CISA-KR 문제 126
SQL 주입 취약점을 해결하는 가장 좋은 제어 방법은 무엇입니까?
정답: C
Input validation is the best control to address SQL injection vulnerabilities, because it can prevent malicious users from entering SQL commands or statements into input fields that are intended for data entry, such as usernames or passwords. SQL injection is a technique that exploits a security vulnerability in an application's software by inserting SQL code into a query string that can execute commands on a database server. Unicode translation, SSL encryption, and digital signatures are not effectivecontrols against SQL injection, because they do not prevent or detect SQL code injection into input fields. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.2
CISA-KR 문제 127
운영 체제 감사 중에 기준 이미지를 얻는 주된 목적은 무엇입니까?
정답: A
The primary purpose of obtaining a baseline image during an operating system audit is to identify atypical running processes. A baseline image is a snapshot of the normal state and configuration of an operating system, including the processes that are expected to run on it. By comparing the current state of the operating system with the baseline image, an IS auditor can detect any deviations or anomalies that may indicate unauthorized or malicious activity, such as malware infection, privilege escalation, or data exfiltration. A baseline image can also help an IS auditor to assess the performance and efficiency of the operating system, as well as its compliance with security standards and policies.
Verifying antivirus definitions (option B) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Antivirus definitions are the files that contain the signatures and rules for detecting and removing malware. An IS auditor may verify that the antivirus definitions are up to date and consistent across the operating system, but this does not require obtaining a baseline image.
Identifying local administrator account access (option C) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Local administrator accounts are user accounts that have full control over the operating system and its resources. An IS auditor may identify and review the local administrator accounts to ensure that they are properly secured and authorized, but this does not require obtaining a baseline image.
Verifying the integrity of operating system backups (option D) is not the primary purpose of obtaining a baseline image, although it may be a part of the backup process. Operating system backups are copies of the operating system data and settings that can be used to restore the system in case of failure or disaster. An IS auditor may verify that the operating system backups are complete, accurate, and accessible, but this does not require obtaining a baseline image.
References: : Linux security and system hardening checklist : CISA Certification | Certified Information Systems Auditor | ISACA : CISA Certified Information Systems Auditor Study Guide, 4th Edition : CISA - Certified Information Systems Auditor Study Guide [Book]
Verifying antivirus definitions (option B) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Antivirus definitions are the files that contain the signatures and rules for detecting and removing malware. An IS auditor may verify that the antivirus definitions are up to date and consistent across the operating system, but this does not require obtaining a baseline image.
Identifying local administrator account access (option C) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Local administrator accounts are user accounts that have full control over the operating system and its resources. An IS auditor may identify and review the local administrator accounts to ensure that they are properly secured and authorized, but this does not require obtaining a baseline image.
Verifying the integrity of operating system backups (option D) is not the primary purpose of obtaining a baseline image, although it may be a part of the backup process. Operating system backups are copies of the operating system data and settings that can be used to restore the system in case of failure or disaster. An IS auditor may verify that the operating system backups are complete, accurate, and accessible, but this does not require obtaining a baseline image.
References: : Linux security and system hardening checklist : CISA Certification | Certified Information Systems Auditor | ISACA : CISA Certified Information Systems Auditor Study Guide, 4th Edition : CISA - Certified Information Systems Auditor Study Guide [Book]
CISA-KR 문제 128
IS 감사원은 성능을 높이기 위해 웹 애플리케이션의 검증 제어가 서버 측에서 브라우저로 옮겨졌다는 것을 발견했습니다. 이는 다음과 같은 이유로 성공적인 공격의 위험을 증가시킬 가능성이 가장 큽니다.
정답: A
Validation controls are used to check the input data from the user before processing it on the server. If the validation controls are moved from the server side to the browser, it means that the user can modify or bypass them using tools such as browser developer tools, JavaScript console, or proxy tools. This would increase the risk of a successful attack by structured query language (SQL) injection, which is a technique that exploits a security vulnerability in an application's software layer that allows an attacker to execute arbitrary SQL commands on the underlying database. SQL injection can result in data theft, data corruption, or unauthorized access to the system.
Buffer overflow, denial of service (DoS), and phishing are not directly related to the validation controls in a web application. Buffer overflow is a type of attack that exploits a memory management flaw in an application or system that allows an attacker to write data beyond the allocated buffer size and overwrite adjacent memory locations. DoS is a type of attack that prevents legitimate users from accessing a service or resource by overwhelming it with requests or traffic. Phishing is a type of attack that uses fraudulent emails or websites to trick users into revealing sensitive information or installing malware.
References:
Client-side form validation - Learn web development | MDN
JavaScript: client-side vs. server-side validation - Stack Overflow
SQL Injection - OWASP
Buffer overflow, denial of service (DoS), and phishing are not directly related to the validation controls in a web application. Buffer overflow is a type of attack that exploits a memory management flaw in an application or system that allows an attacker to write data beyond the allocated buffer size and overwrite adjacent memory locations. DoS is a type of attack that prevents legitimate users from accessing a service or resource by overwhelming it with requests or traffic. Phishing is a type of attack that uses fraudulent emails or websites to trick users into revealing sensitive information or installing malware.
References:
Client-side form validation - Learn web development | MDN
JavaScript: client-side vs. server-side validation - Stack Overflow
SQL Injection - OWASP
CISA-KR 문제 129
제3자 컨설턴트가 회계 시스템 교체를 관리하고 있습니다. 다음 중 IS 감사원의 가장 큰 관심사는 무엇입니까?
정답: C
The greatest concern for an IS auditor in this scenario is that the user department will manage access rights to the new accounting system. This could pose a significant risk of unauthorized access, segregation of duties violations, data tampering and fraud. The IS auditor should ensure that access rights are defined, approved and monitored by an independent function, such as IT security or internal audit. The other options are not as concerning as option C, as they can be mitigated by other controls or procedures. Data migration is an important part of the system replacement project, but it can be performed by another party or verified by the IS auditor. The timing of the replacement near year-end reporting is a challenge, but it can be managed by proper planning, testing and contingency plans. Testing performed by the third-party consultant is acceptable, as long as it is reviewed and validated by the IS auditor or another independent party. References: CISA Review Manual (Digital Version) 1, Chapter 3: Information Systems Acquisition, Development & Implementation, Section 3.4: System Implementation.
CISA-KR 문제 130
IS 감사원은 조직의 IT 전략이 연구 개발에 크게 집중되어 있는 반면, IT 포트폴리오의 대부분은 운영과 유지 관리에 집중되어 있다는 것을 발견했습니다. 잔디 깎기 중 가장 좋은 권장 사항은 무엇입니까?
정답: A
The best recommendation is to align the IT strategy with the business objectives. This will ensure that the IT projects and initiatives are consistent with the organization's vision, mission, and goals. IT strategy should be derived from and support the business strategy, not the other way around. By aligning the IT strategy with the business objectives, the organization can achieve better value, performance, and alignment from its IT investments.
Reviewing priorities in the IT portfolio (option B) is not the best recommendation, as it does not address the root cause of the misalignment between the IT strategy and the IT portfolio. The IT portfolio should reflect the IT strategy, which in turn should reflect the business objectives. Simply changing the priorities in the IT portfolio without aligning the IT strategy with the business objectives may result in suboptimal or conflicting outcomes.
Changing the IT strategy to focus on operational excellence (option C) is also not the best recommendation, as it may not be aligned with the business objectives. The organization's IT strategy should be based on its competitive advantage, market position, customer needs, and industry trends. If the organization's business strategy is heavily focused on research and development, then changing the IT strategy to focus on operational excellence may not be appropriate or beneficial.
Aligning the IT portfolio with the IT strategy (option D) is also not the best recommendation, as it does not address the misalignment between the IT strategy and the business objectives. Aligning the IT portfolio with the IT strategy may improve the coherence and consistency of the IT projects, but it may not ensure that they are aligned with the organization's vision, mission, and goals.
Therefore, option A is the correct answer.
References:
* The Challenges of Aligning IT and the Business | CIO Insight
* Strategic alignment and value maximization for IT project portfolios ...
* A Guide to IT Portfolio Management | Adobe Workfront
Reviewing priorities in the IT portfolio (option B) is not the best recommendation, as it does not address the root cause of the misalignment between the IT strategy and the IT portfolio. The IT portfolio should reflect the IT strategy, which in turn should reflect the business objectives. Simply changing the priorities in the IT portfolio without aligning the IT strategy with the business objectives may result in suboptimal or conflicting outcomes.
Changing the IT strategy to focus on operational excellence (option C) is also not the best recommendation, as it may not be aligned with the business objectives. The organization's IT strategy should be based on its competitive advantage, market position, customer needs, and industry trends. If the organization's business strategy is heavily focused on research and development, then changing the IT strategy to focus on operational excellence may not be appropriate or beneficial.
Aligning the IT portfolio with the IT strategy (option D) is also not the best recommendation, as it does not address the misalignment between the IT strategy and the business objectives. Aligning the IT portfolio with the IT strategy may improve the coherence and consistency of the IT projects, but it may not ensure that they are aligned with the organization's vision, mission, and goals.
Therefore, option A is the correct answer.
References:
* The Challenges of Aligning IT and the Business | CIO Insight
* Strategic alignment and value maximization for IT project portfolios ...
* A Guide to IT Portfolio Management | Adobe Workfront
- 다른 버전
- 3860ISACA.CISA-KR.v2026-05-16.q709
- 1770ISACA.CISA-KR.v2026-05-06.q261
- 3094ISACA.CISA-KR.v2026-03-16.q665
- 4445ISACA.CISA-KR.v2026-03-07.q651
- 9182ISACA.CISA-KR.v2025-04-07.q633
- 4438ISACA.CISA-KR.v2025-04-03.q628
- 3635ISACA.CISA-KR.v2025-04-02.q544
- 4196ISACA.CISA-KR.v2025-03-31.q534
- 5300ISACA.CISA-KR.v2025-03-28.q617
- 3960ISACA.CISA-KR.v2025-03-03.q807
- 5088ISACA.CISA-KR.v2024-02-07.q421
- 2793ISACA.CISA-KR.v2024-01-31.q392
- 5260ISACA.CISA-KR.v2023-10-24.q329
- 5178ISACA.CISA-KR.v2023-07-31.q266
- 3098ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 106Microsoft.DP-900-KR.v2026-08-13.q130
- 227Microsoft.PL-600.v2026-08-11.q206
- 165Microsoft.DP-100.v2026-08-11.q160
- 166Oracle.1Z0-1048-25.v2026-08-11.q68
- 140ISQI.CTAL-TAE.v2026-08-11.q37
- 183ServiceNow.CIS-HR.v2026-08-11.q84
- 255Salesforce.Plat-Arch-201.v2026-08-10.q101
- 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 189F5.F5CAB2.v2026-08-10.q41
- 292APA.CPP-Remote.v2026-08-08.q109
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-19.q581 모의시험 시험자료를 다운 받으세요.