CISA-KR 문제 156
Education and guidelines can help employees understand the benefits and risks of using social media for business purposes, such as enhancing brand awareness, engaging with customers, or sharing industry insights.
They can also inform employees about the dos and don'ts of social media etiquette, such as respecting privacy, protecting intellectual property, avoiding conflicts of interest, or complying with legal obligations.
Education and guidelines can also raise awareness of potential data leakage scenarios, such as phishing attacks, malicious links, fake profiles, or oversharing sensitive information, and provide tips on how to prevent or respond to them.
CISA-KR 문제 157
Other options:
RPO (B) defines acceptable data loss but does not determine the total outage limit.
SDO (C) is related to service agreements but does not set the risk threshold.
AIW (D) is similar to MTO but is not as commonly used in disaster recovery planning.
Reference: ISACA CISA Review Manual, Information Systems Operations and Business Resilience
CISA-KR 문제 158
References
1: Separation of Duty (SOD) - Glossary | CSRC3 2: Separation of Duties within Information Systems4 3:
Separation of Duties: Implementation & Challenges in IT2 4: Implementing Segregation of Duties: A Practical Experience Based on Best Practices - ISACA1
CISA-KR 문제 159
CISA-KR 문제 160
The application implementation documents are the documents that describe the design specifications, logic, and functionality of the application and its controls. The application implementation documents may include:
Business requirements document - a document that defines the business objectives, needs, and expectations of the application.
Functional specifications document - a document that describes the features, functions, and interfaces of the application and its controls.
Technical specifications document - a document that details the technical architecture, design, and configuration of the application and its controls.
Test plan and test cases - a document that outlines the testing strategy, methodology, and scenarios for verifying the functionality and performance of the application and its controls.
User manual and training material - a document that provides instructions and guidance on how to use the application and its controls.
By reviewing the application implementation documents, an IS auditor can:
Gain an understanding of the purpose, scope, and nature of the application and its controls.
Evaluate whether the application and its controls are designed to meet the business requirements and objectives.
Identify any gaps, inconsistencies, or errors in the design of the application and its controls.
Compare the design of the application and its controls with the best practices and standards in the industry.
Determine whether the application and its controls are adequately tested and documented.
Interviewing the application developer is not the best way for an IS auditor to assess the design of an automated application control. An interview is a verbal communication technique that involves asking questions and listening to responses. An interview can be useful for obtaining general information or clarifying specific issues related to the application and its controls. However, an interview alone cannot provide sufficient evidence or documentation to support the auditor's assessment of the design of an automated application control. An interview may also be subject to bias, misunderstanding, or misinterpretation by either party.
Obtaining management attestation and sign-off is not the best way for an IS auditor to assess the design of an automated application control. Management attestation and sign-off is a formal process that involves obtaining written confirmation from management that they have reviewed and approved the design of the application and its controls. Management attestation and sign-off can indicate management's commitment and accountability for the quality and effectiveness of the application and its controls. However, management attestation and sign-off cannot substitute for an independent and objective evaluation by an IS auditor.
Management attestation and sign-off may also be influenced by pressure, conflict of interest, or fraud.
Reviewing system configuration parameters and output is not the best way for an IS auditor to assess the design of an automated application control. System configuration parameters are settings that define how the system operates or interacts with other components. System output is data or information that is produced by the system as a result of processing transactions or performing functions. Reviewing system configuration parameters and output can help an IS auditor to verify whether the system is configured correctly and whether it produces accurate and reliable output. However, reviewing system configuration parameters and output cannot provide a comprehensive view of how the application and its controls are designed to achieve their objectives. Reviewing system configuration parameters and output may also require technical expertise or access rights that may not be available to an IS auditor.
- 다른 버전
- 249ISACA.CISA-KR.v2026-08-15.q712
- 4281ISACA.CISA-KR.v2026-05-16.q709
- 1842ISACA.CISA-KR.v2026-05-06.q261
- 3229ISACA.CISA-KR.v2026-03-16.q665
- 4711ISACA.CISA-KR.v2026-03-07.q651
- 9420ISACA.CISA-KR.v2025-04-07.q633
- 3795ISACA.CISA-KR.v2025-04-02.q544
- 4300ISACA.CISA-KR.v2025-03-31.q534
- 5460ISACA.CISA-KR.v2025-03-28.q617
- 3295ISACA.CISA-KR.v2025-03-19.q581
- 4157ISACA.CISA-KR.v2025-03-03.q807
- 5235ISACA.CISA-KR.v2024-02-07.q421
- 2904ISACA.CISA-KR.v2024-01-31.q392
- 5412ISACA.CISA-KR.v2023-10-24.q329
- 5247ISACA.CISA-KR.v2023-07-31.q266
- 3245ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 249ISACA.CISA-KR.v2026-08-15.q712
- 212Microsoft.MS-700-KR.v2026-08-15.q203
- 149Microsoft.AZ-305-KR.v2026-08-14.q177
- 219Microsoft.DP-900-KR.v2026-08-13.q130
- 291Microsoft.PL-600.v2026-08-11.q206
- 232Microsoft.DP-100.v2026-08-11.q160
- 194Oracle.1Z0-1048-25.v2026-08-11.q68
- 161ISQI.CTAL-TAE.v2026-08-11.q37
- 204ServiceNow.CIS-HR.v2026-08-11.q84
- 283Salesforce.Plat-Arch-201.v2026-08-10.q101
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-04-03.q628 모의시험 시험자료를 다운 받으세요.