CISA-KR 문제 216
조직의 고위 경영진은 현재 보안 통제가 과도할 수 있다고 생각하고 IS 감사자에게 현재 조치의 적절성을 평가하는 방법에 대한 조언을 요청합니다. 감사자가 경영진에게 내리는 최상의 권고는 무엇입니까?
정답: D
A risk and control framework is a set of principles, processes, and tools that guide an organization in identifying, assessing, managing, and monitoring the risks and controls that affect its objectives and performance. A risk and control framework helps an organization to align its risk appetite and tolerance with its strategy, culture, and values, and to ensure that its security controls are appropriate, effective, and efficient1.
Re-evaluating the organization's risk and control framework is the best recommendation to management because it can help them to:
Review the current risk environment and the sources, causes, and impacts of potential threats and vulnerabilities.
Update the risk assessment and analysis methods and criteria, such as likelihood, impact, severity, and priority.
Reconsider the risk response and treatment options, such as avoidance, reduction, transfer, or acceptance.
Realign the security controls with the risk profile and the business needs and expectations.
Evaluate the performance and effectiveness of the security controls using key indicators and metrics.
Identify the gaps, weaknesses, or inefficiencies in the security controls and implement corrective or improvement actions.
Communicate and report the risk and control status and results to relevant stakeholders.
Re-evaluating the organization's risk and control framework can help management to determine whether the current security controls are excessive or not, and to make informed and rational decisions on how to adjust them accordingly.
Re-evaluating the organization's risk and control framework is the best recommendation to management because it can help them to:
Review the current risk environment and the sources, causes, and impacts of potential threats and vulnerabilities.
Update the risk assessment and analysis methods and criteria, such as likelihood, impact, severity, and priority.
Reconsider the risk response and treatment options, such as avoidance, reduction, transfer, or acceptance.
Realign the security controls with the risk profile and the business needs and expectations.
Evaluate the performance and effectiveness of the security controls using key indicators and metrics.
Identify the gaps, weaknesses, or inefficiencies in the security controls and implement corrective or improvement actions.
Communicate and report the risk and control status and results to relevant stakeholders.
Re-evaluating the organization's risk and control framework can help management to determine whether the current security controls are excessive or not, and to make informed and rational decisions on how to adjust them accordingly.
CISA-KR 문제 217
데이터베이스 관리 시스템(DBMS)의 레코드 잠금 옵션은 다음과 같은 역할을 합니다.
정답: A
The record-locking option of a database management system (DBMS) serves to eliminate the risk of concurrent updates to a record by different users or transactions. Record locking is a technique of preventing simultaneous access to data in a database, to prevent inconsistent results1. For example, if two bank clerks try to update the same bank account for two different transactions, record locking can ensure that only one clerk can modify the record at a time, while the other has to wait until the lock is released. This way, the record will reflect both transactions correctly and avoid data corruption.
Record locking does not serve to allow database administrators (DBAs) to record the activities of users. This is a function of auditing or logging, which can track the actions performed by users on the database2. Record locking does not affect the ability of DBAs to monitor or audit user activities.
Record locking does not serve to restrict users from changing certain values within records. This is a function of access control or authorization, which can enforce rules or policies on what data users can view or modify2. Record locking does not affect the permissions or privileges of users on the database.
Record locking does not serve to allow users to lock others out of their files. This is a function of encryption or password protection, which can secure files from unauthorized access or modification3. Record locking does not affect the security or confidentiality of files on the database.
References:
Record locking - Wikipedia1
Database security - Wikipedia2
File system permissions - Wikipedia3
Record locking does not serve to allow database administrators (DBAs) to record the activities of users. This is a function of auditing or logging, which can track the actions performed by users on the database2. Record locking does not affect the ability of DBAs to monitor or audit user activities.
Record locking does not serve to restrict users from changing certain values within records. This is a function of access control or authorization, which can enforce rules or policies on what data users can view or modify2. Record locking does not affect the permissions or privileges of users on the database.
Record locking does not serve to allow users to lock others out of their files. This is a function of encryption or password protection, which can secure files from unauthorized access or modification3. Record locking does not affect the security or confidentiality of files on the database.
References:
Record locking - Wikipedia1
Database security - Wikipedia2
File system permissions - Wikipedia3
CISA-KR 문제 218
한 조직에서 자기 테이프에 대한 야간 일괄 처리 백업을 두 번째 데이터 센터에 대한 실시간 복제로 대체할 계획입니다. 다음 중 이 변경과 관련된 가장 큰 위험은 무엇입니까?
정답: C
Real-time replication to a second data center means that any changes made to the primary data center are immediately copied to the secondary data center. This can improve data availability and performance, but also introduces the risk of propagating malicious or erroneous changes to the backup data center. If a cybersecurity attack compromises the primary data center, it may also affect the secondary data center, making it difficult or impossible to recover from the attack using the replicated data. Therefore, option C is the greatest risk associated with this change.
Option A is not correct because version control issues are more likely to occur with batch processing backup, which may create inconsistencies between different versions of the data. Option B is not correct because real- time replication may reduce system performance at the primary data center, but it may also improve system performance at the secondary data center by reducing latency and network traffic. Option D is not correct because although real-time replication may increase IT investment cost, this is not a risk but a trade-off that the organization has to consider.
References:
Data Replication: The Basics, Risks, and Best Practices1
Best Practices for Data Replication Between Data Centers2
The Good, Bad, and Ugly of Data Replication3
Option A is not correct because version control issues are more likely to occur with batch processing backup, which may create inconsistencies between different versions of the data. Option B is not correct because real- time replication may reduce system performance at the primary data center, but it may also improve system performance at the secondary data center by reducing latency and network traffic. Option D is not correct because although real-time replication may increase IT investment cost, this is not a risk but a trade-off that the organization has to consider.
References:
Data Replication: The Basics, Risks, and Best Practices1
Best Practices for Data Replication Between Data Centers2
The Good, Bad, and Ugly of Data Replication3
CISA-KR 문제 219
직원이 제한된 구역에 접근하는 것을 제한하기 위해 카드를 사용하려면 어떤 추가적인 통제 수단을 구현해야 합니까?
정답: C
Periodic review of access profiles by management is an additional control that is required when using swipe cards to limit employee access to restricted areas. Swipe cards are a type of physical access control that use magnetic stripes or radio frequency identification (RFID) to store and transmit information about the cardholder's identity and access rights. Swipe cards can help to prevent unauthorized entry, protect sensitive assets and data, and monitor access activity. However, swipe cards alone are not enough to ensure effective access control. They need to be complemented by other controls, such as:
Periodic review of access profiles by management: This is a type of logical access control that involves verifying that the access rights assigned to each cardholder are appropriate, necessary, and consistent with the organization's policies and procedures. Periodic review of access profiles can help to detect and correct any errors, inconsistencies, or violations in the access control system, such as outdated, excessive, or redundant access rights, segregation of duties conflicts, or unauthorized changes. Periodic review of access profiles can also help to ensure compliance with internal and external audit requirements and regulations.
Implementation of additional PIN pads: This is a type of multi-factor authentication (MFA) that requires the cardholder to enter a personal identification number (PIN) in addition to swiping their card. MFA can enhance the security of the access control system by adding another layer of verification and reducing the risk of lost, stolen, or cloned cards being used by unauthorized persons.
Installation of closed-circuit television (CCTV): This is a type of surveillance system that uses cameras and monitors to record and display the images of the people and activities in the restricted areas. CCTV can deter potential intruders, provide evidence of any security incidents or breaches, and enable real-time monitoring and response by security personnel.
The other options are not as effective or relevant as periodic review of access profiles by management for an additional control when using swipe cards. Physical sign-in of all employees for access to restricted areas is a redundant and inefficient control that can be easily bypassed or manipulated. It also does not provide any assurance or verification of the identity or access rights of the cardholders. Audit hooks are software routines embedded in an application that can trigger an alert or a report when certain conditions are met. Audit hooks can help to detect anomalies or exceptions in access control lists, but they do not provide a comprehensive or integrated view of them.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 236
ISACA, ITAF: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition, 2014, p. 88 Data Analytics for Auditing Access Control
Periodic review of access profiles by management: This is a type of logical access control that involves verifying that the access rights assigned to each cardholder are appropriate, necessary, and consistent with the organization's policies and procedures. Periodic review of access profiles can help to detect and correct any errors, inconsistencies, or violations in the access control system, such as outdated, excessive, or redundant access rights, segregation of duties conflicts, or unauthorized changes. Periodic review of access profiles can also help to ensure compliance with internal and external audit requirements and regulations.
Implementation of additional PIN pads: This is a type of multi-factor authentication (MFA) that requires the cardholder to enter a personal identification number (PIN) in addition to swiping their card. MFA can enhance the security of the access control system by adding another layer of verification and reducing the risk of lost, stolen, or cloned cards being used by unauthorized persons.
Installation of closed-circuit television (CCTV): This is a type of surveillance system that uses cameras and monitors to record and display the images of the people and activities in the restricted areas. CCTV can deter potential intruders, provide evidence of any security incidents or breaches, and enable real-time monitoring and response by security personnel.
The other options are not as effective or relevant as periodic review of access profiles by management for an additional control when using swipe cards. Physical sign-in of all employees for access to restricted areas is a redundant and inefficient control that can be easily bypassed or manipulated. It also does not provide any assurance or verification of the identity or access rights of the cardholders. Audit hooks are software routines embedded in an application that can trigger an alert or a report when certain conditions are met. Audit hooks can help to detect anomalies or exceptions in access control lists, but they do not provide a comprehensive or integrated view of them.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 236
ISACA, ITAF: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition, 2014, p. 88 Data Analytics for Auditing Access Control
CISA-KR 문제 220
다음 중 전략적 프로그램 관리를 가장 용이하게 하는 것은 무엇입니까?
정답: C
The best option that facilitates strategic program management is aligning projects with business portfolios (option C). This is because:
Strategic program management is the coordinated planning, management, and execution of multiple related projects that are directed toward the same strategic goals12.
Aligning projects with business portfolios means ensuring that the projects within a program are aligned with the organization's strategic objectives, vision, and mission .
Aligning projects with business portfolios helps to prioritize the most valuable and impactful projects, optimize the allocation of resources, monitor the progress and performance of the program, and deliver the expected benefits and outcomes .
Implementing stage gates (option A) is a process of reviewing and approving projects at predefined points in their lifecycle to ensure that they meet the quality, scope, time, and cost criteria. While this can help to control and improve the project management process, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Establishing a quality assurance (QA) process (option B) is a process of ensuring that the project deliverables meet the quality standards and requirements of the stakeholders. While this can help to enhance the quality and satisfaction of the project outcomes, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Tracking key project milestones (option D) is a process of monitoring and reporting the completion of significant events or deliverables in a project. While this can help to measure and communicate the progress and status of the project, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Therefore, the best option that facilitates strategic program management is aligning projects with business portfolios (option C), as this ensures that the projects within a program are consistent with the organization's strategic goals and objectives.
References: 1: Program Management: The Key to Strategic Execution 2: The Ultimate Guide to Program Management [2023] * Asana : Project Portfolio Management - PMI : Aligning Projects with Strategy - Harvard Business Review : What Is Stage-Gate Process? - ProjectManager.com : Quality Assurance in Project Management - PMI : What Is a Milestone in Project Management? - TeamGantt
Strategic program management is the coordinated planning, management, and execution of multiple related projects that are directed toward the same strategic goals12.
Aligning projects with business portfolios means ensuring that the projects within a program are aligned with the organization's strategic objectives, vision, and mission .
Aligning projects with business portfolios helps to prioritize the most valuable and impactful projects, optimize the allocation of resources, monitor the progress and performance of the program, and deliver the expected benefits and outcomes .
Implementing stage gates (option A) is a process of reviewing and approving projects at predefined points in their lifecycle to ensure that they meet the quality, scope, time, and cost criteria. While this can help to control and improve the project management process, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Establishing a quality assurance (QA) process (option B) is a process of ensuring that the project deliverables meet the quality standards and requirements of the stakeholders. While this can help to enhance the quality and satisfaction of the project outcomes, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Tracking key project milestones (option D) is a process of monitoring and reporting the completion of significant events or deliverables in a project. While this can help to measure and communicate the progress and status of the project, it does not necessarily facilitate strategic program management, as it does not address the alignment of projects with business portfolios.
Therefore, the best option that facilitates strategic program management is aligning projects with business portfolios (option C), as this ensures that the projects within a program are consistent with the organization's strategic goals and objectives.
References: 1: Program Management: The Key to Strategic Execution 2: The Ultimate Guide to Program Management [2023] * Asana : Project Portfolio Management - PMI : Aligning Projects with Strategy - Harvard Business Review : What Is Stage-Gate Process? - ProjectManager.com : Quality Assurance in Project Management - PMI : What Is a Milestone in Project Management? - TeamGantt
- 다른 버전
- 2347ISACA.CISA-KR.v2026-08-27.q676
- 4430ISACA.CISA-KR.v2026-08-15.q712
- 6932ISACA.CISA-KR.v2026-05-16.q709
- 2729ISACA.CISA-KR.v2026-05-06.q261
- 4641ISACA.CISA-KR.v2026-03-16.q665
- 6641ISACA.CISA-KR.v2026-03-07.q651
- 11045ISACA.CISA-KR.v2025-04-07.q633
- 5705ISACA.CISA-KR.v2025-04-03.q628
- 4748ISACA.CISA-KR.v2025-04-02.q544
- 6667ISACA.CISA-KR.v2025-03-28.q617
- 4287ISACA.CISA-KR.v2025-03-19.q581
- 5452ISACA.CISA-KR.v2025-03-03.q807
- 6030ISACA.CISA-KR.v2024-02-07.q421
- 3617ISACA.CISA-KR.v2024-01-31.q392
- 5928ISACA.CISA-KR.v2023-10-24.q329
- 5718ISACA.CISA-KR.v2023-07-31.q266
- 3819ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 113ACFE.CFE-Fraud-Prevention-and-Deterrence.v2026-10-18.q194
- 148Oracle.1Z0-1048-26.v2026-10-17.q66
- 173Splunk.SPLK-3003.v2026-10-17.q106
- 163Nokia.SRAN-Radio-Network-Performance-Optimization.v2026-10-16.q18
- 182Pegasystems.PEGACPRSA22V1.v2026-10-16.q33
- 193PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 234Splunk.SPLK-1002.v2026-10-15.q187
- 166Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 161AIChE.CCPSC.v2026-10-15.q37
- 230API.API-571.v2026-10-15.q131
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-31.q534 모의시험 시험자료를 다운 받으세요.