CISA-KR 문제 391
시설 입구에 생체인식 출입장치를 설치하는 경우 어떤 종류의 통제를 시행하고 있나요?
정답: A
A biometric access device installed at the entrance to a facility is a type of preventive control. Preventive controls are designed to deter or prevent undesirable events from occurring12. They are proactive measures that aim to inhibit incidents before they happen12. In this case, the biometric access device prevents unauthorized individuals from gaining access to the facility by requiring unique biological characteristics for authentication12.
References:
Guide to Biometric Access Control & Door Lock Security - Avigilon
Biometric access control: meaning, types and implementation - Smowl
References:
Guide to Biometric Access Control & Door Lock Security - Avigilon
Biometric access control: meaning, types and implementation - Smowl
CISA-KR 문제 392
데이터 분류 프로그램을 구현할 때 다음 중 가장 중요한 것은 무엇입니까?
정답: B
Data classification is the process of organizing data into categories based on its sensitivity, value, and risk to the organization. Data classification helps to ensure that data is protected according to its importance and regulatory requirements. Data classification also enables data owners to make informed decisions about data access, retention, and disposal.
To implement a data classification program, it is most important to formalize data ownership. Data owners are the individuals or business units that have the authority and responsibility for the data they create or use. Data owners should be involved in defining the data classification levels, assigning the appropriate classification to their data, and ensuring that the data is handled according to the established policies and procedures. Data owners should also review and update the data classification periodically or when there are changes in the data or its usage.
The other options are not as important as formalizing data ownership when implementing a data classification program. Understanding the data classification levels is necessary, but it is not sufficient without identifying the data owners who will apply them. Developing a privacy policy is a good practice, but it is not specific to data classification. Planning for secure storage capacity is a technical consideration, but it does not address the business and legal aspects of data classification.
References:
* ISACA, CISA Review Manual, 27th Edition, 2020, page 247
* Data Classification: What It Is and Howto Implement It
To implement a data classification program, it is most important to formalize data ownership. Data owners are the individuals or business units that have the authority and responsibility for the data they create or use. Data owners should be involved in defining the data classification levels, assigning the appropriate classification to their data, and ensuring that the data is handled according to the established policies and procedures. Data owners should also review and update the data classification periodically or when there are changes in the data or its usage.
The other options are not as important as formalizing data ownership when implementing a data classification program. Understanding the data classification levels is necessary, but it is not sufficient without identifying the data owners who will apply them. Developing a privacy policy is a good practice, but it is not specific to data classification. Planning for secure storage capacity is a technical consideration, but it does not address the business and legal aspects of data classification.
References:
* ISACA, CISA Review Manual, 27th Edition, 2020, page 247
* Data Classification: What It Is and Howto Implement It
CISA-KR 문제 393
다음 중 재해 복구 계획(DRP) 테스트가 성공적이었는지 확인하는 가장 좋은 방법은 무엇입니까?
정답: A
The best way to determine whether a test of a disaster recovery plan (DRP) was successful is to analyze whether predetermined test objectives were met. Test objectives are specific, measurable, achievable, relevant, and time-bound (SMART) goals that define what the test aims to accomplish and how it will be evaluated. Test objectives should be aligned with the DRP objectives and scope, and should cover aspects such as recovery time objectives (RTOs), recovery point objectives (RPOs), critical business functions, roles and responsibilities, communication channels, backup systems, and contingency procedures. By comparing the actual test results with the expected test objectives, the IS auditor can measure the effectiveness and efficiency of the DRP and identify any gaps or weaknesses that need to be addressed.
CISA-KR 문제 394
소규모 사업 단위에서 통제 자체 평가(CSA) 프로그램을 구현하고 내부 감사 기능을 활용하여 매년 내부 통제를 테스트하고 있습니다. 다음 중 이 접근 방식의 가장 중요한 이점은 무엇입니까?
정답: B
The most significant benefit of implementing a control self-assessment (CSA) program and leveraging the internal audit function to test its internal controls annually is that risks are detected earlier. A CSA program is a process that enables business owners and managers to assess and improve their own internal controls on a regular basis, without relying on external auditors or consultants. A CSA program can help identify and mitigate risks, enhance performance, increase accountability, and foster a culture of control within the organization. By leveraging the internal audit function to test its internal controls annually, a small business unit can also obtain independent assurance and validation of its CSA results, as well as recommendations for improvement. This approach can help reduce compliance costs, as external audits may be less frequent or extensive. However, this is not the most significant benefit, as compliance costs are only one aspect of the total cost of risk. Business owners can also focus more on their core roles, as they can delegate some of their control responsibilities to their staff or teams through CSA. However, this is not the most significant benefit, as business owners still need to oversee and monitor their CSA activities and results, and ensure that they align with their strategic objectives and priorities. Line management may also be more motivated to avoid control exceptions, as they are directly involved in assessing and improving their own controls through CSA.
However, this is not the most significant benefit, as motivation alone may not be sufficient to ensure effective control design and operation. References: Info Technology & Systems Resources | COBIT, Risk, Governance
... - ISACA, IT Governance and Process Maturity
However, this is not the most significant benefit, as motivation alone may not be sufficient to ensure effective control design and operation. References: Info Technology & Systems Resources | COBIT, Risk, Governance
... - ISACA, IT Governance and Process Maturity
CISA-KR 문제 395
IS 감사원은 사업 비용 청구 시스템 내에서 사기를 방지하는 프로세스를 검토하라는 임무를 받았습니다. 다음 이해 관계자 중 이 검토에 가장 중요한 것은 무엇입니까?
정답: D
The business process owner is the most important stakeholder to involve in the review of the processes that prevent fraud within a business expense claim system. This is because the business process owner is responsible for defining, implementing, and monitoring the business rules and policies that govern the expense claim process. The business process owner also has the authority and accountability to approve or reject expense claims, as well as to investigate and report any suspicious or fraudulent activities. The business process owner can provide valuable insights and feedback to the IS auditor on the effectiveness and efficiency of the current processes, aswell as the potential risks and controls that need to be addressed12.
The information security manager is not the most important stakeholder because their role is mainly focused on ensuring the confidentiality, integrity, and availability of the information systems and data that support the expense claim process. The information security manager can help the IS auditor with assessing the technical aspects of the system, such as access controls, encryption, logging, and backup, but they may not have sufficient knowledge or authority over the business rules and policies that prevent fraud1.
The quality assurance (QA) manager is not the most important stakeholder because their role is mainly focused on ensuring the quality and reliability of the software applications and systems that support the expense claim process. The QA manager can help the IS auditor with testing and verifying the functionality and performanceof the system, but they may not have sufficient knowledge or authority over the business rules and policies that prevent fraud1.
The business department executive is not the most important stakeholder because their role is mainly focused on overseeing the strategic objectives and financial performance of the business department that uses the expense claim system. The business department executive can help the IS auditor with understanding the business context and needs of the expense claim process, but they may not have sufficient knowledge or authority over the operational details and controls that prevent fraud
The information security manager is not the most important stakeholder because their role is mainly focused on ensuring the confidentiality, integrity, and availability of the information systems and data that support the expense claim process. The information security manager can help the IS auditor with assessing the technical aspects of the system, such as access controls, encryption, logging, and backup, but they may not have sufficient knowledge or authority over the business rules and policies that prevent fraud1.
The quality assurance (QA) manager is not the most important stakeholder because their role is mainly focused on ensuring the quality and reliability of the software applications and systems that support the expense claim process. The QA manager can help the IS auditor with testing and verifying the functionality and performanceof the system, but they may not have sufficient knowledge or authority over the business rules and policies that prevent fraud1.
The business department executive is not the most important stakeholder because their role is mainly focused on overseeing the strategic objectives and financial performance of the business department that uses the expense claim system. The business department executive can help the IS auditor with understanding the business context and needs of the expense claim process, but they may not have sufficient knowledge or authority over the operational details and controls that prevent fraud
- 다른 버전
- 4088ISACA.CISA-KR.v2026-05-16.q709
- 1819ISACA.CISA-KR.v2026-05-06.q261
- 3148ISACA.CISA-KR.v2026-03-16.q665
- 4528ISACA.CISA-KR.v2026-03-07.q651
- 9316ISACA.CISA-KR.v2025-04-07.q633
- 4465ISACA.CISA-KR.v2025-04-03.q628
- 3713ISACA.CISA-KR.v2025-04-02.q544
- 4244ISACA.CISA-KR.v2025-03-31.q534
- 5347ISACA.CISA-KR.v2025-03-28.q617
- 4045ISACA.CISA-KR.v2025-03-03.q807
- 5214ISACA.CISA-KR.v2024-02-07.q421
- 2869ISACA.CISA-KR.v2024-01-31.q392
- 5385ISACA.CISA-KR.v2023-10-24.q329
- 5219ISACA.CISA-KR.v2023-07-31.q266
- 3212ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 125Microsoft.AZ-305-KR.v2026-08-14.q177
- 164Microsoft.DP-900-KR.v2026-08-13.q130
- 270Microsoft.PL-600.v2026-08-11.q206
- 204Microsoft.DP-100.v2026-08-11.q160
- 185Oracle.1Z0-1048-25.v2026-08-11.q68
- 154ISQI.CTAL-TAE.v2026-08-11.q37
- 198ServiceNow.CIS-HR.v2026-08-11.q84
- 259Salesforce.Plat-Arch-201.v2026-08-10.q101
- 247Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 193F5.F5CAB2.v2026-08-10.q41
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-19.q581 모의시험 시험자료를 다운 받으세요.