CISA-KR 문제 21
Parallel simulation involves running the same data through two systems and comparing the results1. In this case, the bank's data would be processed using both the modified interest calculation program and an audit software. The results from both systems would then be compared to check for discrepancies1. This technique provides strong evidence of the correctness of interest calculations as it directly tests the program's output against a known and trusted output1. While source code review23, manual verification of a sample of results4567, and review of QA test results8910 can also provide valuable insights, they do not offer the same level of direct, comparative evidence as parallel simulation1.
References:
Parallel simulation in IT testing - Universal CPA Review
5 code review best practices - Work Life by Atlassian
How to Make Good Code Reviews Better - Stack Overflow
Guidelines for the validation and verification of quantitative and qualitative test methods - Mathematics LibreTexts Method Validation and Verification - University of Utah Sample Procedure for Method Validation - NIST Method validation and verification - CFS Good Practices for Quality Assurance Reviewers: Assessing Evidence of Supervisory Review - IGNET How do quality assurance engineers test calculations? - Software Quality Assurance & Testing Stack Exchange Quality Assurance/Quality Control (QA/QC) Plan and Procedures - UNFCCC
CISA-KR 문제 22
The proximity badge incorrectly granting access to restricted areas is the most concerning issue, as it indicates a failure of the access control system to enforce the principle of least privilege and protect the sensitive or critical assets of the organization. The proximity badge should only grant access to the areas that are necessary for the IS auditor to perform the audit fieldwork, and not to any other areas that may contain confidential information, valuable equipment, or hazardous materials. The incorrect access could result in unauthorized disclosure, modification, or destruction of the assets, as well as potential safety or legal issues.
References
ISACA CISA Review Manual, 27th Edition, page 254
Office & Workplace Physical Security Assessment Checklist
Physical Security: Planning, Measures & Examples
CISA-KR 문제 23
The primary objective of a control self-assessment (CSA) is to educate functional areas on risks and controls. CSA is a technique that allows managers and work teams directly involved in business units, functions or processes to participate in assessing the organization's risk management and control processes1. CSA can help functional areas to obtain a clear and shared understanding of their major activities and objectives, to foster an improved awareness of risk and controls among management and staff, to enhance responsibility and accountability for risks and controls, and to highlight best practices and opportunities to improve business performance2.
The other options are not the primary objective of a CSA. Ensuring appropriate access controls are implemented is a specific type of control that may be assessed by a CSA, but it is not the main goal of the technique. Eliminating the audit risk by leveraging management's analysis is not a realistic or desirable outcome of a CSA, as audit risk can never be completely eliminated, and management's analysis may not be sufficient or reliable without independent verification. Gaining assurance for business functions that cannot be audited is not a valid reason for conducting a CSA, as all business functions should be subject to audit, and a CSA is not a substitute for an audit.
References:
Control Self Assessments - PwC
Control self-assessment - Wikipedia
Control Self Assessment - AuditNet
CISA-KR 문제 24
An IS auditor is analyzing a sample of accounts payable transactions for a specific vendor and identifies one transaction with a value five times as high as the average transaction. The next step that the auditor should do is to request an explanation of the variance from the auditee. This is because the variance may indicate an error, fraud, or an unusual but legitimate transaction that requires further investigation. The auditor should not report the variance immediately to the audit committee without verifying its cause and significance. The auditor should not increase the sample size to 100% of the population without considering the cost-benefit analysis and the sampling methodology. The auditor should not exclude the transaction from the sample population without justification, as it may affect the validity and reliability of the audit results. References:
CISA Review Manual (Digital Version), [ISACA Auditing Standards]
CISA-KR 문제 25
The best approach for determining the overall IT risk appetite of an organization when business units use different methods for managing IT risks is to prioritize the organization's IT risk scenarios. IT risk appetite is the amount and type of IT risk that an organization is willing to accept in pursuit of its objectives. IT risk scenarios are hypothetical situations that describe the potential impact of IT risk events on the organization's objectives, processes, and resources. By prioritizing the organization's IT risk scenarios, the IS auditor can identify the most significant IT risks that affect the organization as a whole, and align them with the organization's strategic goals, values, and culture. Prioritizing the organization's IT risk scenarios can also help to communicate and monitor the IT risk appetite across the organization, and facilitate consistent and informed decision making. The other approaches (A, B and D) are not effective for determining the overall IT risk appetite of an organization, as they do not consider the impact and likelihood of IT risks on the organization's objectives, nor do they account for the diversity and complexity of IT risks across different business units. References: CISA Review Manual (Digital Version), Chapter 2: Governance and Management of Information Technology, Section 2.3: Information Technology Risk Management
- 다른 버전
- 2269ISACA.CISA-KR.v2026-08-27.q676
- 4287ISACA.CISA-KR.v2026-08-15.q712
- 6803ISACA.CISA-KR.v2026-05-16.q709
- 2703ISACA.CISA-KR.v2026-05-06.q261
- 4557ISACA.CISA-KR.v2026-03-16.q665
- 6497ISACA.CISA-KR.v2026-03-07.q651
- 10939ISACA.CISA-KR.v2025-04-07.q633
- 5649ISACA.CISA-KR.v2025-04-03.q628
- 4706ISACA.CISA-KR.v2025-04-02.q544
- 5241ISACA.CISA-KR.v2025-03-31.q534
- 6617ISACA.CISA-KR.v2025-03-28.q617
- 4242ISACA.CISA-KR.v2025-03-19.q581
- 5383ISACA.CISA-KR.v2025-03-03.q807
- 3588ISACA.CISA-KR.v2024-01-31.q392
- 5907ISACA.CISA-KR.v2023-10-24.q329
- 5698ISACA.CISA-KR.v2023-07-31.q266
- 3755ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 122Microsoft.AB-210.v2026-10-14.q58
- 120Huawei.H12-893_V1.0.v2026-10-14.q46
- 133UiPath.UiPath-ADPv1.v2026-10-14.q114
- 133Salesforce.MCE-Dev-201.v2026-10-14.q64
- 121PMI.PMI-RMP.v2026-10-14.q125
- 171HP.HPE7-A01.v2026-10-13.q163
- 134PaloAltoNetworks.XDR-Analyst.v2026-10-13.q30
- 145Snowflake.DAA-C01.v2026-10-13.q66
- 151Salesforce.Salesforce-Loyalty-Management.v2026-10-13.q71
- 141Oracle.1z0-1033-25.v2026-10-13.q44
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-02-07.q421 모의시험 시험자료를 다운 받으세요.