CISA-KR 문제 151
소프트웨어 개발 라이프 사이클의 어느 단계에서 애플리케이션 제어에 대한 논의를 시작하는 것이 가장 좋을까요?
정답: B
The best phase of the software development life cycle to initiate the discussion of application controls is the application design phase when process functionalities are finalized. Application controls are the policies, procedures, and techniques that ensure the completeness, accuracy, validity, and authorization of data input, processing, output, and storage in an application. Application controls help prevent, detect, or correct errors and fraud in software applications. Examples of application controls include input validation, edit checks, reconciliation, encryption, access control, audit trails, etc.
The application design phase is when the software requirements are translated into a logical and physical design that specifies how the application will look and work. This phase is the best time to discuss application controls because it allows the developers to incorporate them into the design specifications and ensure that they are aligned with the business objectives and user needs. By discussing application controls early in the design phase, the developers can also avoid costly rework or changes later in the development process.
The other phases are not as optimal as the application design phase to initiate the discussion of application controls. A. Business case development phase when stakeholders are identified. The business case development phase is when the feasibility, scope, objectives, benefits, risks, and costs of a software project are defined and evaluated. This phase is important for obtaining stakeholder approval and support for the project, but it is too early to discuss application controls in detail because the software requirements and functionalities are not yet clear or finalized. B. User acceptance testing (UAT) phase when test scenarios are designed. The user acceptance testing phase is when the software is tested by the end-users or stakeholders to verify that it meets their expectations and requirements. This phase is too late to discuss application controls because it is near the end of the development process and any changes or additions to the application controls would require retesting and revalidation of the software. C. Application coding phase when algorithms are developed to solve business problems. The application coding phase is when the software design is translated into executable code using programming languages and tools. This phase is not ideal to discuss application controls because it is after the design phase and any changes or additions to the application controls would require redesigning and recoding of the software.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
* What Is Application Control? | McAfee3
* What Is Application Lifecycle Management? | Red Hat4
The application design phase is when the software requirements are translated into a logical and physical design that specifies how the application will look and work. This phase is the best time to discuss application controls because it allows the developers to incorporate them into the design specifications and ensure that they are aligned with the business objectives and user needs. By discussing application controls early in the design phase, the developers can also avoid costly rework or changes later in the development process.
The other phases are not as optimal as the application design phase to initiate the discussion of application controls. A. Business case development phase when stakeholders are identified. The business case development phase is when the feasibility, scope, objectives, benefits, risks, and costs of a software project are defined and evaluated. This phase is important for obtaining stakeholder approval and support for the project, but it is too early to discuss application controls in detail because the software requirements and functionalities are not yet clear or finalized. B. User acceptance testing (UAT) phase when test scenarios are designed. The user acceptance testing phase is when the software is tested by the end-users or stakeholders to verify that it meets their expectations and requirements. This phase is too late to discuss application controls because it is near the end of the development process and any changes or additions to the application controls would require retesting and revalidation of the software. C. Application coding phase when algorithms are developed to solve business problems. The application coding phase is when the software design is translated into executable code using programming languages and tools. This phase is not ideal to discuss application controls because it is after the design phase and any changes or additions to the application controls would require redesigning and recoding of the software.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
* What Is Application Control? | McAfee3
* What Is Application Lifecycle Management? | Red Hat4
CISA-KR 문제 152
다음 중 어떤 것이 애자일 방식으로 개발된 소프트웨어에 점진적으로 변경을 가할 때 개발팀이 잠재적인 보안 문제를 고려하도록 하는 데 가장 도움이 될까요?
정답: C
The best way to ensure that potential security issues are considered by the development team as part of incremental changes to agile-developed software is to include a mandatory step to analyze the security impact when making changes. This will help to identify and mitigate any security risks or vulnerabilities that may arise from the changes, and to ensure that the software meets the security requirements and standards. The other options are not as effective, because they either delegate the security analysis to someone outside the development team, rely on post-deployment testing, or focus on documentation rather than analysis.
References: CISA Review Manual (Digital Version)1, Chapter 4, Section 4.2.5
References: CISA Review Manual (Digital Version)1, Chapter 4, Section 4.2.5
CISA-KR 문제 153
재무 애플리케이션 감사 중에 많은 해지된 사용자의 계정이 비활성화되지 않은 것으로 확인되었습니다. 다음 중 IS 감사원의 다음 단계는 무엇이어야 합니까?
정답: B
The IS auditor's next step after determining that many terminated users' accounts were not disabled is to perform a review of terminated users' account activity. This means that the IS auditor should check whether any of the terminated users' accounts were accessed or used after their termination date, which could indicate unauthorized or fraudulent activity. The IS auditor should also assess the impact and risk of such activity on the confidentiality, integrity, and availability of IT resources and data. The other options are not as appropriate as performing a review of terminated users' account activity, as they do not provide sufficient evidence or assurance of the extent and effect of the problem. References: CISA Review Manual, 27th Edition, page 240
CISA-KR 문제 154
IS 감사자는 다음 시스템 개발 수명 주기(SDLC) 단계 중 어느 단계에서 통제가 시스템 사양에 통합되었는지 확인할 것으로 예상합니까?
정답: D
The design phase of the system development life cycle (SDLC) is where an IS auditor would expect to find that controlshave been incorporated into system specifications, because this is where the system requirements are translated intodetailed design specifications that include the technical, functional, and security aspects of the system34. The implementation phase iswhere the system is deployed and tested, the development phase is where the system is codedand unit tested, and thefeasibility phase is where the system objectives and scope are defined. References: 3: CISA Review Manual (Digital Version), Chapter 4, Section 4.2.2 4: CISA Online Review Course, Module 4, Lesson 2
CISA-KR 문제 155
대규모 조직에서 IT 리소스의 우선순위가 적절하게 지정되지 않아 중요한 프로젝트의 IT 마감일이 놓쳤습니다. 이 문제를 해결하기 위한 가장 좋은 권장 사항은 다음 중 무엇입니까?
정답: B
The best recommendation to address the problem of missing IT deadlines on important projects because IT resources are not prioritized properly is to implement project portfolio management (PPM). PPM is the process of analyzing and optimizing the costs, resources, technologies, and processes for all the projects and programs within a portfolio. A portfolio is a collection of projects, programs, and processes that are managed together and aligned with the strategic goals and objectives of the organization. PPM can help the organization to:
Prioritize the most valuable and relevant projects and programs based on their alignment with the organizational strategy, vision, and mission.
Balance the portfolio to ensure that the projects and programs are diversified, feasible, and sustainable, and that they meet the needs and expectations of the stakeholders.
Optimize the allocation, utilization, and coordination of IT resources across the portfolio, such as staff, budget, time, equipment, and software.
Monitor and control the performance and progress of the projects and programs within the portfolio, and evaluate their outcomes and benefits.
By implementing PPM, the organization can improve its IT project delivery and avoid missing deadlines.
PPM can also help the organization to increase its efficiency, effectiveness, quality, and value. For more information about PPM, you can refer to the following web search results:
Project Portfolio Management (PPM): The Ultimate Guide - ProjectManager1 A Complete Overview of Project Portfolio Management - Smartsheet2 PPM 101: What Is Project Portfolio Management?3
Prioritize the most valuable and relevant projects and programs based on their alignment with the organizational strategy, vision, and mission.
Balance the portfolio to ensure that the projects and programs are diversified, feasible, and sustainable, and that they meet the needs and expectations of the stakeholders.
Optimize the allocation, utilization, and coordination of IT resources across the portfolio, such as staff, budget, time, equipment, and software.
Monitor and control the performance and progress of the projects and programs within the portfolio, and evaluate their outcomes and benefits.
By implementing PPM, the organization can improve its IT project delivery and avoid missing deadlines.
PPM can also help the organization to increase its efficiency, effectiveness, quality, and value. For more information about PPM, you can refer to the following web search results:
Project Portfolio Management (PPM): The Ultimate Guide - ProjectManager1 A Complete Overview of Project Portfolio Management - Smartsheet2 PPM 101: What Is Project Portfolio Management?3
- 다른 버전
- 3874ISACA.CISA-KR.v2026-05-16.q709
- 1778ISACA.CISA-KR.v2026-05-06.q261
- 3095ISACA.CISA-KR.v2026-03-16.q665
- 4447ISACA.CISA-KR.v2026-03-07.q651
- 9186ISACA.CISA-KR.v2025-04-07.q633
- 4439ISACA.CISA-KR.v2025-04-03.q628
- 3639ISACA.CISA-KR.v2025-04-02.q544
- 4200ISACA.CISA-KR.v2025-03-31.q534
- 5303ISACA.CISA-KR.v2025-03-28.q617
- 3962ISACA.CISA-KR.v2025-03-03.q807
- 5112ISACA.CISA-KR.v2024-02-07.q421
- 2793ISACA.CISA-KR.v2024-01-31.q392
- 5260ISACA.CISA-KR.v2023-10-24.q329
- 5188ISACA.CISA-KR.v2023-07-31.q266
- 3098ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 120Microsoft.DP-900-KR.v2026-08-13.q130
- 227Microsoft.PL-600.v2026-08-11.q206
- 168Microsoft.DP-100.v2026-08-11.q160
- 167Oracle.1Z0-1048-25.v2026-08-11.q68
- 140ISQI.CTAL-TAE.v2026-08-11.q37
- 184ServiceNow.CIS-HR.v2026-08-11.q84
- 255Salesforce.Plat-Arch-201.v2026-08-10.q101
- 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 189F5.F5CAB2.v2026-08-10.q41
- 296APA.CPP-Remote.v2026-08-08.q109
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-19.q581 모의시험 시험자료를 다운 받으세요.