CISA-KR 문제 251
IT 전략 계획을 검토할 때 가장 큰 관심사는 다음과 같습니다.
정답: B
The greatest concern when reviewing an IT strategic plan is B. The plan does not support relevant organizational goals. This is because an IT strategic plan should align and integrate the IT goals and objectives with the organization's overall strategy and vision, and ensure that IT supports and enables the business processes and functions1. If the IT strategic plan does not support relevant organizational goals, it may lead to:
Suboptimal or negative outcomes and value for the organization, as IT investments and initiatives may not align with the organization's priorities, needs, or expectations1.
Conflicts or inconsistencies between IT and business functions, as IT may not deliver the expected level of service, quality, or performance2.
Wasted or inefficient use of resources, as IT may spend time, money, or effort on projects or activities that are not relevant or beneficial for the organization2.
Suboptimal or negative outcomes and value for the organization, as IT investments and initiatives may not align with the organization's priorities, needs, or expectations1.
Conflicts or inconsistencies between IT and business functions, as IT may not deliver the expected level of service, quality, or performance2.
Wasted or inefficient use of resources, as IT may spend time, money, or effort on projects or activities that are not relevant or beneficial for the organization2.
CISA-KR 문제 252
다음 중 비대칭 암호화로만 제공될 수 있는 것은 무엇입니까?
정답: D
The only thing that can be provided by asymmetric encryption is nonrepudiation. Nonrepudiation is the ability to prove that a message or transaction was originated or authorized by a specific party. Asymmetric encryption uses a pair of keys: a public key and a private key. The public key can be shared with anyone, while the private key is kept secret by the owner. If a message is encrypted with the sender's private key, only the sender's public key can decrypt it. This proves that the message was sent by the sender and not by anyone else. This is called digital signature and it provides nonrepudiation. Asymmetric encryption can also provide information privacy by encrypting a message with the receiver's public key, so that only the receiver's private key can decrypt it. However, information privacy can also be provided by symmetric encryption, which uses a single key to encrypt and decrypt messages. References:
* CISA Review Manual (Digital Version), Chapter 5, Section 5.21
* CISA Online Review Course, Domain 3, Module 2, Lesson 12
* CISA Review Manual (Digital Version), Chapter 5, Section 5.21
* CISA Online Review Course, Domain 3, Module 2, Lesson 12
CISA-KR 문제 253
운영 체제 감사 중에 기준 이미지를 얻는 주된 목적은 무엇입니까?
정답: A
The primary purpose of obtaining a baseline image during an operating system audit is to identify atypical running processes. A baseline image is a snapshot of the normal state and configuration of an operating system, including the processes that are expected to run on it. By comparing the current state of the operating system with the baseline image, an IS auditor can detect any deviations or anomalies that may indicate unauthorized or malicious activity, such as malware infection, privilege escalation, or data exfiltration. A baseline image can also help an IS auditor to assess the performance and efficiency of the operating system, as well as its compliance with security standards and policies.
Verifying antivirus definitions (option B) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Antivirus definitions are the files that contain the signatures and rules for detecting and removing malware. An IS auditor may verify that the antivirus definitions are up to date and consistent across the operating system, but this does not require obtaining a baseline image.
Identifying local administrator account access (option C) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Local administrator accounts are user accounts that have full control over the operating system and its resources. An IS auditor may identify and review the local administrator accounts to ensure that they are properly secured and authorized, but this does not require obtaining a baseline image.
Verifying the integrity of operating system backups (option D) is not the primary purpose of obtaining a baseline image, although it may be a part of the backup process. Operating system backups are copies of the operating system data and settings that can be used to restore the system in case of failure or disaster. An IS auditor may verify that the operating system backups are complete, accurate, and accessible, but this does not require obtaining a baseline image.
References: : Linux security and system hardening checklist : CISA Certification | Certified Information Systems Auditor | ISACA : CISA Certified Information Systems Auditor Study Guide, 4th Edition : CISA - Certified Information Systems Auditor Study Guide [Book]
Verifying antivirus definitions (option B) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Antivirus definitions are the files that contain the signatures and rules for detecting and removing malware. An IS auditor may verify that the antivirus definitions are up to date and consistent across the operating system, but this does not require obtaining a baseline image.
Identifying local administrator account access (option C) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Local administrator accounts are user accounts that have full control over the operating system and its resources. An IS auditor may identify and review the local administrator accounts to ensure that they are properly secured and authorized, but this does not require obtaining a baseline image.
Verifying the integrity of operating system backups (option D) is not the primary purpose of obtaining a baseline image, although it may be a part of the backup process. Operating system backups are copies of the operating system data and settings that can be used to restore the system in case of failure or disaster. An IS auditor may verify that the operating system backups are complete, accurate, and accessible, but this does not require obtaining a baseline image.
References: : Linux security and system hardening checklist : CISA Certification | Certified Information Systems Auditor | ISACA : CISA Certified Information Systems Auditor Study Guide, 4th Edition : CISA - Certified Information Systems Auditor Study Guide [Book]
CISA-KR 문제 254
통제 합계를 사용하면 다음과 같은 위험이 줄어듭니다.
정답: B
Control totals are a method of verifying the accuracy and completeness of data processing by comparing the totals of key fields in input and output records1. Control totals can be used to reduce the risk of incomplete processing, which is the failure to process all the data or transactions that are expected or required2.
Incomplete processing can result in data loss, inconsistency, or incompleteness, which can affect the quality and reliability of the information system and its outputs. Incomplete processing can be caused by various factors, such as:
Hardware or software failures that interrupt the processing or transmission of data2 Human errors or omissions that skip or miss some data or transactions2 Malicious attacks or unauthorized access that delete or modify some data or transactions2 Environmental hazards or disasters that damage or destroy some data or transactions2 Control totals can help detect and prevent incomplete processing by:
Providing a benchmark or reference point to compare the input and output data or transactions1 Identifying any discrepancies or deviations from the expected or required totals1 Alerting the users or operators to investigate and resolve the causes of incomplete processing1 Ensuring that all the data or transactions are properly transmitted, converted, and processed1 The other options are not as relevant as control totals for reducing the risk of incomplete processing. Posting to the wrong record is the error of assigning or transferring data or transactions to an incorrect account, file, or record3. Improper backup is the failure to create, store, or restore copies of data or transactions in case of loss, corruption, or damage4. Improper authorization is the lack of proper permission or approval to access, modify, or process data or transactions. Control totals may not be able to prevent or detect these errors or failures, as they are not related to the completeness of data processing. Therefore, option B is the correct answer.
References:
control totals - Barrons Dictionary - AllBusiness.com
What is control total amount? - Sage Advice US
Posting Error Definition
Backup Definition
[Authorization Definition]
Incomplete processing can result in data loss, inconsistency, or incompleteness, which can affect the quality and reliability of the information system and its outputs. Incomplete processing can be caused by various factors, such as:
Hardware or software failures that interrupt the processing or transmission of data2 Human errors or omissions that skip or miss some data or transactions2 Malicious attacks or unauthorized access that delete or modify some data or transactions2 Environmental hazards or disasters that damage or destroy some data or transactions2 Control totals can help detect and prevent incomplete processing by:
Providing a benchmark or reference point to compare the input and output data or transactions1 Identifying any discrepancies or deviations from the expected or required totals1 Alerting the users or operators to investigate and resolve the causes of incomplete processing1 Ensuring that all the data or transactions are properly transmitted, converted, and processed1 The other options are not as relevant as control totals for reducing the risk of incomplete processing. Posting to the wrong record is the error of assigning or transferring data or transactions to an incorrect account, file, or record3. Improper backup is the failure to create, store, or restore copies of data or transactions in case of loss, corruption, or damage4. Improper authorization is the lack of proper permission or approval to access, modify, or process data or transactions. Control totals may not be able to prevent or detect these errors or failures, as they are not related to the completeness of data processing. Therefore, option B is the correct answer.
References:
control totals - Barrons Dictionary - AllBusiness.com
What is control total amount? - Sage Advice US
Posting Error Definition
Backup Definition
[Authorization Definition]
CISA-KR 문제 255
두 사용자가 동일한 데이터베이스 레코드에 동시에 접근할 경우 발생할 수 있는 가장 큰 위험은 무엇입니까?
정답: B
The greatest risk if two users have concurrent access to the same database record is data integrity. Data integrity is the property that ensures that the data is accurate, complete, consistent, and valid throughout its lifecycle. If two users have concurrent access to the same database record, they may modify or delete the data in a conflicting or inconsistent manner, resulting in data corruption, loss, or duplication. This can affect the reliability and quality of the data, and cause errors or anomalies in the database operations and functions. The IS auditor should verify that the database has adequate controls to prevent or resolve concurrent access issues, such as locking mechanisms, transaction isolation levels, concurrency control protocols, or timestamping methods. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.7
- 다른 버전
- 2322ISACA.CISA-KR.v2026-08-27.q676
- 4387ISACA.CISA-KR.v2026-08-15.q712
- 6891ISACA.CISA-KR.v2026-05-16.q709
- 2724ISACA.CISA-KR.v2026-05-06.q261
- 4614ISACA.CISA-KR.v2026-03-16.q665
- 6612ISACA.CISA-KR.v2026-03-07.q651
- 11024ISACA.CISA-KR.v2025-04-07.q633
- 5689ISACA.CISA-KR.v2025-04-03.q628
- 4737ISACA.CISA-KR.v2025-04-02.q544
- 6662ISACA.CISA-KR.v2025-03-28.q617
- 4284ISACA.CISA-KR.v2025-03-19.q581
- 5443ISACA.CISA-KR.v2025-03-03.q807
- 6019ISACA.CISA-KR.v2024-02-07.q421
- 3612ISACA.CISA-KR.v2024-01-31.q392
- 5925ISACA.CISA-KR.v2023-10-24.q329
- 5713ISACA.CISA-KR.v2023-07-31.q266
- 3813ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 118Oracle.1Z0-1048-26.v2026-10-17.q66
- 137Splunk.SPLK-3003.v2026-10-17.q106
- 149Nokia.SRAN-Radio-Network-Performance-Optimization.v2026-10-16.q18
- 167Pegasystems.PEGACPRSA22V1.v2026-10-16.q33
- 183PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 222Splunk.SPLK-1002.v2026-10-15.q187
- 151Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 152AIChE.CCPSC.v2026-10-15.q37
- 216API.API-571.v2026-10-15.q131
- 136Microsoft.AB-210.v2026-10-14.q58
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-31.q534 모의시험 시험자료를 다운 받으세요.