CISA-KR 문제 11
References
ISACA CISA Review Manual, 27th Edition, page 256
Materiality in Auditing - AICPA
Materiality in Planning and Performing an Audit - IAASB
CISA-KR 문제 12
Completed test plans are only documents that outline the scope, objectives, and procedures of the BCP testing, but they do not show the outcomes or issues encountered during the testing. Updated inventory of systems is a component of the BCP that identifies the critical systems and resources required for business continuity, but it does not measure the effectiveness of the BCP changes. Change management processes are controls that ensure that changes to the BCP are authorized, documented, and communicated, but they do not evaluate the impact or benefit of the changes. References: CISA Review Manual (Digital Version), Chapter 4, Section 4.2.3
CISA-KR 문제 13
SFTP (Secure File Transfer Protocol)is the most secure option for transferring data over the internet, as it encrypts both commands and data, ensuring confidentiality and integrity.
* SFTP (Correct Answer - C)
* Uses SSH (Secure Shell) for encryption.
* Provides authentication and encryption for secure data transfers.
* Example:A company uses SFTP to securely transmit payroll files to a third-party processor.
* UDP (Incorrect - A)
* Faster but lacks encryption and data integrity checks.
* HTTP (Incorrect - B)
* Transfers data in plaintext and is vulnerable to interception.
* RDP (Incorrect - D)
* Used for remote desktop access, not secure file transfers.
References:
* ISACA CISA Review Manual
* NIST 800-52 (Guidelines for Transport Layer Security)
CISA-KR 문제 14
Some examples of control objectives for an information protection audit are:
To ensure that the information stored in the application is classified according to its sensitivity, value, and regulatory requirements To ensure that the information stored in the application is encrypted, masked, or anonymized as appropriate To ensure that the information stored in the application is accessible only by authorized users and processes To ensure that the information stored in the application is backed up, restored, and retained according to the business continuity and retention policies To ensure that the information stored in the application is monitored, logged, and audited for any unauthorized or anomalous activities Therefore, option B is the correct answer.
Option A is not correct because reviewing remediation reports is not the most important action before the audit work begins. Remediation reports are documents that describe how previous audit findings or issues have been resolved or addressed by the auditee4. While reviewing remediation reports may be useful for understanding the current state of information protection in the application, it is not a prerequisite for defining the control objectives of the audit.
Option C is not correct because assessing the threat landscape is not the most important action before the audit work begins. The threat landscape is the set of potential sources, methods, and impacts of cyberattacks or data breaches that may affect the information stored in the application5. While assessing the threat landscape may be helpful for identifying and prioritizing the risks and vulnerabilities of information protection in the application, it is not a prerequisite for defining the control objectives of the audit.
Option D is not correct because performing penetration testing is not the most important action before the audit work begins. Penetration testing is a technique that simulates real-world cyberattacks or data breaches to test the security and resilience of information systems or applications.
CISA-KR 문제 15
Retesting the control is not necessary, as management has already decided not to implement therecommendations. Closing the audit finding is premature, as management's decision may not be aligned with the audit objectives or risk appetite. References: CISA Review Manual (Digital Version), Chapter 2, Section 2.4
- 다른 버전
- 193ISACA.CISA-KR.v2026-08-15.q712
- 4116ISACA.CISA-KR.v2026-05-16.q709
- 1821ISACA.CISA-KR.v2026-05-06.q261
- 3153ISACA.CISA-KR.v2026-03-16.q665
- 4536ISACA.CISA-KR.v2026-03-07.q651
- 9318ISACA.CISA-KR.v2025-04-07.q633
- 4472ISACA.CISA-KR.v2025-04-03.q628
- 3719ISACA.CISA-KR.v2025-04-02.q544
- 4247ISACA.CISA-KR.v2025-03-31.q534
- 3245ISACA.CISA-KR.v2025-03-19.q581
- 4050ISACA.CISA-KR.v2025-03-03.q807
- 5215ISACA.CISA-KR.v2024-02-07.q421
- 2871ISACA.CISA-KR.v2024-01-31.q392
- 5386ISACA.CISA-KR.v2023-10-24.q329
- 5228ISACA.CISA-KR.v2023-07-31.q266
- 3222ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 193ISACA.CISA-KR.v2026-08-15.q712
- 147Microsoft.MS-700-KR.v2026-08-15.q203
- 125Microsoft.AZ-305-KR.v2026-08-14.q177
- 180Microsoft.DP-900-KR.v2026-08-13.q130
- 278Microsoft.PL-600.v2026-08-11.q206
- 217Microsoft.DP-100.v2026-08-11.q160
- 186Oracle.1Z0-1048-25.v2026-08-11.q68
- 158ISQI.CTAL-TAE.v2026-08-11.q37
- 200ServiceNow.CIS-HR.v2026-08-11.q84
- 262Salesforce.Plat-Arch-201.v2026-08-10.q101
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-28.q617 모의시험 시험자료를 다운 받으세요.