CISA-KR 문제 376
IS 감사인이 해고된 직원의 액세스 권한을 제거하는 프로세스가 문서화되어 있지 않음을 발견했습니다. 이 관찰에서 가장 중요한 위험은 무엇입니까?
정답: D
Explanation
The most significant risk from this observation is that access rights may not be removed in a timely manner. If the process for removing access for terminated employees is not documented, there is no clear guidance or accountability for who, how, when, and what actions should be taken to revoke the access rights of the employees who leave the organization. This could result in delays, inconsistencies, or omissions in removing access rights, which could allow terminated employees to retain unauthorized access to the organization's systems and data. This could compromise the security, confidentiality, integrity, and availability of the information assets. References:
CISA Review Manual (Digital Version)
CISA Questions, Answers & Explanations Database
The most significant risk from this observation is that access rights may not be removed in a timely manner. If the process for removing access for terminated employees is not documented, there is no clear guidance or accountability for who, how, when, and what actions should be taken to revoke the access rights of the employees who leave the organization. This could result in delays, inconsistencies, or omissions in removing access rights, which could allow terminated employees to retain unauthorized access to the organization's systems and data. This could compromise the security, confidentiality, integrity, and availability of the information assets. References:
CISA Review Manual (Digital Version)
CISA Questions, Answers & Explanations Database
CISA-KR 문제 377
새로운 시스템 개발 프로젝트가 중요한 구현 기한에 비해 늦어지고 있습니다. 다음 중 가장 중요한 활동은 무엇입니까?
정답: C
Explanation
Performing user acceptance testing (UAT) is the most important activity before implementing a new system, as it ensures that the system meets the user requirements and expectations, and that it is free of major defects. Documenting last-minute enhancements, performing a pre-implementation audit, and ensuring that code has been reviewed are also important activities, but they are not as critical as UAT. References: CISA Review Manual (Digital Version), Chapter 4, Section 4.2.2
Performing user acceptance testing (UAT) is the most important activity before implementing a new system, as it ensures that the system meets the user requirements and expectations, and that it is free of major defects. Documenting last-minute enhancements, performing a pre-implementation audit, and ensuring that code has been reviewed are also important activities, but they are not as critical as UAT. References: CISA Review Manual (Digital Version), Chapter 4, Section 4.2.2
CISA-KR 문제 378
다음 중 감사 보고서에 포함할 문제를 결정할 때 IS 감사인이 가장 먼저 고려해야 할 사항은 무엇입니까?
정답: C
Explanation
Materiality is the primary consideration when determining which issues to include in an audit report, as it reflects the significance or importance of the issues to the users of the report. Materiality is a relative concept that depends on the nature, context, and amount of the issues, as well as the expectations and needs of the users. Materiality helps the auditor to prioritize the issues and communicate them clearly and concisely.
References
ISACA CISA Review Manual, 27th Edition, page 256
Materiality in Auditing - AICPA
Materiality in Planning and Performing an Audit - IAASB
Materiality is the primary consideration when determining which issues to include in an audit report, as it reflects the significance or importance of the issues to the users of the report. Materiality is a relative concept that depends on the nature, context, and amount of the issues, as well as the expectations and needs of the users. Materiality helps the auditor to prioritize the issues and communicate them clearly and concisely.
References
ISACA CISA Review Manual, 27th Edition, page 256
Materiality in Auditing - AICPA
Materiality in Planning and Performing an Audit - IAASB
CISA-KR 문제 379
두 회사 간의 상호 재해 복구 계약을 감사하는 동안 IS 감사인은 다음 사항에 가장 관심을 갖게 됩니다.
정답: A
Explanation
During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be most concerned with the allocation of resources during an emergency. A reciprocal disaster recovery agreement is an arrangement by which one organization agrees to use another's resources in the event of a business continuity event or incident. The IS auditor would need to ensure that both parties have clearly defined their roles and responsibilities, their resource requirements, their priority levels, their communication channels, and their escalation procedures in case of a disaster. The IS auditor would also need to verify that both parties have tested their agreement and have updated it regularly to reflect any changes in their business environments. The frequency of system testing is not as critical as the allocation of resources during an emergency, because system testing can be performed periodically or on demand, while resource allocation is a dynamic and complex process that requires careful planning and coordination. The differences in IS policies and procedures are not as critical as the allocation of resources during an emergency, because both parties can agree on common standards and protocols for their disaster recovery operations, or they can adapt their policies and procedures to suit each other's needs. The maintenance of hardware and software compatibility is not as critical as the allocation of resources during an emergency, because both parties can use compatible or interoperable systems, or they can use virtualization or cloud computing technologies to overcome any compatibility issues. References: ISACA CISA Review Manual 27th Edition, page 281
During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be most concerned with the allocation of resources during an emergency. A reciprocal disaster recovery agreement is an arrangement by which one organization agrees to use another's resources in the event of a business continuity event or incident. The IS auditor would need to ensure that both parties have clearly defined their roles and responsibilities, their resource requirements, their priority levels, their communication channels, and their escalation procedures in case of a disaster. The IS auditor would also need to verify that both parties have tested their agreement and have updated it regularly to reflect any changes in their business environments. The frequency of system testing is not as critical as the allocation of resources during an emergency, because system testing can be performed periodically or on demand, while resource allocation is a dynamic and complex process that requires careful planning and coordination. The differences in IS policies and procedures are not as critical as the allocation of resources during an emergency, because both parties can agree on common standards and protocols for their disaster recovery operations, or they can adapt their policies and procedures to suit each other's needs. The maintenance of hardware and software compatibility is not as critical as the allocation of resources during an emergency, because both parties can use compatible or interoperable systems, or they can use virtualization or cloud computing technologies to overcome any compatibility issues. References: ISACA CISA Review Manual 27th Edition, page 281
CISA-KR 문제 380
사고 대응 계획의 주요 목적은 다음과 같습니다.
정답: A
Explanation
The primary purpose of an incident response plan is to reduce the impact of an adverse event on information assets. An incident response plan is a set of instructions and procedures that guide the organization's actions in the event of a security breach, cyberattack, or other disruption that affects its information systems and data. An incident response plan aims to:
Detect and identify the incident as soon as possible.
Contain and isolate the incident to prevent further damage or spread.
Analyze and investigate the incident to determine its cause, scope, and impact.
Eradicate and eliminate the incident and its root causes from the affected systems and data.
Recover and restore the normal operations and functionality of the systems and data.
Learn and improve from the incident by documenting the lessons learned, best practices, and recommendations for future prevention and mitigation.
By following an incident response plan, the organization can minimize the negative consequences of an adverse event on its information assets, such as:
Loss or corruption of data or information.
Disclosure or theft of confidential or sensitive data or information.
Interruption or degradation of system or service availability or performance.
Legal or regulatory noncompliance or liability.
Financial or reputational loss or damage.
An incident response plan also helps the organization to demonstrate its due diligence and accountability in protecting its information assets and complying with its legal and contractual obligations.
The other options are not the primary purpose of an incident response plan, although they may be secondary benefits or outcomes of having one.
Increasing the effectiveness of preventive controls is not the primary purpose of an incident response plan.
Preventive controls are controls that aim to prevent or deter incidents from occurring in the first place, such as firewalls, antivirus software, encryption, authentication, etc. An incident response plan is a reactive control that deals with incidents after they have occurred. However, an incident response plan may help to improve the effectiveness of preventive controls by identifying and addressing their weaknesses or gaps.
Reducing the maximum tolerable downtime (MTD) of impacted systems is not the primary purpose of an incident response plan. MTD is a measure of how long an organization can tolerate a system or service outage before it causes unacceptable harm or loss to its business operations or objectives. An incident response plan may help to reduce the MTD of impacted systems by facilitating a faster and smoother recovery process.
However, reducing the MTD is not the main goal of an incident response plan, but rather a desired outcome.
Increasing awareness of impacts from adverse events to IT systems is not the primary purpose of an incident response plan. Awareness is a state of being informed or conscious of something. An incident response plan may help to increase awareness of impacts from adverse events to IT systems by providing information and communication channels for stakeholders, such as management, employees, customers, regulators, etc.
However, increasing awareness is not the main objective of an incident response plan, but rather a means to achieve other objectives, such as reducing impact, ensuring compliance, or maintaining trust.
The primary purpose of an incident response plan is to reduce the impact of an adverse event on information assets. An incident response plan is a set of instructions and procedures that guide the organization's actions in the event of a security breach, cyberattack, or other disruption that affects its information systems and data. An incident response plan aims to:
Detect and identify the incident as soon as possible.
Contain and isolate the incident to prevent further damage or spread.
Analyze and investigate the incident to determine its cause, scope, and impact.
Eradicate and eliminate the incident and its root causes from the affected systems and data.
Recover and restore the normal operations and functionality of the systems and data.
Learn and improve from the incident by documenting the lessons learned, best practices, and recommendations for future prevention and mitigation.
By following an incident response plan, the organization can minimize the negative consequences of an adverse event on its information assets, such as:
Loss or corruption of data or information.
Disclosure or theft of confidential or sensitive data or information.
Interruption or degradation of system or service availability or performance.
Legal or regulatory noncompliance or liability.
Financial or reputational loss or damage.
An incident response plan also helps the organization to demonstrate its due diligence and accountability in protecting its information assets and complying with its legal and contractual obligations.
The other options are not the primary purpose of an incident response plan, although they may be secondary benefits or outcomes of having one.
Increasing the effectiveness of preventive controls is not the primary purpose of an incident response plan.
Preventive controls are controls that aim to prevent or deter incidents from occurring in the first place, such as firewalls, antivirus software, encryption, authentication, etc. An incident response plan is a reactive control that deals with incidents after they have occurred. However, an incident response plan may help to improve the effectiveness of preventive controls by identifying and addressing their weaknesses or gaps.
Reducing the maximum tolerable downtime (MTD) of impacted systems is not the primary purpose of an incident response plan. MTD is a measure of how long an organization can tolerate a system or service outage before it causes unacceptable harm or loss to its business operations or objectives. An incident response plan may help to reduce the MTD of impacted systems by facilitating a faster and smoother recovery process.
However, reducing the MTD is not the main goal of an incident response plan, but rather a desired outcome.
Increasing awareness of impacts from adverse events to IT systems is not the primary purpose of an incident response plan. Awareness is a state of being informed or conscious of something. An incident response plan may help to increase awareness of impacts from adverse events to IT systems by providing information and communication channels for stakeholders, such as management, employees, customers, regulators, etc.
However, increasing awareness is not the main objective of an incident response plan, but rather a means to achieve other objectives, such as reducing impact, ensuring compliance, or maintaining trust.
- 다른 버전
- 3855ISACA.CISA-KR.v2026-05-16.q709
- 1755ISACA.CISA-KR.v2026-05-06.q261
- 3092ISACA.CISA-KR.v2026-03-16.q665
- 4443ISACA.CISA-KR.v2026-03-07.q651
- 9180ISACA.CISA-KR.v2025-04-07.q633
- 4437ISACA.CISA-KR.v2025-04-03.q628
- 3635ISACA.CISA-KR.v2025-04-02.q544
- 4193ISACA.CISA-KR.v2025-03-31.q534
- 5299ISACA.CISA-KR.v2025-03-28.q617
- 3073ISACA.CISA-KR.v2025-03-19.q581
- 3958ISACA.CISA-KR.v2025-03-03.q807
- 2791ISACA.CISA-KR.v2024-01-31.q392
- 5260ISACA.CISA-KR.v2023-10-24.q329
- 5162ISACA.CISA-KR.v2023-07-31.q266
- 3097ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 216Microsoft.PL-600.v2026-08-11.q206
- 153Microsoft.DP-100.v2026-08-11.q160
- 155Oracle.1Z0-1048-25.v2026-08-11.q68
- 131ISQI.CTAL-TAE.v2026-08-11.q37
- 171ServiceNow.CIS-HR.v2026-08-11.q84
- 254Salesforce.Plat-Arch-201.v2026-08-10.q101
- 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 189F5.F5CAB2.v2026-08-10.q41
- 288APA.CPP-Remote.v2026-08-08.q109
- 149SAP.C_BCBAI_2601.v2026-08-08.q9
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2024-02-07.q421 모의시험 시험자료를 다운 받으세요.