CISA-KR 문제 211
The answer D is correct because the most important thing to determine when conducting an audit of an organization's data privacy practices is whether the systems inventory containing personal data is maintained.
A systems inventory is a list of all the systems, applications, databases, and devices that store, process, or transmit personal data within the organization. Maintaining a systems inventory is essential for data privacy because it helps the organization to identify, classify, and protect the personal data it holds, as well as to comply with the relevant privacy laws and regulations. A systems inventory also enables the organization to perform data protection impact assessments (DPIAs), data breach notifications, data subject access requests, and data retention and disposal policies.
The other options are not as important as option D. Whether a disciplinary process is established for data privacy violations (option A) is a policy issue that may deter or sanction the employees who violate the data privacy rules, but it does not directly affect the data privacy practices of the organization. Whether strong encryption algorithms are deployed for personal data protection (option B) is a technical issue that may enhance the security and confidentiality of the personal data, but it does not address the other aspects of data privacy, such as accuracy, consent, and purpose limitation. Whether privacy technologies are implemented for personal data protection (option C) is also a technical issue that may support the data privacy practices of the organization, but it does not guarantee that the organization follows the best practices or complies with the applicable laws and regulations.
References:
IS Audit Basics: Auditing Data Privacy
Best Practices for Privacy Audits
ISACA Produces New Audit and Assurance Programs for Data Privacy and Mobile Computing
CISA-KR 문제 212
Stress testing is designed to evaluate a system's performance under extreme conditions1. It is typically carried out in a test environment that closely mirrors the production environment, using production workloads1. This approach ensures that the test results accurately reflect how the system would perform under similar conditions in the production environment1. Using a test environment also prevents any disruptions or damage to the production environment during testing1.
References:
Stress Testing Best Practices: A Seven Steps Model
CISA-KR 문제 213
This means that the IT investments are aligned with the strategic goals and priorities of the organization, and that they deliver value and benefits to the business. Mapping IT investments to specific business objectives can help ensure that the IT investments are relevant, justified, and measurable, and that they support the organization's mission and vision.
IT investments are implemented and monitored following a system development life cycle (SDLC) is an indication of effective IT project management, but not necessarily of effective IT investment management.
The SDLC is a framework that guides the development and implementation of IT systems and applications, but it does not address the alignment, justification, or measurement of the IT investments.
Key performance indicators (KPIs) are defined for each business requiring IT investment is an indication of effective IT performance management, but not necessarily of effective IT investment management. KPIs are metrics that measure the outcomes and results of IT activities and processes, but they do not address the alignment, justification, or value of the IT investments.
The IT investment budget is significantly below industry benchmarks is not an indication of effective IT investment management, but rather of low IT spending. The IT investment budget should be based on the organization's needs and capabilities, and not on external comparisons. A low IT investment budget may indicate that the organization is underinvesting in IT, which could limit its potential for growth and innovation.
CISA-KR 문제 214
The greatest benefit of adopting an international IT governance framework rather than establishing a new framework based on the actual situation of a specific organization is wide acceptance by different business and support units with IT governance objectives. An international IT governance framework, such as COBIT, provides a common language and understanding for IT governance among various stakeholders, such as management, users, auditors and regulators. This facilitates alignment, communication and collaboration among them. Readily available resources, comprehensive coverage and fewer resources expended are also benefits of adopting an international IT governance framework, but they are not the greatest benefit. References: CISA Review Manual (Digital Version) , Chapter 1, Section 1.3.1.
CISA-KR 문제 215
Encryption is the process of transforming information into an unreadable form using a secret key, so that only authorized parties can access it. Encryption would protect the confidentiality of information sent in email messages, as it would prevent unauthorized parties from intercepting and reading the messages. Secure Hash Algorithm 1 (SHA-1) is a cryptographic hash function that produces a fixed-length output from an input.
SHA-1 does not encrypt information, but rather verifies its integrity by detecting any changes or modifications. Digital signatures are electronic signatures that use encryption and hash functions to authenticate the identity of the sender and the integrity of the message. Digital signatures do not protect the confidentiality of information, but rather ensure its authenticity and non-repudiation. Digital certificates are electronic documents that contain the public key and identity information of an entity, such as a person, organization or device. Digital certificates are issued by trusted third parties called certificate authorities (CAs). Digital certificates do not protect the confidentiality of information, but rather enable secure communication and encryption by verifying the identity and public key of an entity. References:
1: [Encryption Definition]
2: [Secure Hash Algorithm 1 (SHA-1) Definition]
3: [Digital Signature Definition]
4: [Digital Certificate Definition]
- 다른 버전
- 3874ISACA.CISA-KR.v2026-05-16.q709
- 1778ISACA.CISA-KR.v2026-05-06.q261
- 3096ISACA.CISA-KR.v2026-03-16.q665
- 4448ISACA.CISA-KR.v2026-03-07.q651
- 9187ISACA.CISA-KR.v2025-04-07.q633
- 4439ISACA.CISA-KR.v2025-04-03.q628
- 3640ISACA.CISA-KR.v2025-04-02.q544
- 4200ISACA.CISA-KR.v2025-03-31.q534
- 5303ISACA.CISA-KR.v2025-03-28.q617
- 3101ISACA.CISA-KR.v2025-03-19.q581
- 3962ISACA.CISA-KR.v2025-03-03.q807
- 2793ISACA.CISA-KR.v2024-01-31.q392
- 5260ISACA.CISA-KR.v2023-10-24.q329
- 5189ISACA.CISA-KR.v2023-07-31.q266
- 3098ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 133Microsoft.DP-900-KR.v2026-08-13.q130
- 227Microsoft.PL-600.v2026-08-11.q206
- 168Microsoft.DP-100.v2026-08-11.q160
- 167Oracle.1Z0-1048-25.v2026-08-11.q68
- 140ISQI.CTAL-TAE.v2026-08-11.q37
- 185ServiceNow.CIS-HR.v2026-08-11.q84
- 255Salesforce.Plat-Arch-201.v2026-08-10.q101
- 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 189F5.F5CAB2.v2026-08-10.q41
- 297APA.CPP-Remote.v2026-08-08.q109
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-02-07.q421 모의시험 시험자료를 다운 받으세요.