CISA-KR 문제 371
다음 중 사무실 간에 민감한 데이터를 전송하는 조직의 방법을 검토하는 IS 감사인에게 가장 큰 관심사는 무엇입니까?
정답: D
Explanation
The greatest concern to an IS auditor reviewing an organization's method to transport sensitive data between offices is that the method relies exclusively on the use of public key infrastructure (PKI). PKI is a set of tools and procedures that are used to create, manage, and revoke digital certificates and public keys for encryption and authentication1. PKI can provide secure and trustworthy communication over the internet, but it also has some limitations and risks that need to be considered.
One of the main limitations of PKI is that it depends on the trustworthiness and security of the certificate authority (CA), which is the entity that issues and verifies the digital certificates2. If the CA is compromised or malicious, it can issue fake or fraudulent certificates that can be used to impersonate legitimate parties or intercept sensitive data. For example, in 2011, a hacker breached the CA DigiNotar and issued hundreds of rogue certificates for domains such as Google, Yahoo, and Microsoft3. This allowed the hacker to conduct man-in-the-middle attacks and spy on the online activities of users in Iran3.
Another limitation of PKI is that it requires a complex and costly infrastructure to maintain and operate. PKI involves multiple components, such as servers, software, hardware, policies, and procedures, that need to be configured, updated, and monitored regularly1. PKI also requires a high level of technical expertise and coordination among different parties, such as users, administrators, CAs, and registration authorities (RAs)1.
PKI can be vulnerable to human errors or negligence that can compromise its security or functionality. For example, in 2018, a software bug in Apple's macOS High Sierra caused the system to accept any certificate as valid without checking its validity period. This could have allowed attackers to use expired or revoked certificates to bypass security checks.
Therefore, an IS auditor should be concerned if an organization relies exclusively on PKI for transporting sensitive data between offices. PKI can provide a high level of security and trust, but it also has some inherent risks and challenges that need to be addressed. An IS auditor should evaluate whether the organization has implemented adequate controls and measures to ensure the reliability and integrity of its PKI system. An IS auditor should also consider whether the organization has alternative or complementary methods for securing its data transmission, such as using symmetric encryption algorithms or digital signatures. Symmetric encryption algorithms use the same key for both encryption and decryption, which can offer faster performance and lower overhead than asymmetric encryption algorithms used by PKI4. Digital signatures use cryptographic techniques to verify the identity and authenticity of the sender and the integrity of the data5.
The greatest concern to an IS auditor reviewing an organization's method to transport sensitive data between offices is that the method relies exclusively on the use of public key infrastructure (PKI). PKI is a set of tools and procedures that are used to create, manage, and revoke digital certificates and public keys for encryption and authentication1. PKI can provide secure and trustworthy communication over the internet, but it also has some limitations and risks that need to be considered.
One of the main limitations of PKI is that it depends on the trustworthiness and security of the certificate authority (CA), which is the entity that issues and verifies the digital certificates2. If the CA is compromised or malicious, it can issue fake or fraudulent certificates that can be used to impersonate legitimate parties or intercept sensitive data. For example, in 2011, a hacker breached the CA DigiNotar and issued hundreds of rogue certificates for domains such as Google, Yahoo, and Microsoft3. This allowed the hacker to conduct man-in-the-middle attacks and spy on the online activities of users in Iran3.
Another limitation of PKI is that it requires a complex and costly infrastructure to maintain and operate. PKI involves multiple components, such as servers, software, hardware, policies, and procedures, that need to be configured, updated, and monitored regularly1. PKI also requires a high level of technical expertise and coordination among different parties, such as users, administrators, CAs, and registration authorities (RAs)1.
PKI can be vulnerable to human errors or negligence that can compromise its security or functionality. For example, in 2018, a software bug in Apple's macOS High Sierra caused the system to accept any certificate as valid without checking its validity period. This could have allowed attackers to use expired or revoked certificates to bypass security checks.
Therefore, an IS auditor should be concerned if an organization relies exclusively on PKI for transporting sensitive data between offices. PKI can provide a high level of security and trust, but it also has some inherent risks and challenges that need to be addressed. An IS auditor should evaluate whether the organization has implemented adequate controls and measures to ensure the reliability and integrity of its PKI system. An IS auditor should also consider whether the organization has alternative or complementary methods for securing its data transmission, such as using symmetric encryption algorithms or digital signatures. Symmetric encryption algorithms use the same key for both encryption and decryption, which can offer faster performance and lower overhead than asymmetric encryption algorithms used by PKI4. Digital signatures use cryptographic techniques to verify the identity and authenticity of the sender and the integrity of the data5.
CISA-KR 문제 372
다음 중 보안 분류가 다른 데이터가 포함된 서버에서 최소 권한 원칙을 적용하는 가장 좋은 방법은 무엇입니까?
정답: C
Explanation
The best way to enforce the principle of least privilege on a server containing data with different security classifications is to apply access controls determined by the data owner. The principle of least privilege states that users should only have the minimum level of access required to perform their tasks. The data owner is the person who has the authority and responsibility to classify, label, and protect the data according to its sensitivity and value. The data owner can define the access rights and permissions for each user or role based on the data classification policy and the business needs. This will ensure that only authorized and appropriate users can access the data and prevent unauthorized or excessive access that could compromise the confidentiality, integrity, or availability of the data. References:
CISA Review Manual (Digital Version)
CISA Questions, Answers & Explanations Database
The best way to enforce the principle of least privilege on a server containing data with different security classifications is to apply access controls determined by the data owner. The principle of least privilege states that users should only have the minimum level of access required to perform their tasks. The data owner is the person who has the authority and responsibility to classify, label, and protect the data according to its sensitivity and value. The data owner can define the access rights and permissions for each user or role based on the data classification policy and the business needs. This will ensure that only authorized and appropriate users can access the data and prevent unauthorized or excessive access that could compromise the confidentiality, integrity, or availability of the data. References:
CISA Review Manual (Digital Version)
CISA Questions, Answers & Explanations Database
CISA-KR 문제 373
습식 파이프 시스템보다 건식 파이프 화재 진압 시스템을 사용하는 주요 이점은 건식 파이프 시스템입니다.
정답: C
Explanation
The primary benefit of using a dry-pipe fire-suppression system rather than a wet-pipe system is that a dry-pipe system has a decreased risk of leakage, as the pipes are filled with pressurized air or nitrogen instead of water until the system is activated. A wet-pipe system has a higher risk of leakage, corrosion, and freezing.
A dry-pipe system is not more effective at suppressing flames, as it uses the same water-based suppressant as a wet-pipe system. A dry-pipe system does not allow more time to abort release of the suppressant, as it has a delay of only a few seconds before the water is released. A dry-pipe system does not disperse dry chemical suppressants exclusively, as it uses water as the primary suppressant. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.2.3
The primary benefit of using a dry-pipe fire-suppression system rather than a wet-pipe system is that a dry-pipe system has a decreased risk of leakage, as the pipes are filled with pressurized air or nitrogen instead of water until the system is activated. A wet-pipe system has a higher risk of leakage, corrosion, and freezing.
A dry-pipe system is not more effective at suppressing flames, as it uses the same water-based suppressant as a wet-pipe system. A dry-pipe system does not allow more time to abort release of the suppressant, as it has a delay of only a few seconds before the water is released. A dry-pipe system does not disperse dry chemical suppressants exclusively, as it uses water as the primary suppressant. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.2.3
CISA-KR 문제 374
원격 콜 센터와 고객 데이터베이스의 양방향 복제를 위해 제안된 프로젝트를 평가할 때 IS 감사인은 다음을 확인해야 합니다.
정답: A
Explanation
A database conflict occurs when the same data is modified at two separate servers, such as a customer database and a remote call center database, and the changes are not consistent with each other. For example, if a customer updates their phone number at the customer database, and a call center agent updates the same customer's address at the remote call center database, there is a conflict between the two updates. Database conflicts can cause data inconsistency, corruption, or loss if they are not detected and resolved properly.
Two-way replication is a process of synchronizing data between two databases, so that any changes made in one database are reflected in the other database, and vice versa. Two-way replication can improve data availability, performance, and scalability, but it also increases the risk of database conflicts. Therefore, when assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that database conflicts are managed during replication. This means that the project should have a clear and effective strategy for:
Preventing or minimizing database conflicts by using techniques such as locking, timestamping, or partitioning.
Detecting or identifying database conflicts by using tools such as triggers, logs, or alerts.
Resolving or handling database conflicts by using methods such as priority-based, rule-based, or user-based resolution.
The other possible options are:
B: end users are trained in the replication process: This is not a relevant or important factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. End users are not directly involved in the replication process, and they do not need to have detailed knowledge or skills about how replication works. The replication process should be transparent and seamless to the end users, and they should only interact with the data through their applications or interfaces.
C: the source database is backed up on both sites: This is not a sufficient or necessary factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. Backing up the source database on both sites can provide some level of data protection and recovery, but it does not address the issue of database conflicts that can occur during replication. Moreover, backing up the source database on both sites may not be feasible or efficient, as it may consume more storage space and network bandwidth, and introduce more complexity and overhead to the replication process.
D: user rights are identical on both databases: This is not a critical or relevant factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. User rights are the permissions or privileges that users have to access or modify data in a database. User rights do not directly affect the occurrence or resolution of database conflicts during replication. User rights may vary depending on the role or function of the users in different databases, and they should be defined and enforced according to the security policies and requirements of each database.
A database conflict occurs when the same data is modified at two separate servers, such as a customer database and a remote call center database, and the changes are not consistent with each other. For example, if a customer updates their phone number at the customer database, and a call center agent updates the same customer's address at the remote call center database, there is a conflict between the two updates. Database conflicts can cause data inconsistency, corruption, or loss if they are not detected and resolved properly.
Two-way replication is a process of synchronizing data between two databases, so that any changes made in one database are reflected in the other database, and vice versa. Two-way replication can improve data availability, performance, and scalability, but it also increases the risk of database conflicts. Therefore, when assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that database conflicts are managed during replication. This means that the project should have a clear and effective strategy for:
Preventing or minimizing database conflicts by using techniques such as locking, timestamping, or partitioning.
Detecting or identifying database conflicts by using tools such as triggers, logs, or alerts.
Resolving or handling database conflicts by using methods such as priority-based, rule-based, or user-based resolution.
The other possible options are:
B: end users are trained in the replication process: This is not a relevant or important factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. End users are not directly involved in the replication process, and they do not need to have detailed knowledge or skills about how replication works. The replication process should be transparent and seamless to the end users, and they should only interact with the data through their applications or interfaces.
C: the source database is backed up on both sites: This is not a sufficient or necessary factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. Backing up the source database on both sites can provide some level of data protection and recovery, but it does not address the issue of database conflicts that can occur during replication. Moreover, backing up the source database on both sites may not be feasible or efficient, as it may consume more storage space and network bandwidth, and introduce more complexity and overhead to the replication process.
D: user rights are identical on both databases: This is not a critical or relevant factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. User rights are the permissions or privileges that users have to access or modify data in a database. User rights do not directly affect the occurrence or resolution of database conflicts during replication. User rights may vary depending on the role or function of the users in different databases, and they should be defined and enforced according to the security policies and requirements of each database.
CISA-KR 문제 375
다음 중 회사 이메일을 통해 전송된 기밀 문서의 무단 공개를 감지하는 데 가장 도움이 되는 방법은 무엇입니까?
정답: D
Explanation
To detect unauthorized disclosure of confidential documents sent over corporate email, monitoring all emails based on pre-defined criteria is the best approach. This involves setting up automated monitoring systems that analyze email content, attachments, and metadata to identify any potential unauthorized disclosures. By defining specific criteria (such as keywords related to confidential information), organizations can proactively detect and prevent leaks. Requiring encryption before sending documents (option A) is important but does not address monitoring for unauthorized disclosures. Firewalls (option B) protect the network but do not specifically focus on email content. Reporting outgoing emails marked as confidential (option C) relies on user self-reporting and may not catch all incidents12. References: 1(https://www.isaca.org/resources/isaca-journal/past-issues/2010/data-governance-for-p
To detect unauthorized disclosure of confidential documents sent over corporate email, monitoring all emails based on pre-defined criteria is the best approach. This involves setting up automated monitoring systems that analyze email content, attachments, and metadata to identify any potential unauthorized disclosures. By defining specific criteria (such as keywords related to confidential information), organizations can proactively detect and prevent leaks. Requiring encryption before sending documents (option A) is important but does not address monitoring for unauthorized disclosures. Firewalls (option B) protect the network but do not specifically focus on email content. Reporting outgoing emails marked as confidential (option C) relies on user self-reporting and may not catch all incidents12. References: 1(https://www.isaca.org/resources/isaca-journal/past-issues/2010/data-governance-for-p
- 다른 버전
- 3855ISACA.CISA-KR.v2026-05-16.q709
- 1759ISACA.CISA-KR.v2026-05-06.q261
- 3092ISACA.CISA-KR.v2026-03-16.q665
- 4444ISACA.CISA-KR.v2026-03-07.q651
- 9180ISACA.CISA-KR.v2025-04-07.q633
- 4438ISACA.CISA-KR.v2025-04-03.q628
- 3635ISACA.CISA-KR.v2025-04-02.q544
- 4195ISACA.CISA-KR.v2025-03-31.q534
- 5299ISACA.CISA-KR.v2025-03-28.q617
- 3075ISACA.CISA-KR.v2025-03-19.q581
- 3959ISACA.CISA-KR.v2025-03-03.q807
- 2791ISACA.CISA-KR.v2024-01-31.q392
- 5260ISACA.CISA-KR.v2023-10-24.q329
- 5166ISACA.CISA-KR.v2023-07-31.q266
- 3097ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 226Microsoft.PL-600.v2026-08-11.q206
- 163Microsoft.DP-100.v2026-08-11.q160
- 165Oracle.1Z0-1048-25.v2026-08-11.q68
- 139ISQI.CTAL-TAE.v2026-08-11.q37
- 181ServiceNow.CIS-HR.v2026-08-11.q84
- 254Salesforce.Plat-Arch-201.v2026-08-10.q101
- 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 189F5.F5CAB2.v2026-08-10.q41
- 288APA.CPP-Remote.v2026-08-08.q109
- 149SAP.C_BCBAI_2601.v2026-08-08.q9
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-02-07.q421 모의시험 시험자료를 다운 받으세요.