CISA-KR 문제 316
최근 글로벌 조직의 한 국가에서 새로운 규정으로 인해 개인 데이터의 국경 간 전송이 금지되었습니다. IS 감사원은 영향을 받는 국가에서 조직의 노출 수준을 결정하라는 요청을 받았습니다. 다음 중 어떤 것이 이러한 평가를 내리는 데 가장 도움이 될까요?
정답: D
Identifying business processes associated with personal data exchange with the affected jurisdiction is the most helpful activity in making an assessment of the organization's level of exposure in the affected country.
An IS auditor should understand how the organization's business operations and functions rely on or involve the cross-border transfer of personal data, as well as the potential impacts and risks of the new regulation on the business continuity and compliance. The other options are less helpful activities that may provide additional information or context for the assessment, but not its primary focus. References:
* CISA Review Manual (Digital Version), Chapter 7, Section 7.4.21
* CISA Review Questions, Answers & Explanations Database, Question ID 221
An IS auditor should understand how the organization's business operations and functions rely on or involve the cross-border transfer of personal data, as well as the potential impacts and risks of the new regulation on the business continuity and compliance. The other options are less helpful activities that may provide additional information or context for the assessment, but not its primary focus. References:
* CISA Review Manual (Digital Version), Chapter 7, Section 7.4.21
* CISA Review Questions, Answers & Explanations Database, Question ID 221
CISA-KR 문제 317
사무실 간에 민감한 데이터를 전송하는 조직의 방법을 검토하는 IS 감사자가 가장 우려해야 할 사항은 다음 중 무엇입니까?
정답: C
The greatest concern to an IS auditor reviewing an organization's method to transport sensitive data between offices is that the method relies exclusively on the use of asymmetric encryption algorithms. Asymmetric encryption algorithms, also known as public key encryption, use two different keys for encryption and decryption: a public key that is shared with anyone who wants to communicate with the sender, and a private key that is kept secret by the sender. Asymmetric encryption algorithms are more secure than symmetric encryption algorithms, which use the same key for both encryption and decryption, but they are also slower and more computationally intensive. Therefore, relying exclusively on asymmetric encryption algorithms may not be efficient or practical for transporting large amounts of sensitive data between offices. A better method would be to use a combination of symmetric and asymmetric encryption algorithms, such as using asymmetric encryption to exchange a symmetric key and then using symmetric encryption to encrypt and decrypt the data.
The other options are not as concerning as option C. The method relying exclusively on the use of public key infrastructure (PKI) is not a concern, because PKI is a system that provides the services and mechanisms for creating, managing, distributing, using, storing, and revoking digital certificates that are based on asymmetric encryption algorithms. PKI enables secure and authenticated communication between parties who do not have a prior trust relationship. The method relying exclusively on the use of digital signatures is not a concern, because digital signatures are a way of verifying the authenticity and integrity of a message or document by using asymmetric encryption algorithms. Digital signatures ensure that the sender cannot deny sending the message or document, and that the receiver can detect any tampering or alteration of the message or document. The method relying exclusively on the use of 128-bit encryption is not a concern, because 128- bit encryption is a level of encryption that uses a 128-bit key to encrypt and decrypt data. 128-bit encryption is considered to be strong enough to resist brute-force attacks by modern computers. References: Asymmetric vs Symmetric Encryption: What are differences?, Public Key Infrastructure (PKI), Digital Signature, What is
128-bit Encryption?
The other options are not as concerning as option C. The method relying exclusively on the use of public key infrastructure (PKI) is not a concern, because PKI is a system that provides the services and mechanisms for creating, managing, distributing, using, storing, and revoking digital certificates that are based on asymmetric encryption algorithms. PKI enables secure and authenticated communication between parties who do not have a prior trust relationship. The method relying exclusively on the use of digital signatures is not a concern, because digital signatures are a way of verifying the authenticity and integrity of a message or document by using asymmetric encryption algorithms. Digital signatures ensure that the sender cannot deny sending the message or document, and that the receiver can detect any tampering or alteration of the message or document. The method relying exclusively on the use of 128-bit encryption is not a concern, because 128- bit encryption is a level of encryption that uses a 128-bit key to encrypt and decrypt data. 128-bit encryption is considered to be strong enough to resist brute-force attacks by modern computers. References: Asymmetric vs Symmetric Encryption: What are differences?, Public Key Infrastructure (PKI), Digital Signature, What is
128-bit Encryption?
CISA-KR 문제 318
조직의 오프사이트 보관 시설을 평가할 때 IS 감사자가 가장 먼저 초점을 맞춰야 할 부분은 무엇입니까?
정답: B
The IS auditor's primary focus when evaluating an organization's offsite storage facility should be the adequacy of physical and environmental controls. Physical and environmental controls are essential to protect the offsite storage facility from unauthorized access, theft, fire, water damage, pests or other hazards that could compromise the integrity and availability of backup media. Shared facilities is something that the IS auditor should consider when evaluating the offsite storage facility, but it is not the primary focus. Results of business continuity plan (BCP) test or retention policy and period are things that the IS auditor should review when evaluating the organization's BCP or backup strategy, not the offsite storage facility itself. References: ISACA, CISA Review Manual, 27th Edition, 2018, page 388
CISA-KR 문제 319
경영진이 승인한 IT 정책 예외의 수가 많은 것과 관련된 가장 큰 우려 사항은 다음 중 무엇입니까?
정답: B
The greatest concern associated with a high number of IT policy exceptions approved by management is that the exceptions may result in noncompliance. IT policy exceptions are deviations from the established IT policies that are granted by management for specific reasons and circumstances. However, if there are too many exceptions, it may indicate that the IT policies are not aligned with the business needs, regulatory requirements, or best practices. This may expose the organization to legal, contractual, or reputational risks due to noncompliance. The other options are not as concerning as noncompliance, as they do not have the same potential impact or consequences. The exceptions are likely to continue indefinitely is a possible outcome of a high number of exceptions, but it does not necessarily imply a negative effect on the organization. The exceptions may elevate the level of operational risk is a valid concern, but it can be mitigated by implementing compensating controls or monitoring mechanisms. The exceptions may negatively impact process efficiency is a minor concern, as it does not affect the effectiveness or reliability of the IT processes. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.2
CISA-KR 문제 320
다음 위험 시나리오 중 전체 디스크 암호화와 관련된 정책 및 절차를 구현하여 해결하는 것이 가장 좋은 것은 무엇입니까?
정답: D
Full disk encryption (FDE) is a means of protecting information by encrypting all of the data on a disk, including temporary files, programs, and system files1. FDE is best suited for addressing the risk scenario of physical theft of media on which information is stored, as it prevents unauthorized access to the data even if the device is lost or stolen2. FDE does not prevent data leakage as a result of employees leaving to work for competitors, as they may still have access to the data while using the device or copy the data to another device before leaving. FDE does not prevent noncompliance fines related to storage of regulated information, as it does not ensure that the data is stored in accordance with the applicable laws and regulations. FDE does not prevent unauthorized logical access to information through an application interface, as it does not control the access rights and permissions of users and applications. *References: According to the ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques for IS Audit and Assurance Professionals, section 2402 Planning, "The IS audit and assurance professional should identify and assess risk relevant to the area under review." 3 One of the risk factors to consider is "the sensitivity of information processed, stored or transmitted by the system" 3. FDE is one of the possible controls to mitigate the risk of unauthorized disclosure of sensitive information due to physical theft of media.
- 다른 버전
- 2323ISACA.CISA-KR.v2026-08-27.q676
- 4388ISACA.CISA-KR.v2026-08-15.q712
- 6893ISACA.CISA-KR.v2026-05-16.q709
- 2725ISACA.CISA-KR.v2026-05-06.q261
- 4615ISACA.CISA-KR.v2026-03-16.q665
- 6612ISACA.CISA-KR.v2026-03-07.q651
- 11024ISACA.CISA-KR.v2025-04-07.q633
- 5689ISACA.CISA-KR.v2025-04-03.q628
- 4739ISACA.CISA-KR.v2025-04-02.q544
- 6662ISACA.CISA-KR.v2025-03-28.q617
- 4284ISACA.CISA-KR.v2025-03-19.q581
- 5445ISACA.CISA-KR.v2025-03-03.q807
- 6020ISACA.CISA-KR.v2024-02-07.q421
- 3612ISACA.CISA-KR.v2024-01-31.q392
- 5925ISACA.CISA-KR.v2023-10-24.q329
- 5714ISACA.CISA-KR.v2023-07-31.q266
- 3813ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 119Oracle.1Z0-1048-26.v2026-10-17.q66
- 137Splunk.SPLK-3003.v2026-10-17.q106
- 149Nokia.SRAN-Radio-Network-Performance-Optimization.v2026-10-16.q18
- 167Pegasystems.PEGACPRSA22V1.v2026-10-16.q33
- 184PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 223Splunk.SPLK-1002.v2026-10-15.q187
- 151Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 152AIChE.CCPSC.v2026-10-15.q37
- 216API.API-571.v2026-10-15.q131
- 137Microsoft.AB-210.v2026-10-14.q58
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-31.q534 모의시험 시험자료를 다운 받으세요.