CISA-KR 문제 31
The finding that should be of greatest concern to an IS auditor assessing the effectiveness of an organization's vulnerability scanning program is that results are not reported to individuals with authority to ensure resolution. This indicates a lack of accountability and communication for vulnerability management, which may result in unresolved or delayed remediation of identified vulnerabilities. This may expose the organization to increased risk of cyberattacks or breaches. The other findings are also concerning, but not as much as this one, because they may affect the completeness, accuracy or timeliness of the vulnerability scanning process, but not necessarily its effectiveness. References:
ISACA, CISA Review Manual, 27th Edition, chapter 4, section 4.41
ISACA, COBIT 2019 Framework: Introduction and Methodology, section 3.2
CISA-KR 문제 32
The primary concern when negotiating a contract for a hot site is the availability of the site in the event of multiple disaster declarations. A hot site is a fully equipped alternative facility that can be used to resume business operations in the event of a disaster. However, if multiple clients of the hot site provider declare a disaster at the same time, there may be a shortage of resources or capacity to accommodate all of them.
Therefore, the contract should specify the terms and conditions for ensuring the availability and priority of the hot site for the organization. The other options are not as important as availability, as they do not affect the ability to use the hot site in a disaster situation. Coordination with the site staff in the event of multiple disaster declarations is a logistical issue that can be resolved by communication and planning. Reciprocal agreements with other organizations are alternative arrangements that can be used to share resources or facilities in a disaster, but they may not be as reliable or suitable as a hot site. Complete testing of the recovery plan is a good practice that can help validate and improve the effectiveness of the recovery plan, but it is not a concern for negotiating a contract for a hot site. References: CISA Review Manual (Digital Version), Chapter 4, Section 4.2.3
CISA-KR 문제 33
A comprehensive asset inventory is the most important factor for the successful establishment of a security vulnerability management program. A security vulnerability management program is a systematic process of identifying, assessing, prioritizing, and remediating vulnerabilities in the organization's IT environment1. A comprehensive asset inventory is a complete and accurate record of all the hardware, software, and network components that the organization owns or uses2. A comprehensive asset inventory helps the organization to:
Know what assets are in scope for vulnerability scanning and assessment3.
Identify the vulnerabilities that affect each asset and their severity level4.
Prioritize the remediation of vulnerabilities based on the criticality and value of each asset.
Track the status and progress of vulnerability remediation for each asset.
Measure the effectiveness and maturity of the vulnerability management program.
A robust tabletop exercise plan is a simulated scenario that tests the organization's preparedness and response capabilities for a potential cyberattack or incident. A tabletop exercise plan is useful for validating and improving the organization's incident response plan, but it is not essential for establishing a security vulnerability management program.
A tested incident response plan is a documented process that defines the roles, responsibilities, and actions of the organization's personnel in the event of a cyberattack or incident. A tested incident response plan is important for minimizing the impact and restoring normal operations after a security breach, but it is not critical for establishing a security vulnerability management program.
An approved patching policy is a set of rules and guidelines that governs how the organization applies patches and updates to its IT systems and applications. An approved patching policy is a key component of the remediation phase of the vulnerability management program, but it is not sufficient for establishing a security vulnerability management program.
CISA-KR 문제 34
The effectiveness of a risk management program can be measured by how well it reduces the residual risk, which is the risk that remains after applying controls, to an acceptable level. Inherent risk is the risk that exists before applying any controls, and it cannot be eliminated completely. Control risk is the risk that the controls fail to prevent or detect a risk event, and it is a component of residual risk. Overall risk is not a meaningful metric for assessing the effectiveness of a risk management program, as it does not account for the impact and likelihood of different risk events. References: CISA Review Manual (Digital Version), Chapter 1, Section
1.2.2
CISA-KR 문제 35
The auditor's best action when IT management provides suitable evidence for a control that had been concluded as ineffective is to re-perform the audit before changing the conclusion. This means that the auditor should verify the validity, completeness, and timeliness of the evidence provided by IT management and test the effectiveness of the new control in meeting the audit objectives. The auditor should not change the conclusion based on evidence provided by IT management without re-performing the audit, as this could compromise the auditor's independence and objectivity. The auditor should also not explain to IT management that the new control will be evaluated during follow-up or add comments about the action taken by IT management in the report, as these actions do not address the original audit finding. References: CISA Review Manual, 27th Edition, page 439
- 다른 버전
- 2293ISACA.CISA-KR.v2026-08-27.q676
- 4330ISACA.CISA-KR.v2026-08-15.q712
- 6836ISACA.CISA-KR.v2026-05-16.q709
- 2711ISACA.CISA-KR.v2026-05-06.q261
- 4576ISACA.CISA-KR.v2026-03-16.q665
- 6537ISACA.CISA-KR.v2026-03-07.q651
- 10973ISACA.CISA-KR.v2025-04-07.q633
- 5657ISACA.CISA-KR.v2025-04-03.q628
- 4717ISACA.CISA-KR.v2025-04-02.q544
- 5260ISACA.CISA-KR.v2025-03-31.q534
- 6638ISACA.CISA-KR.v2025-03-28.q617
- 4261ISACA.CISA-KR.v2025-03-19.q581
- 5394ISACA.CISA-KR.v2025-03-03.q807
- 5977ISACA.CISA-KR.v2024-02-07.q421
- 5914ISACA.CISA-KR.v2023-10-24.q329
- 5707ISACA.CISA-KR.v2023-07-31.q266
- 3773ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 171PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 171Splunk.SPLK-1002.v2026-10-15.q187
- 130Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 139AIChE.CCPSC.v2026-10-15.q37
- 201API.API-571.v2026-10-15.q131
- 128Microsoft.AB-210.v2026-10-14.q58
- 127Huawei.H12-893_V1.0.v2026-10-14.q46
- 164UiPath.UiPath-ADPv1.v2026-10-14.q114
- 184Salesforce.MCE-Dev-201.v2026-10-14.q64
- 139PMI.PMI-RMP.v2026-10-14.q125
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-01-31.q392 모의시험 시험자료를 다운 받으세요.