CISA-KR 문제 321
IS 감사원은 기존 시스템을 대체하는 새로운 건강 기록 시스템과 관련된 가장 중요한 위험으로 다음 중 어떤 것을 고려해야 합니까?
정답: B
The most significant risk associated with a new health records system that replaces a legacy system is data not being converted correctly, resulting in inaccurate patient records. Data conversion is the process of transferring data from one format or system to another. Data conversion is a critical step in implementing a new health records system, as it ensures that the patient data are consistent, complete, accurate, and accessible in the new system. Data not being converted correctly may cause errors, discrepancies, or losses in patient records, which may have serious implications for patient safety, quality of care, legal compliance, and privacy protection. Staff not being involved in the procurement process, creating user resistance to the new system; the deployment project experiencing significant overruns, exceeding budget projections; and the new system having capacity issues, leading to slow response times for users are also risks associated with a new health records system implementation, but they are not as significant as data not being converted correctly. References: [ISACA CISA Review Manual 27th Edition], page 281.
CISA-KR 문제 322
RAO 모델에서 다음 역할 중 어느 것을 한 명의 개인에게만 할당해야 합니까?
정답: D
In a RAO model, which stands for Responsible, Accountable, Consulted, and Informed, the accountable role must be assigned to only one individual. The accountable role is the person who has the ultimate authority and responsibility for the outcome of the project or task, and who approves or rejects the work done by the responsible role. The accountable role cannot be delegated or shared, as it is essential to have a clear and single point of accountability for each project or task.
The other roles can be assigned to more than one individual:
* Responsible. This is the person who does the work or performs the task. There can be multiple responsible roles for different aspects or phases of a project or task, as long as they are coordinated and supervised by the accountable role.
* Informed. This is the person who needs to be notified or updated about the progress or results of the project or task. There can be multiple informed roles who have an interest or stake in the project or task, but who do not need to be consulted or involved in the decision-making process.
* Consulted. This is the person who provides input, feedback, or advice on the project or task. There can be multiple consulted roles who have expertise or experience relevant to the project or task, but who do not have the authority or responsibility to approve or reject the work done by the responsible role.
The other roles can be assigned to more than one individual:
* Responsible. This is the person who does the work or performs the task. There can be multiple responsible roles for different aspects or phases of a project or task, as long as they are coordinated and supervised by the accountable role.
* Informed. This is the person who needs to be notified or updated about the progress or results of the project or task. There can be multiple informed roles who have an interest or stake in the project or task, but who do not need to be consulted or involved in the decision-making process.
* Consulted. This is the person who provides input, feedback, or advice on the project or task. There can be multiple consulted roles who have expertise or experience relevant to the project or task, but who do not have the authority or responsibility to approve or reject the work done by the responsible role.
CISA-KR 문제 323
다음 중 직원 소유의 모바일 기기에 푸시되는 기업용 애플리케이션의 보안을 유지하기 위한 BE ST 방법을 제공하는 것은 무엇입니까?
정답: B
The best method for maintaining the security of corporate applications pushed to employee-owned mobile devices is implementing mobile device management (MDM). MDM is a software solution that allows an organization to remotely manage, configure, and secure the mobile devices that access its network and data.
MDM can help protect corporate applications on employee-owned devices by:
Enforcing security policies and settings, such as encryption, password, firewall, antivirus, and VPN.
Controlling the installation, update, and removal of corporate applications and data.
Separating corporate and personal data and applications on the device using containers or profiles.
Monitoring and auditing the device's compliance status, activity, and location.
Performing remote actions, such as lock, wipe, backup, or restore, in case of loss, theft, or compromise.
MDM can provide a comprehensive and centralized approach to maintain the security of corporate applications on employee-owned devices, regardless of the device type, platform, or ownership. MDM can also help the organization comply with regulatory and industry standards for data protection and privacy.
Enabling remote data destruction capabilities is a useful feature for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Remote data destruction allows the organization to erase the corporate data and applications from the device in case of loss, theft, or compromise. However, this feature does not prevent unauthorized access or misuse of the corporate data and applications before they are destroyed. Remote data destruction is usually part of an MDM solution.
Disabling unnecessary network connectivity options is a good practice for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Network connectivity options, such as Wi-Fi, Bluetooth, NFC, or USB, can expose the device to potential attacks or data leakage. Disabling these options when they are not needed can reduce the attack surface and improve battery life. However, this practice does not address other security risks or requirements for the corporate applications on the device. Disabling network connectivity options can also be part of an MDM solution.
Requiring security awareness training for mobile users is an important measure for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Security awareness training can educate the users about the potential threats and best practices for using their devices securely. It can also help foster a culture of security and responsibility among the users. However, security awareness training cannot guarantee that the users will follow the security policies and guidelines consistently and correctly. Security awareness training should be complemented by technical controls, such as MDM.
References:
Protecting Corporate Data on Mobile Devices for All Companies1
Mobile Device Security: Corporate-Owned Personally-Enabled (COPE)23
MDM can help protect corporate applications on employee-owned devices by:
Enforcing security policies and settings, such as encryption, password, firewall, antivirus, and VPN.
Controlling the installation, update, and removal of corporate applications and data.
Separating corporate and personal data and applications on the device using containers or profiles.
Monitoring and auditing the device's compliance status, activity, and location.
Performing remote actions, such as lock, wipe, backup, or restore, in case of loss, theft, or compromise.
MDM can provide a comprehensive and centralized approach to maintain the security of corporate applications on employee-owned devices, regardless of the device type, platform, or ownership. MDM can also help the organization comply with regulatory and industry standards for data protection and privacy.
Enabling remote data destruction capabilities is a useful feature for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Remote data destruction allows the organization to erase the corporate data and applications from the device in case of loss, theft, or compromise. However, this feature does not prevent unauthorized access or misuse of the corporate data and applications before they are destroyed. Remote data destruction is usually part of an MDM solution.
Disabling unnecessary network connectivity options is a good practice for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Network connectivity options, such as Wi-Fi, Bluetooth, NFC, or USB, can expose the device to potential attacks or data leakage. Disabling these options when they are not needed can reduce the attack surface and improve battery life. However, this practice does not address other security risks or requirements for the corporate applications on the device. Disabling network connectivity options can also be part of an MDM solution.
Requiring security awareness training for mobile users is an important measure for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Security awareness training can educate the users about the potential threats and best practices for using their devices securely. It can also help foster a culture of security and responsibility among the users. However, security awareness training cannot guarantee that the users will follow the security policies and guidelines consistently and correctly. Security awareness training should be complemented by technical controls, such as MDM.
References:
Protecting Corporate Data on Mobile Devices for All Companies1
Mobile Device Security: Corporate-Owned Personally-Enabled (COPE)23
CISA-KR 문제 324
다음 중 애플리케이션 프로그래밍 인터페이스(API) 통합 구현과 관련된 도청 위험을 완화하기 위해 IS 감사자가 내린 가장 좋은 권장 사항은 무엇입니까?
정답: B
The best recommendation to mitigate the risk of eavesdropping associated with an API integration implementation is to implement Transport Layer Security (TLS). TLS is a cryptographic protocol that provides secure communication over a network by encrypting the data in transit and authenticating the parties involved. TLS can prevent unauthorized parties from intercepting, modifying or tampering with the data exchanged between the API endpoints. Encrypting the XML file, implementing SOAP, and masking the API endpoints are not sufficient to mitigate the risk of eavesdropping, as they do not provide end-to-end encryption or authentication for the API communication. References: IS Audit and Assurance Tools and Techniques, CISA Certification | Certified Information Systems Auditor | ISACA
CISA-KR 문제 325
IS 감사원은 여전히 정기적으로 사용되는 소프트웨어 시스템이 수년이나 오래되어 더 이상 지원되지 않는다는 사실을 발견했습니다. 감사 대상자는 소프트웨어가 현재 버전에서 실행될 때까지 6개월이 걸릴 것이라고 말했습니다. 다음 중 지원되지 않는 버전의 소프트웨어를 사용하는 것과 관련된 즉각적인 위험을 줄이는 가장 좋은 방법은 무엇입니까?
정답: D
The best way to reduce the immediate risk associated with using an unsupported version of the software is to segregate the outdated software system from the main network. This will limit the exposure of the system to potential attacks and prevent it from compromising other systems on the network. Segregating the system will also reduce the impact of any security incidents that may occur on the system.
Monitoring network traffic attempting to reach the outdated software system (option C) is not the best way to reduce the risk, as it will not prevent or stop any attacks on the system. It will only provide visibility into the network activity and alert the auditee of any suspicious or malicious traffic.
Verifying all patches have been applied to the software system's outdated version (option A) and closing all unused ports on the outdated software system (option B) are also not the best ways to reduce the risk, as they will not address the underlying issue of using an unsupported version of the software. Patches and ports may still have vulnerabilities that are not fixed by the vendor, and attackers may exploit them to gain access to the system.
Therefore, option D is the correct answer.
References:
* Introduction (Part 1 of 7: Mitigating Risks of Unsupported Operating Systems)
* Summary (Part 7 of 7: Mitigating Risks of Unsupported Operating Systems)
* Upgrade, Retire, or Replace Unsupported Software (Part 4 of 7: Mitigating Risks of Unsupported Operating Systems)
Monitoring network traffic attempting to reach the outdated software system (option C) is not the best way to reduce the risk, as it will not prevent or stop any attacks on the system. It will only provide visibility into the network activity and alert the auditee of any suspicious or malicious traffic.
Verifying all patches have been applied to the software system's outdated version (option A) and closing all unused ports on the outdated software system (option B) are also not the best ways to reduce the risk, as they will not address the underlying issue of using an unsupported version of the software. Patches and ports may still have vulnerabilities that are not fixed by the vendor, and attackers may exploit them to gain access to the system.
Therefore, option D is the correct answer.
References:
* Introduction (Part 1 of 7: Mitigating Risks of Unsupported Operating Systems)
* Summary (Part 7 of 7: Mitigating Risks of Unsupported Operating Systems)
* Upgrade, Retire, or Replace Unsupported Software (Part 4 of 7: Mitigating Risks of Unsupported Operating Systems)
- 다른 버전
- 2323ISACA.CISA-KR.v2026-08-27.q676
- 4388ISACA.CISA-KR.v2026-08-15.q712
- 6893ISACA.CISA-KR.v2026-05-16.q709
- 2725ISACA.CISA-KR.v2026-05-06.q261
- 4615ISACA.CISA-KR.v2026-03-16.q665
- 6612ISACA.CISA-KR.v2026-03-07.q651
- 11024ISACA.CISA-KR.v2025-04-07.q633
- 5689ISACA.CISA-KR.v2025-04-03.q628
- 4739ISACA.CISA-KR.v2025-04-02.q544
- 6662ISACA.CISA-KR.v2025-03-28.q617
- 4284ISACA.CISA-KR.v2025-03-19.q581
- 5445ISACA.CISA-KR.v2025-03-03.q807
- 6020ISACA.CISA-KR.v2024-02-07.q421
- 3612ISACA.CISA-KR.v2024-01-31.q392
- 5925ISACA.CISA-KR.v2023-10-24.q329
- 5714ISACA.CISA-KR.v2023-07-31.q266
- 3813ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 119Oracle.1Z0-1048-26.v2026-10-17.q66
- 137Splunk.SPLK-3003.v2026-10-17.q106
- 149Nokia.SRAN-Radio-Network-Performance-Optimization.v2026-10-16.q18
- 167Pegasystems.PEGACPRSA22V1.v2026-10-16.q33
- 184PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 223Splunk.SPLK-1002.v2026-10-15.q187
- 151Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 152AIChE.CCPSC.v2026-10-15.q37
- 216API.API-571.v2026-10-15.q131
- 137Microsoft.AB-210.v2026-10-14.q58
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-03-31.q534 모의시험 시험자료를 다운 받으세요.