무료 온라인 액세스 ISACA.CISA-KR.v2025-03-31.q534 모의 시험 (Page 18)

CISA-KR 문제 81

IS 감사원이 ERP(Enterprise Resource Planning) 시스템에서 업무 분리 문제를 발견했습니다. 다음 중 어떤 것이 잘못된 구성이 반복되는 것을 방지하는 가장 좋은 방법입니까?

A. 정기적으로 접근 권한 모니터링

B. 표준 사용자 액세스 매트릭스 참조

C. 역할 기반 모델을 사용하여 사용자 액세스 권한 부여

D. 업무분장 갈등 해결

정답: C

The best way to prevent the misconfiguration from recurring is to grant user access using a role-based model. A role-based access control (RBAC) model is an access control method that assigns permissions to end-users based on their role within the organization1. RBAC provides fine-grained control, offering a simple, manageable approach to access management that is less error-prone than individually assigning permissions1. RBAC also enforces the principle of least privilege, which means that users only have the minimum access required to perform their tasks2.
A role-based model can help prevent segregation of duties (SoD) issues in an ERP system by restricting user access to conflicting activities within the application. SoD is a central issue for enterprises to ensure compliance with laws and regulations, and to reduce the risk of fraud and unauthorized transactions3. SoD requires that no single individual or group of individuals should have control over two or more parts of a process or an asset3. For example, a user who can create and approve purchase orders should not be able to process payments or modify vendor records.
By using a role-based model, user access provisioning is based on the needs of a group (e.g., accounting department) based on common responsibilities and needs1. This means each role has a given set of permissions, and individuals can be assigned to one or more roles. For example, you may designate a user as an accounts payable clerk, an accounts receivable clerk, or a financial manager, and limit access to specific resources or tasks. The user-role and role-permissions relationships make it easy to perform role assignment because individual users no longer have unique access rights, rather they have privileges that conform to the permissions assigned to their specific role or job function1.
The other options are not the best way to prevent the misconfiguration from recurring. Monitoring access rights on a regular basis (option A) is a detective control that can help identify SoD issues after they occur, but it does not prevent them from happening in the first place. Referencing a standard user-access matrix (option B) is a tool that can help document and analyze user access rights, but it does not ensure that the user access rights are configured correctly or consistently. Correcting the segregation of duties conflicts (option D) is a corrective action that can resolve SoD issues once they are detected, but it does not prevent them from happening again.
References: 3: Implementing Segregation of Duties: A Practical Experience Based on Best Practices 1: What is Role-Based Access Control (RBAC)? Examples, Benefits, and More 2: What is Azure role-based access control (Azure RBAC)?

CISA-KR 문제 82

IS 감사원이 법의학적 조사를 지원하고 있습니다. 영향을 받은 저장 매체의 이미지가 디지털 법의학적 증거를 수집하는 동안 캡처되었습니다. 다음 중 어떤 기술을 사용하면 IS 감사원이 캡처된 이미지가 원본 매체의 정확하고 변경되지 않은 복제본인지 확인하는 데 가장 적합할까요?

A. 접근 제어 목록

B. 파일 할당 테이블

C. 파일 크기

D. 해시값

CISA-KR 문제 83

소프트웨어 개발의 폭포수 라이프사이클 모델은 다음 중 어떤 상황에 가장 적합할까요?

A. 보호 요구 사항이 이해되었습니다.

B. 이 프로젝트는 시간적 압박을 받고 있습니다.

C. 이 프로젝트에서는 객체 지향적 설계 방식을 적용하려고 합니다.

D. 이 프로젝트에는 새로운 기술이 사용될 예정입니다.

정답: A

The waterfall life cycle model of software development is best suited for situations where the project requirements are well understood. The waterfall life cycle model is a sequential and linear approach to software development that consists of several phases, such as planning, analysis, design, implementation, testing, and maintenance. Each phase depends on the completion and approval of the previous phase before proceeding to the next phase. The waterfall life cycle model is best suited for situations where the project requirements are well understood, as it assumes that the requirements are clear, stable, and fixed at the beginning of the project, and do not change significantly throughout the project. The project is subject to time pressures is not a situation where the waterfall life cycle model of software development is best suited, as it may not be flexible or agile enough to accommodate changes or adjustments in the project schedule or timeline. The waterfall life cycle model may involve long delays or dependencies between phases, and may not allow for early feedback or delivery of software products. The project intends to apply an object-oriented design approach is not a situation where the waterfall life cycle model of software development is best suited, as it may not be compatible or effective with the object-oriented design approach. The object-oriented design approach is a technique that models software as a collection of interacting objects that have attributes and behaviors. The object-oriented design approach may require iterative and incremental development methods that allow for dynamic and adaptive changes in software design and functionality. The project will involve the use of new technology is not a situation where the waterfall life cycle model of software development is best suited, as it may not be able to cope with the uncertainty or complexity of new technology. The waterfall life cycle model may not allow for sufficient exploration or experimentation with new technology, and may not be able to handle changes or issues that arise from new technology.

CISA-KR 문제 84

한 조직이 최근 고객에게 대출을 제공하기 위한 지능형 에이전트 소프트웨어를 인수하여 구현했습니다. 구현 후 검토 중에 IS 감사자가 수행해야 하는 가장 중요한 절차는 다음 중 어느 것입니까?

A. 거래 정확성을 확인하기 위해 시스템 및 오류 로그를 검토하세요.

B. 시스템 결정의 정확성을 확인하기 위해 입력 및 출력 제어 보고서를 검토합니다.

C. 시스템 결정에 대한 책임이 명확하게 정의되어 있는지 확인하기 위해 서명된 승인을 검토합니다.

D. 완전성을 확인하기 위해 시스템 문서를 검토하세요.

CISA-KR 문제 85

암호화된 데이터에 대한 무차별 대입 공격이 테스트에서 성공할 경우 위험을 평가하는 IS 감사자에게 가장 중요한 조건은 무엇일까요?

A. 짧은 키 길이

B. 랜덤 키 생성

C. 대칭 암호화 사용

D. 비대칭 암호화 사용

다른 버전: 218ISACA.CISA-KR.v2026-08-15.q712; 4174ISACA.CISA-KR.v2026-05-16.q709; 1823ISACA.CISA-KR.v2026-05-06.q261; 3176ISACA.CISA-KR.v2026-03-16.q665; 4589ISACA.CISA-KR.v2026-03-07.q651; 9334ISACA.CISA-KR.v2025-04-07.q633; 4487ISACA.CISA-KR.v2025-04-03.q628; 3724ISACA.CISA-KR.v2025-04-02.q544; 5410ISACA.CISA-KR.v2025-03-28.q617; 3252ISACA.CISA-KR.v2025-03-19.q581; 4056ISACA.CISA-KR.v2025-03-03.q807; 5218ISACA.CISA-KR.v2024-02-07.q421; 2871ISACA.CISA-KR.v2024-01-31.q392; 5388ISACA.CISA-KR.v2023-10-24.q329; 5230ISACA.CISA-KR.v2023-07-31.q266; 3229ISACA.CISA-KR.v2023-06-23.q324

최근 업로드: 218ISACA.CISA-KR.v2026-08-15.q712; 165Microsoft.MS-700-KR.v2026-08-15.q203; 129Microsoft.AZ-305-KR.v2026-08-14.q177; 188Microsoft.DP-900-KR.v2026-08-13.q130; 279Microsoft.PL-600.v2026-08-11.q206; 218Microsoft.DP-100.v2026-08-11.q160; 187Oracle.1Z0-1048-25.v2026-08-11.q68; 159ISQI.CTAL-TAE.v2026-08-11.q37; 200ServiceNow.CIS-HR.v2026-08-11.q84; 279Salesforce.Plat-Arch-201.v2026-08-10.q101