unpatched vulnerability in a software or system, before the vendor or developer has had time to fix it. Identifying vulnerable assets is crucial for managing the impact of a zero-day attack, because it helps to determine the scope and severity of the attack, prioritize the protection and mitigation measures, and isolate or quarantine the affected assets from further damage or compromise. The other options are not the first steps in managing the impact of a zero-day attack, because they either require more information about the vulnerable assets, or they are part of the subsequent steps of assessing, responding, or recovering from the attack. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.4
The first step in managing the impact of a recently discovered zero-day attack is to identify vulnerable assets.
A zero-day attack is a cyberattack that exploits a previously unknown or unpatched vulnerability in a software or system, before the vendor or developer has had time to fix it. Identifying vulnerable assets is crucial for managing the impact of a zero-day attack, because it helps to determine the scope and severity of the attack, prioritize the protection and mitigation measures, and isolate or quarantine the affected assets from further damage or compromise. The other options are not the first steps in managing the impact of a zero-day attack, because they either require more information about the vulnerable assets, or they are part of the subsequent steps of assessing, responding, or recovering from the attack. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.4
CISA-KR 문제 29
업무상 필요한 이메일은 직원 개인 기기에 저장하고 있습니다.
다음 중 IS 감사인이 가장 권장하는 것은 무엇입니까?
다음 중 IS 감사인이 가장 권장하는 것은 무엇입니까?
정답: D
Explanation
Implementing an email containerization solution on personal devices is the best recommendation for an IS auditor, because it allows the organization to separate and secure the email data from the rest of the device data. Email containerization creates a virtual environment that encrypts and isolates the email data, preventing unauthorized access, leakage, or loss of sensitive information12. Requiring passwords or antivirus protection on personal devices may not be sufficient or enforceable, while prohibiting employees from storing company email on personal devices may not be feasible or practical. References: 1: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.3 2: CISA Online Review Course, Module 5, Lesson 4
Implementing an email containerization solution on personal devices is the best recommendation for an IS auditor, because it allows the organization to separate and secure the email data from the rest of the device data. Email containerization creates a virtual environment that encrypts and isolates the email data, preventing unauthorized access, leakage, or loss of sensitive information12. Requiring passwords or antivirus protection on personal devices may not be sufficient or enforceable, while prohibiting employees from storing company email on personal devices may not be feasible or practical. References: 1: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.3 2: CISA Online Review Course, Module 5, Lesson 4
CISA-KR 문제 30
체크섬은 어떤 유형의 제어로 분류됩니까?
정답: A
Explanation
A checksum is classified as a detective control. A checksum is a mathematical value that is calculated from a data set and used to verify the integrity of the data. A checksum can detect if the data has been altered or corrupted during transmission or storage. A checksum does not prevent or correct the data corruption, but it alerts the user or system of the problem. Therefore, it is a detective control. A preventive control is a control that prevents an error or incident from occurring. A corrective control is a control that restores normal operations after an error or incident has occurred. An administrative control is a control that involves policies, procedures, standards, guidelines, or organizational structures. References: CISA Review Manual (Digital Version)1, page 439.
A checksum is classified as a detective control. A checksum is a mathematical value that is calculated from a data set and used to verify the integrity of the data. A checksum can detect if the data has been altered or corrupted during transmission or storage. A checksum does not prevent or correct the data corruption, but it alerts the user or system of the problem. Therefore, it is a detective control. A preventive control is a control that prevents an error or incident from occurring. A corrective control is a control that restores normal operations after an error or incident has occurred. An administrative control is a control that involves policies, procedures, standards, guidelines, or organizational structures. References: CISA Review Manual (Digital Version)1, page 439.
- 다른 버전
- 2269ISACA.CISA-KR.v2026-08-27.q676
- 4287ISACA.CISA-KR.v2026-08-15.q712
- 6803ISACA.CISA-KR.v2026-05-16.q709
- 2703ISACA.CISA-KR.v2026-05-06.q261
- 4557ISACA.CISA-KR.v2026-03-16.q665
- 6497ISACA.CISA-KR.v2026-03-07.q651
- 10939ISACA.CISA-KR.v2025-04-07.q633
- 5649ISACA.CISA-KR.v2025-04-03.q628
- 4706ISACA.CISA-KR.v2025-04-02.q544
- 5241ISACA.CISA-KR.v2025-03-31.q534
- 6617ISACA.CISA-KR.v2025-03-28.q617
- 4242ISACA.CISA-KR.v2025-03-19.q581
- 5383ISACA.CISA-KR.v2025-03-03.q807
- 5955ISACA.CISA-KR.v2024-02-07.q421
- 5907ISACA.CISA-KR.v2023-10-24.q329
- 5698ISACA.CISA-KR.v2023-07-31.q266
- 3755ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 122Microsoft.AB-210.v2026-10-14.q58
- 120Huawei.H12-893_V1.0.v2026-10-14.q46
- 133UiPath.UiPath-ADPv1.v2026-10-14.q114
- 133Salesforce.MCE-Dev-201.v2026-10-14.q64
- 121PMI.PMI-RMP.v2026-10-14.q125
- 171HP.HPE7-A01.v2026-10-13.q163
- 134PaloAltoNetworks.XDR-Analyst.v2026-10-13.q30
- 145Snowflake.DAA-C01.v2026-10-13.q66
- 151Salesforce.Salesforce-Loyalty-Management.v2026-10-13.q71
- 141Oracle.1z0-1033-25.v2026-10-13.q44
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-01-31.q392 모의시험 시험자료를 다운 받으세요.