CISA-KR 문제 131
악성 프로그램 코드가 애플리케이션에서 발견되어 프로덕션으로 출시되기 전에 수정되었습니다. 출시 후 동일한 문제가 보고되었습니다. 다음 중 IS 감사인의 가장 좋은 권장 사항은 무엇입니까?
정답: C
The IS auditor's best recommendation is to ensure that programmers cannot access code after the completion of program edits. This is because programmers who have access to code after editing may introduce unauthorized or malicious changes that could compromise the security, functionality, or performance of the application. By restricting access to code after editing, the organization can ensure that only authorized and tested code is released into production, and prevent any tampering or reoccurrence of the same issue.
References:
* 1 discusses the importance of controlling access to code after editing and testing, and provides some best practices for doing so.
* 2 explains how programmers can introduce malicious code into applications, and how to prevent and detect such attacks.
* 3 describes the role of IS auditors in reviewing and assessing the security and quality of application code.
References:
* 1 discusses the importance of controlling access to code after editing and testing, and provides some best practices for doing so.
* 2 explains how programmers can introduce malicious code into applications, and how to prevent and detect such attacks.
* 3 describes the role of IS auditors in reviewing and assessing the security and quality of application code.
CISA-KR 문제 132
데이터 웨어하우스(DW) 관리에서 소스 시스템의 변경으로 인해 발생하는 데이터 품질 문제를 방지하는 가장 좋은 방법은 무엇입니까?
정답: C
Including the data warehouse in the impact analysis for any changes in the source system is the best way to prevent data quality issues caused by changes from a source system. A data warehouse is a centralized repository of integrated data from one or more source systems. An impact analysis is a technique of assessing the potential effects and consequences of a change on the existing system or environment. Including the data warehouse in the impact analysis can help to identify and mitigate any data quality issues that may arise from changes in the source system, such as data inconsistency, incompleteness, or inaccuracy. The other options are less effective ways to prevent data quality issues, as they may involve data quality alerts, approval for changes, or access restrictions. References:
* CISA Review Manual (Digital Version), Chapter 5, Section 5.41
* CISA Review Questions, Answers & Explanations Database, Question ID 226
* CISA Review Manual (Digital Version), Chapter 5, Section 5.41
* CISA Review Questions, Answers & Explanations Database, Question ID 226
CISA-KR 문제 133
다음 표집 방법 중 단 하나의 오차가 발견되면 전체 표본이 불규칙하다고 간주되는 것은 무엇입니까?
정답: A
The sampling method in which the entire sample is considered to be irregular if a single error is found is discovery sampling. Discovery sampling is a type of statistical sampling that is used to test for the existence of at least one occurrence of a specific characteristic or condition in a population. Discovery sampling is often used when the auditor expects the characteristic or condition to be very rare or nonexistent, and when any occurrence would have a significant impact on the audit objective. For example, discovery sampling can be used to test for fraud, noncompliance, or material misstatement.
Discovery sampling works by setting a very low tolerable error rate (the maximum rate of occurrence of the characteristic or condition that the auditor is willing to accept) and a high confidence level (the degree of assurance that the auditor wants to obtain). The auditor then selects a sample from the population using a random or systematic method, and examines each item in the sample for the presence or absence of the characteristic or condition. If no error is found in the sample, the auditor can conclude with a high level of confidence that the characteristic or condition does not exist or is very rare in the population. However, if one or more errors are found in the sample, the auditor cannot draw any conclusion about the population and must either expand the sample size or perform alternative procedures.
Discovery sampling differs from other sampling methods in that it does not allow for any errors in the sample.
Other sampling methods, such as variable sampling, stop-or-go sampling, or judgmental sampling, can tolerate some errors in the sample and use them to estimate the error rate or amount in the population.
However, discovery sampling is designed to test for zero-tolerance situations, where any error would be unacceptable or material. Therefore, discovery sampling considers the entire sample to be irregular if a single error is found.
References:
Audit Sampling - Overview, Purpose, Importance, and Types1
Audit Sampling - What Is It, Methods, Example, Advantage, Reason2
ISA 530: Audit sampling | ICAEW3
Audit Sampling - AICPA4
Discovery sampling works by setting a very low tolerable error rate (the maximum rate of occurrence of the characteristic or condition that the auditor is willing to accept) and a high confidence level (the degree of assurance that the auditor wants to obtain). The auditor then selects a sample from the population using a random or systematic method, and examines each item in the sample for the presence or absence of the characteristic or condition. If no error is found in the sample, the auditor can conclude with a high level of confidence that the characteristic or condition does not exist or is very rare in the population. However, if one or more errors are found in the sample, the auditor cannot draw any conclusion about the population and must either expand the sample size or perform alternative procedures.
Discovery sampling differs from other sampling methods in that it does not allow for any errors in the sample.
Other sampling methods, such as variable sampling, stop-or-go sampling, or judgmental sampling, can tolerate some errors in the sample and use them to estimate the error rate or amount in the population.
However, discovery sampling is designed to test for zero-tolerance situations, where any error would be unacceptable or material. Therefore, discovery sampling considers the entire sample to be irregular if a single error is found.
References:
Audit Sampling - Overview, Purpose, Importance, and Types1
Audit Sampling - What Is It, Methods, Example, Advantage, Reason2
ISA 530: Audit sampling | ICAEW3
Audit Sampling - AICPA4
CISA-KR 문제 134
IS 감사원은 위험 관리 관행이 적용되었는지 확인하기 위해 이벤트 로그 집계 시스템을 검토하라는 요청을 받았습니다. 감사원이 가장 우려해야 할 사항은 다음 중 어느 것입니까?
정답: B
The IS auditor should be most concerned if completeness testing has not been performed on the log data, as this could indicate that some logs are missing, corrupted, or tampered with, and that the log aggregation system is not reliable or accurate12. Completeness testing is a process of verifying that all the logs generated by the source systems are successfully collected, transferred, and stored by the log aggregation system, and that there are no gaps or inconsistencies in the log data34. Completeness testing is essential for ensuring the integrity and validity of the log data, and for supporting the risk management practices of the organization.
References
1: Log Aggregation: How it Works, Methods, and Tools - Exabeam2 2: Log Aggregation & Monitoring Relation in Cybersecurity4 3: Log Aggregation: What It Is & How It Works | Datadog3 4: Data Flow Testing
- GeeksforGeeks1
References
1: Log Aggregation: How it Works, Methods, and Tools - Exabeam2 2: Log Aggregation & Monitoring Relation in Cybersecurity4 3: Log Aggregation: What It Is & How It Works | Datadog3 4: Data Flow Testing
- GeeksforGeeks1
CISA-KR 문제 135
어떤 조직은 데이터 기밀성을 보호하기 위한 새로운 규정을 준수하는 데 관심이 있으며 IS 감사원에게 데이터 전송 절차를 평가해 달라고 요청합니다. 다음 중 어느 것이 조직의 목표를 가장 잘 지원할 것인가요?
정답: C
The best option to support the organization's objectives of protecting data confidentiality while transporting data is encryption. Encryption is a process of transforming data into an unreadable form using a secret key or algorithm, so that only authorized parties can access the original data. Encryption protects the confidentiality of data in transit by preventing unauthorized interception, modification, or disclosure of the data. Encryption can also help comply with data privacy and security regulations, such as the GDPR and HIPAA.
The other options are not as effective as encryption in protecting data confidentiality while transporting data.
Cryptographic hashes are mathematical functions that generate a fixed-length output from an input, but they do not encrypt the data. Hashes are used to verify the integrity and authenticity of data, but they do not prevent unauthorized access to the data. Virtual local area network (VLAN) is a logical grouping of network devices that share the same broadcast domain, but they do not encrypt the data. VLANs can improve network performance and security by isolating traffic, but they do not protect the data from being intercepted or modified by external attackers. Dedicated lines are physical connections that provide exclusive access to a network or service, but they do not encrypt the data. Dedicated lines can offer higher bandwidth and reliability, but they do not guarantee the confidentiality of the data from being compromised by physical tampering or eavesdropping.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
* Data Security and Confidentiality Guidelines - Centers for Disease Control and Prevention3
* Information Security | Confidentiality - GeeksforGeeks4
The other options are not as effective as encryption in protecting data confidentiality while transporting data.
Cryptographic hashes are mathematical functions that generate a fixed-length output from an input, but they do not encrypt the data. Hashes are used to verify the integrity and authenticity of data, but they do not prevent unauthorized access to the data. Virtual local area network (VLAN) is a logical grouping of network devices that share the same broadcast domain, but they do not encrypt the data. VLANs can improve network performance and security by isolating traffic, but they do not protect the data from being intercepted or modified by external attackers. Dedicated lines are physical connections that provide exclusive access to a network or service, but they do not encrypt the data. Dedicated lines can offer higher bandwidth and reliability, but they do not guarantee the confidentiality of the data from being compromised by physical tampering or eavesdropping.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
* Data Security and Confidentiality Guidelines - Centers for Disease Control and Prevention3
* Information Security | Confidentiality - GeeksforGeeks4
- 다른 버전
- 223ISACA.CISA-KR.v2026-08-15.q712
- 4197ISACA.CISA-KR.v2026-05-16.q709
- 1824ISACA.CISA-KR.v2026-05-06.q261
- 3190ISACA.CISA-KR.v2026-03-16.q665
- 4615ISACA.CISA-KR.v2026-03-07.q651
- 9339ISACA.CISA-KR.v2025-04-07.q633
- 4491ISACA.CISA-KR.v2025-04-03.q628
- 3732ISACA.CISA-KR.v2025-04-02.q544
- 5420ISACA.CISA-KR.v2025-03-28.q617
- 3253ISACA.CISA-KR.v2025-03-19.q581
- 4058ISACA.CISA-KR.v2025-03-03.q807
- 5218ISACA.CISA-KR.v2024-02-07.q421
- 2871ISACA.CISA-KR.v2024-01-31.q392
- 5389ISACA.CISA-KR.v2023-10-24.q329
- 5230ISACA.CISA-KR.v2023-07-31.q266
- 3229ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 223ISACA.CISA-KR.v2026-08-15.q712
- 165Microsoft.MS-700-KR.v2026-08-15.q203
- 130Microsoft.AZ-305-KR.v2026-08-14.q177
- 190Microsoft.DP-900-KR.v2026-08-13.q130
- 288Microsoft.PL-600.v2026-08-11.q206
- 218Microsoft.DP-100.v2026-08-11.q160
- 187Oracle.1Z0-1048-25.v2026-08-11.q68
- 159ISQI.CTAL-TAE.v2026-08-11.q37
- 200ServiceNow.CIS-HR.v2026-08-11.q84
- 281Salesforce.Plat-Arch-201.v2026-08-10.q101
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-31.q534 모의시험 시험자료를 다운 받으세요.