CISA-KR 문제 91
거래 데이터의 정확성을 테스트할 때, 다음 중 어떤 상황에서 더 작은 표본 크기를 사용하는 것이 가장 타당할까요?
정답: B
The best situation that justifies the use of a smaller sample size when testing the accuracy of transaction data is B. It is expected that the population is error-free. The sample size is the number of items selected from the population for testing. The sample size depends on various factors, such as the level of confidence, the tolerable error rate, the expected error rate, and the variability of the population. A smaller sample size means that fewer items are tested, which reduces the cost and time of testing, but also increases the sampling risk (the risk that the sample is not representative of the population).
One of the factors that affects the sample size is the expected error rate, which is the auditor's best estimate of the proportion of errors in the population before testing. A higher expected error rate means that more errors are likely to be found in the population, which requires a larger sample size to provide sufficient evidence for the auditor's conclusion. A lower expected error rate means that fewer errors are likely to be found in the population, which allows a smaller sample size to provide sufficient evidence for the auditor's conclusion.
Therefore, if it is expected that the population is error-free (i.e., the expected error rate is zero or very low), a smaller sample size can be justified.
The other situations do not justify the use of a smaller sample size when testing the accuracy of transaction data. A. The IS audit staff has a high level of experience. The IS audit staff's level of experience does not affect the sample size, but rather their ability to design and execute the sampling procedures and evaluate the results. The IS audit staff's level of experience may affect their judgment in selecting and applying sampling methods, but it does not change the statistical or mathematical principles that determine the sample size. B.
Proper segregation of duties is in place. Proper segregation of duties is an internal control that helps prevent or detect errors or fraud in transaction processing, but it does not affect the sample size. The sample size is based on the characteristics of the population and the objectives of testing, not on the controls in place. Proper segregation of duties may reduce the likelihood or impact of errors or fraud in transaction processing, but it does not eliminate them completely. Therefore, proper segregation of duties does not justify a smaller sample size when testing the accuracy of transaction data. C. The data can be directly changed by users. The data's ability to be directly changed by users does not justify a smaller sample size, but rather a larger one. The data' s ability to be directly changed by users increases the risk of errors or fraud in transaction processing, which requires a larger sample size to provide sufficient evidence for the auditor's conclusion. The data's ability to be directly changed by users also increases the variability of the population, which affects the sample size.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
* Audit Sampling - AICPA3
* How to choose a sample size (for the statistically challenged)
One of the factors that affects the sample size is the expected error rate, which is the auditor's best estimate of the proportion of errors in the population before testing. A higher expected error rate means that more errors are likely to be found in the population, which requires a larger sample size to provide sufficient evidence for the auditor's conclusion. A lower expected error rate means that fewer errors are likely to be found in the population, which allows a smaller sample size to provide sufficient evidence for the auditor's conclusion.
Therefore, if it is expected that the population is error-free (i.e., the expected error rate is zero or very low), a smaller sample size can be justified.
The other situations do not justify the use of a smaller sample size when testing the accuracy of transaction data. A. The IS audit staff has a high level of experience. The IS audit staff's level of experience does not affect the sample size, but rather their ability to design and execute the sampling procedures and evaluate the results. The IS audit staff's level of experience may affect their judgment in selecting and applying sampling methods, but it does not change the statistical or mathematical principles that determine the sample size. B.
Proper segregation of duties is in place. Proper segregation of duties is an internal control that helps prevent or detect errors or fraud in transaction processing, but it does not affect the sample size. The sample size is based on the characteristics of the population and the objectives of testing, not on the controls in place. Proper segregation of duties may reduce the likelihood or impact of errors or fraud in transaction processing, but it does not eliminate them completely. Therefore, proper segregation of duties does not justify a smaller sample size when testing the accuracy of transaction data. C. The data can be directly changed by users. The data's ability to be directly changed by users does not justify a smaller sample size, but rather a larger one. The data' s ability to be directly changed by users increases the risk of errors or fraud in transaction processing, which requires a larger sample size to provide sufficient evidence for the auditor's conclusion. The data's ability to be directly changed by users also increases the variability of the population, which affects the sample size.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
* Audit Sampling - AICPA3
* How to choose a sample size (for the statistically challenged)
CISA-KR 문제 92
조직의 보안 정보 및 이벤트 관리(SIEM) 솔루션을 검토할 때, 다음 중 가장 우려되는 사항은 무엇입니까?
정답: C
The greatest concern that the IS auditor should have when reviewing an organization's security information and event management (SIEM) solution is that the SIEM is decentralized. This is because a decentralized SIEM can pose challenges for collecting, correlating, analyzing and reporting on security events and incidents from multiple sources and locations. A decentralized SIEM can also increase the complexity and cost of maintaining and updating the SIEM components, as well as the risk of inconsistent or incomplete security monitoring and response. The IS auditor should recommend that the organization adopts a centralized or hybrid SIEM architecture that can provide a holistic and integrated view of the security posture and activities across the organization. The other findings are not as concerning as a decentralized SIEM, because they can be addressedby implementing best practices and standards for SIEM reporting and configuration. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.4
CISA-KR 문제 93
감사 작업이 완료되면 IS 감사인은 다음을 수행해야 합니다.
정답: B
Upon completion of audit work, an IS auditor should distribute a summary of general findings to the members of the auditing team. This is to ensure that the audit team members are aware of the audit results, have an opportunity to provide feedback, and can agree on the audit conclusions and recommendations.
Providing a report to senior management prior to discussion with the auditee, providing a report to the auditee stating the initial findings, and reviewing the working papers with the auditee are not appropriate actions for an IS auditor to take upon completion of audit work, as they may compromise the audit independence, objectivity, and quality. References: ISACA CISA Review Manual 27th Edition, page 221
Providing a report to senior management prior to discussion with the auditee, providing a report to the auditee stating the initial findings, and reviewing the working papers with the auditee are not appropriate actions for an IS auditor to take upon completion of audit work, as they may compromise the audit independence, objectivity, and quality. References: ISACA CISA Review Manual 27th Edition, page 221
CISA-KR 문제 94
IS 감사자는 조직의 정보 자산 관리 프로세스를 검토하고 있습니다. 다음 중 감사자에게 가장 큰 관심사는 무엇일까요?
정답: B
An IS auditor would be most concerned if process ownership has not been established for the information asset management process, as this would indicate a lack of accountability, responsibility, and authority for managing the assets throughout their lifecycle. The process owner should also ensure that the process is aligned with the organization's objectives, policies, and standards. The process should require specifying the physicallocations of assets, include asset review, and identify asset value, but these are less critical than establishing process ownership. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.3
CISA-KR 문제 95
다음 관리 결정 중 데이터 유출과 관련하여 가장 큰 위험을 초래하는 것은 무엇입니까?
정답: C
The management decision that presents the greatest risk associated with data leakage is not providing security awareness training to staff. This is because staff are often the weakest link in the information security chain, and they may unintentionally or maliciously leak sensitive data through various channels, such as email, social media, cloud storage, or removable media. Security awareness training is essential to educate staff on the importance of protecting data, the policies and procedures for handling data, and the best practices for preventing and reporting data leakage incidents. Not requiring desktops to be encrypted, allowing staff to work remotely, and not updating security policies in the past year are also management decisions that may increase the risk of data leakage, but they are not as significant as not providing security awareness training to staff. Encryption, remote work, and security policies are technical or administrative controls that can be implemented or enforced by management, but they cannot fully prevent or mitigate human errors or malicious actions by staff. References: CISA Review Manual (Digital Version), [ISACA Privacy Principles and Program Management Guide]
- 다른 버전
- 297ISACA.CISA-KR.v2026-08-15.q712
- 4315ISACA.CISA-KR.v2026-05-16.q709
- 1865ISACA.CISA-KR.v2026-05-06.q261
- 3329ISACA.CISA-KR.v2026-03-16.q665
- 4736ISACA.CISA-KR.v2026-03-07.q651
- 9443ISACA.CISA-KR.v2025-04-07.q633
- 3810ISACA.CISA-KR.v2025-04-02.q544
- 4313ISACA.CISA-KR.v2025-03-31.q534
- 5520ISACA.CISA-KR.v2025-03-28.q617
- 3313ISACA.CISA-KR.v2025-03-19.q581
- 4197ISACA.CISA-KR.v2025-03-03.q807
- 5244ISACA.CISA-KR.v2024-02-07.q421
- 2921ISACA.CISA-KR.v2024-01-31.q392
- 5430ISACA.CISA-KR.v2023-10-24.q329
- 5259ISACA.CISA-KR.v2023-07-31.q266
- 3259ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 122Microsoft.AZ-305-KR.v2026-08-17.q162
- 138IIA.IAA-IAP-KR.v2026-08-17.q41
- 297ISACA.CISA-KR.v2026-08-15.q712
- 237Microsoft.MS-700-KR.v2026-08-15.q203
- 167Microsoft.AZ-305-KR.v2026-08-14.q177
- 237Microsoft.DP-900-KR.v2026-08-13.q130
- 312Microsoft.PL-600.v2026-08-11.q206
- 256Microsoft.DP-100.v2026-08-11.q160
- 208Oracle.1Z0-1048-25.v2026-08-11.q68
- 175ISQI.CTAL-TAE.v2026-08-11.q37
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-04-03.q628 모의시험 시험자료를 다운 받으세요.