CISA-KR 문제 151
감사 관찰 내용은 먼저 피감사인에게 전달되어야 합니다.
정답: B
Explanation
Audit observations are the findings and recommendations that result from an audit engagement. Audit observations should be first communicated with the auditee during fieldwork, which is the stage of the audit process where the auditor collects and analyzes evidence to evaluate the audit objectives1. Communicating audit observations during fieldwork has several benefits, such as2:
It allows the auditor to verify the accuracy and completeness of the observations, and to obtain additional information or clarification from the auditee if needed.
It enables the auditor to discuss the root causes, impacts, and risks of the observations, and to solicit the auditee's input on possible corrective actions and implementation timelines.
It helps to build rapport and trust between the auditor and the auditee, and to avoid surprises or disagreements at the end of the audit.
It facilitates timely resolution of audit observations, and reduces the risk of audit delays or disputes.
Therefore, option B is the correct answer.
Option A is not correct because communicating audit observations when drafting the report is too late, as it may lead to misunderstandings, conflicts, or revisions that could have been avoided if the observations were communicated earlier. Option C is not correct because communicating audit observations at the end of fieldwork is also not ideal, as it may not leave enough time for the auditor and the auditee to discuss and agree on the observations and recommendations. Option D is not correct because communicating audit observations within the audit report is the final step of the audit process, not the first.
References:
Audit Process Overview1
Communicating Internal Audit Findings: Best Practices for Success2
Audit observations are the findings and recommendations that result from an audit engagement. Audit observations should be first communicated with the auditee during fieldwork, which is the stage of the audit process where the auditor collects and analyzes evidence to evaluate the audit objectives1. Communicating audit observations during fieldwork has several benefits, such as2:
It allows the auditor to verify the accuracy and completeness of the observations, and to obtain additional information or clarification from the auditee if needed.
It enables the auditor to discuss the root causes, impacts, and risks of the observations, and to solicit the auditee's input on possible corrective actions and implementation timelines.
It helps to build rapport and trust between the auditor and the auditee, and to avoid surprises or disagreements at the end of the audit.
It facilitates timely resolution of audit observations, and reduces the risk of audit delays or disputes.
Therefore, option B is the correct answer.
Option A is not correct because communicating audit observations when drafting the report is too late, as it may lead to misunderstandings, conflicts, or revisions that could have been avoided if the observations were communicated earlier. Option C is not correct because communicating audit observations at the end of fieldwork is also not ideal, as it may not leave enough time for the auditor and the auditee to discuss and agree on the observations and recommendations. Option D is not correct because communicating audit observations within the audit report is the final step of the audit process, not the first.
References:
Audit Process Overview1
Communicating Internal Audit Findings: Best Practices for Success2
CISA-KR 문제 152
IS 감사인은 3개월 이내에 폐기될 레거시 애플리케이션이 현재 정책에 의해 설정된 보안 요구 사항을 충족할 수 없음을 확인합니다. 이 문제를 해결하는 가장 좋은 방법(또는 감사인은 무엇입니까?
정답: C
Explanation
The best way for the auditor to address this issue is to verify management has approved a policy exception to accept the risk. A policy exception is a formal authorization that allows a deviation from the established policy requirements for a specific situation or period of time. A policy exception should be based on a risk assessment that evaluates the impact and likelihood of the potential threats and vulnerabilities, as well as the cost and benefit of the alternative controls. A policy exception should also be documented, approved, and monitored by management.
Recommending the application be patched to meet requirements is not the best way for the auditor to address this issue. Patching the application may not be feasible, cost-effective, or timely, given that the application will be decommissioned in three months. Patching the application may also introduce new risks or errors that could affect the functionality or performance of the application.
Informing the IT director of the policy noncompliance is not the best way for the auditor to address this issue.
Informing the IT director of the policy noncompliance may not resolve the issue or mitigate the risk, especially if the IT director is already aware of the situation and has decided to accept it. Informing the IT director of the policy noncompliance may also create unnecessary conflict or tension between the auditor and the auditee.
Taking no action since the application will be decommissioned in three months is not the best way for the auditor to address this issue. Taking no action may expose the organization to significant risks or consequences, such as data breaches, regulatory fines, or reputational damage, if the application is compromised or exploited by malicious actors. Taking no action may also violate the auditor's professional standards and responsibilities, such as due care, objectivity, and reporting.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 289
ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription Cybersecurity Engineering for Legacy Systems: 6 Recommendations - SEI Blog How to Secure Your Company's Legacy Applications - iCorps
The best way for the auditor to address this issue is to verify management has approved a policy exception to accept the risk. A policy exception is a formal authorization that allows a deviation from the established policy requirements for a specific situation or period of time. A policy exception should be based on a risk assessment that evaluates the impact and likelihood of the potential threats and vulnerabilities, as well as the cost and benefit of the alternative controls. A policy exception should also be documented, approved, and monitored by management.
Recommending the application be patched to meet requirements is not the best way for the auditor to address this issue. Patching the application may not be feasible, cost-effective, or timely, given that the application will be decommissioned in three months. Patching the application may also introduce new risks or errors that could affect the functionality or performance of the application.
Informing the IT director of the policy noncompliance is not the best way for the auditor to address this issue.
Informing the IT director of the policy noncompliance may not resolve the issue or mitigate the risk, especially if the IT director is already aware of the situation and has decided to accept it. Informing the IT director of the policy noncompliance may also create unnecessary conflict or tension between the auditor and the auditee.
Taking no action since the application will be decommissioned in three months is not the best way for the auditor to address this issue. Taking no action may expose the organization to significant risks or consequences, such as data breaches, regulatory fines, or reputational damage, if the application is compromised or exploited by malicious actors. Taking no action may also violate the auditor's professional standards and responsibilities, such as due care, objectivity, and reporting.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 289
ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription Cybersecurity Engineering for Legacy Systems: 6 Recommendations - SEI Blog How to Secure Your Company's Legacy Applications - iCorps
CISA-KR 문제 153
경영진은 향후 몇 년 내에 조직의 데이터 센터 근처에서 잠재적인 홍수와 관련된 높은 수준의 위험을 나타내는 정보를 받습니다. 결과적으로 데이터 센터 운영을 더 높은 곳에 있는 다른 시설로 이전하기로 결정했습니다. 어떤 접근 방식이 채택되었습니까?
정답: A
Explanation
The approach adopted by management in this scenario is risk avoidance. Risk avoidance is the elimination of a risk by discontinuing or not undertaking an activity that poses a threat to the organization3. By moving data center operations to another facility on higher ground, management is avoiding the potential flooding risk that could disrupt or damage the data center. Risk transfer, risk acceptance and risk reduction are other possible approaches for dealing with risks, but they do not apply in this case. References:
CISA Review Manual, 27th Edition, page 641
CISA Review Questions, Answers & Explanations Database - 12 Month Subscription
The approach adopted by management in this scenario is risk avoidance. Risk avoidance is the elimination of a risk by discontinuing or not undertaking an activity that poses a threat to the organization3. By moving data center operations to another facility on higher ground, management is avoiding the potential flooding risk that could disrupt or damage the data center. Risk transfer, risk acceptance and risk reduction are other possible approaches for dealing with risks, but they do not apply in this case. References:
CISA Review Manual, 27th Edition, page 641
CISA Review Questions, Answers & Explanations Database - 12 Month Subscription
CISA-KR 문제 154
용량 관리를 통해 조직은 다음을 수행할 수 있습니다.
정답: C
Explanation
Capacity management is a process that ensures that the IT resources of an organization are sufficient to meet the current and future demands of the business. Capacity management enables organizations to identify the extent to which components need to be upgraded, by monitoring and analyzing the performance, utilization, and availability of the IT components, such as servers, networks, storage, applications, etc., and identifying any bottlenecks, gaps, or risks that may affect the service level agreements (SLAs) or quality of service (QoS).
Capacity management also helps organizations to plan and optimize the use of IT resources, by forecasting the future demand and growth of the business, and aligning the IT capacity with the business needs and objectives.
Forecasting technology trends is a possible outcome of capacity management, but it is not its main purpose.
Establishing the capacity of network communication links is a part of capacity management, but it is not its main goal. Determining business transaction volumes is an input for capacity management, but it is not its main objective.
Capacity management is a process that ensures that the IT resources of an organization are sufficient to meet the current and future demands of the business. Capacity management enables organizations to identify the extent to which components need to be upgraded, by monitoring and analyzing the performance, utilization, and availability of the IT components, such as servers, networks, storage, applications, etc., and identifying any bottlenecks, gaps, or risks that may affect the service level agreements (SLAs) or quality of service (QoS).
Capacity management also helps organizations to plan and optimize the use of IT resources, by forecasting the future demand and growth of the business, and aligning the IT capacity with the business needs and objectives.
Forecasting technology trends is a possible outcome of capacity management, but it is not its main purpose.
Establishing the capacity of network communication links is a part of capacity management, but it is not its main goal. Determining business transaction volumes is an input for capacity management, but it is not its main objective.
CISA-KR 문제 155
재무 부서는 총계정원장을 호스팅하는 전사적 자원 관리(ERP) 시스템을 업그레이드하기 위한 다년간의 프로젝트를 가지고 있습니다. 1년 차에는 시스템 버전 업그레이드가 적용됩니다. 다음 중 프로젝트의 첫 해를 검토하는 IS 감사인의 주요 초점은 무엇입니까?
정답: D
Explanation
The primary focus of the IS auditor reviewing the first year of the project should be regression testing.
Regression testing is a type of testing that ensures that the existing functionality of the system is not affected by the changes or upgrades made to the system. Since the project involves upgrading the ERP system hosting the general ledger, which is a critical and complex component of the finance department, it is important to verify that the upgrade does not introduce any errors or defects that could compromise the accuracy, completeness, and reliability of the financial data and reports. Regression testing can help identify and resolve any issues before they affect the users and the business processes.
Unit testing, network performance, and user acceptance testing (UAT) are also important aspects of the project, but they are not the primary focus of the IS auditor in the first year. Unit testing is a type of testing that verifies that each individual module or component of the system works as expected. Network performance is a measure of how well the system can communicate and exchange data with other systems and devices over a network. User acceptance testing (UAT) is a type of testing that validates that the system meets the user requirements and expectations. These aspects are more relevant in later stages of the project, when the system is more developed and ready for deployment.
References:
ERP Upgrade: The Path to Modernization | SAP
ERP System Validation: Your Guide To Successfully Validating ERP Systems The role of internal auditors in ERPbased organizations What is Regression Testing? Definition, Tools & Examples What is Unit Testing? Definition, Tools & Examples What is Network Performance? Definition, Metrics & Examples What is User Acceptance Testing (UAT)? Definition, Process & Examples
The primary focus of the IS auditor reviewing the first year of the project should be regression testing.
Regression testing is a type of testing that ensures that the existing functionality of the system is not affected by the changes or upgrades made to the system. Since the project involves upgrading the ERP system hosting the general ledger, which is a critical and complex component of the finance department, it is important to verify that the upgrade does not introduce any errors or defects that could compromise the accuracy, completeness, and reliability of the financial data and reports. Regression testing can help identify and resolve any issues before they affect the users and the business processes.
Unit testing, network performance, and user acceptance testing (UAT) are also important aspects of the project, but they are not the primary focus of the IS auditor in the first year. Unit testing is a type of testing that verifies that each individual module or component of the system works as expected. Network performance is a measure of how well the system can communicate and exchange data with other systems and devices over a network. User acceptance testing (UAT) is a type of testing that validates that the system meets the user requirements and expectations. These aspects are more relevant in later stages of the project, when the system is more developed and ready for deployment.
References:
ERP Upgrade: The Path to Modernization | SAP
ERP System Validation: Your Guide To Successfully Validating ERP Systems The role of internal auditors in ERPbased organizations What is Regression Testing? Definition, Tools & Examples What is Unit Testing? Definition, Tools & Examples What is Network Performance? Definition, Metrics & Examples What is User Acceptance Testing (UAT)? Definition, Process & Examples
- 다른 버전
- 3873ISACA.CISA-KR.v2026-05-16.q709
- 1778ISACA.CISA-KR.v2026-05-06.q261
- 3095ISACA.CISA-KR.v2026-03-16.q665
- 4445ISACA.CISA-KR.v2026-03-07.q651
- 9185ISACA.CISA-KR.v2025-04-07.q633
- 4438ISACA.CISA-KR.v2025-04-03.q628
- 3638ISACA.CISA-KR.v2025-04-02.q544
- 4199ISACA.CISA-KR.v2025-03-31.q534
- 5302ISACA.CISA-KR.v2025-03-28.q617
- 3095ISACA.CISA-KR.v2025-03-19.q581
- 3960ISACA.CISA-KR.v2025-03-03.q807
- 2793ISACA.CISA-KR.v2024-01-31.q392
- 5260ISACA.CISA-KR.v2023-10-24.q329
- 5185ISACA.CISA-KR.v2023-07-31.q266
- 3098ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 120Microsoft.DP-900-KR.v2026-08-13.q130
- 227Microsoft.PL-600.v2026-08-11.q206
- 168Microsoft.DP-100.v2026-08-11.q160
- 167Oracle.1Z0-1048-25.v2026-08-11.q68
- 140ISQI.CTAL-TAE.v2026-08-11.q37
- 183ServiceNow.CIS-HR.v2026-08-11.q84
- 255Salesforce.Plat-Arch-201.v2026-08-10.q101
- 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 189F5.F5CAB2.v2026-08-10.q41
- 296APA.CPP-Remote.v2026-08-08.q109
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-02-07.q421 모의시험 시험자료를 다운 받으세요.