CISA-KR 문제 176
조직에서 공개 키 인프라(PKI)를 사용하여 이메일 보안을 제공합니다. 이메일 메시지가 전송 중에 수정되었는지 확인하는 가장 효율적인 방법은 다음 중 어느 것입니까?
정답: C
This method is known as creating a digital signature of the message. It ensures the integrity of the message by verifying that it has not been tampered with in transit. The process involves hashing the message and encrypting the hash value with the sender's private key. Any changes to the message will result in a different hash value1. This method is used in DomainKeys Identified Mail (DKIM), which verifies an email's domain and helps show that the email has not been tampered with in transit2.
References:
Understanding Digital Signatures | CISA
Using DomainKeys Identified Mail (DKIM) in your organisation
References:
Understanding Digital Signatures | CISA
Using DomainKeys Identified Mail (DKIM) in your organisation
CISA-KR 문제 177
소규모 조직의 데이터 분류 프로세스와 절차를 감사하는 동안 IS 감사원은 데이터가 종종 잘못된 수준에서 분류된다는 것을 알아챘습니다. 조직이 이 상황을 개선하는 가장 효과적인 방법은 무엇입니까?
정답: B
This is the most effective way for the organization to improve its data classification processes and procedures, because data owners are the ones who are responsible for assigning the appropriate level of classification to the data they create, collect, or manage. Data owners should be aware of the data classification policy, the criteria for each level of classification, and the implications of misclassification. IT security staff can provide tailored training for data owners based on their roles, functions, and types of data they handle.
The other options are not as effective as having IT security staff conduct targeted training for data owners:
* Use automatic document classification based on content. This is a possible option, but it may not be feasible or accurate for a small organization. Automatic document classification is a process that uses artificial intelligence or machine learning to analyze the content of a document and assign a class label based on predefined rules or models. However, this process may require a lot of resources, expertise, and maintenance, and it may not capture all the nuances and context of the data. The IS auditor should also verify the reliability and validity of the automatic document classification system.
* Publish the data classification policy on the corporate web portal. This is a good practice, but it is not enough to improve the data classification situation. Publishing the data classification policy on the corporate web portal can increase the visibility and accessibility of the policy, but it does not ensure that data owners will read, understand, and follow it. The IS auditor should also monitor and enforce the compliance with the policy.
* Conduct awareness presentations and seminars for information classification policies. This is a useful measure, but it is not the most effective one. Conducting awareness presentations and seminars can raise the general awareness and knowledge of information classification policies among all employees, but it may not address the specific needs and challenges of data owners. The IS auditor should also provide more in-depth and practical training for data owners.
The other options are not as effective as having IT security staff conduct targeted training for data owners:
* Use automatic document classification based on content. This is a possible option, but it may not be feasible or accurate for a small organization. Automatic document classification is a process that uses artificial intelligence or machine learning to analyze the content of a document and assign a class label based on predefined rules or models. However, this process may require a lot of resources, expertise, and maintenance, and it may not capture all the nuances and context of the data. The IS auditor should also verify the reliability and validity of the automatic document classification system.
* Publish the data classification policy on the corporate web portal. This is a good practice, but it is not enough to improve the data classification situation. Publishing the data classification policy on the corporate web portal can increase the visibility and accessibility of the policy, but it does not ensure that data owners will read, understand, and follow it. The IS auditor should also monitor and enforce the compliance with the policy.
* Conduct awareness presentations and seminars for information classification policies. This is a useful measure, but it is not the most effective one. Conducting awareness presentations and seminars can raise the general awareness and knowledge of information classification policies among all employees, but it may not address the specific needs and challenges of data owners. The IS auditor should also provide more in-depth and practical training for data owners.
CISA-KR 문제 178
IT 용량 관리의 일환으로 대규모 서버에 미션 크리티컬 애플리케이션을 통합하기로 결정한 조직에게 가장 큰 잠재적 우려를 불러일으킬 수 있는 것은 다음 중 무엇입니까?
정답: A
Consolidating mission-critical applications onto a single large server introduces a single point of failure. If the server experiences an outage, all hosted applications could be impacted simultaneously, leading to significant operational disruptions. While continuous monitoring costs, potential network bandwidth issues, and challenges in capacity forecasting are valid concerns, the risk of a single outage affecting multiple critical applications presents the most substantial threat to business continuity.
References:
* ISACA CISA Review Manual, 28th Edition, Chapter 4: Information Systems Operations and Business Resilience.
References:
* ISACA CISA Review Manual, 28th Edition, Chapter 4: Information Systems Operations and Business Resilience.
CISA-KR 문제 179
다음 중 변경 사항이 적용된 후 시스템 무결성이 유지되었는지 평가하는 데 가장 적합한 테스트 방법은 무엇입니까?
정답: A
Regression testing is the most appropriate testing method for assessing whether system integrity has been maintained after changes have been made. Regression testing is a type of software testing that ensures that previously developed and tested software still performs as expected after a change1 Regression testing helps to detect any defects or errors that may have been introduced or uncovered due to the change2 Regression testing can be performed at different levels of testing, such as unit, integration, system, and acceptance3 Unit testing is a type of software testing that verifies the functionality of individual components or units of code. Unit testing is usually performed by developers before integrating the code with other components. Unit testing helps to identify and fix errors at an early stage of development, but it does not ensure that the system as a whole works as expected after a change.
Integration testing is a type of software testing that verifies the functionality, performance, and reliability of the interactions between different components or units of code. Integration testing is usually performed after unit testing and before system testing. Integration testing helps to identify and fix errors that may occur when different components are integrated, but it does not ensure that the system as a whole works as expected after a change.
Acceptance testing is a type of software testing that verifies whether the system meets the user requirements and expectations. Acceptance testing is usually performed by end-users or customers after system testing and before deploying the system to production. Acceptance testing helps to ensure that the system delivers the desired value and quality to the users, but it does not ensure that the system as a whole works as expected after a change.
References: 1: What is Regression Testing? Test Cases (Example) - Guru99 2: What is Regression Testing? Definition, Tools, Examples - Katalon 3: Regression testing - Wikipedia : What is Unit Testing?
Definition, Types, Tools & Examples - Guru99 : What is Integration Testing? Definition, Types, Tools & Examples - Guru99 : What is Acceptance Testing? Definition, Types, Tools & Examples - Guru99
Integration testing is a type of software testing that verifies the functionality, performance, and reliability of the interactions between different components or units of code. Integration testing is usually performed after unit testing and before system testing. Integration testing helps to identify and fix errors that may occur when different components are integrated, but it does not ensure that the system as a whole works as expected after a change.
Acceptance testing is a type of software testing that verifies whether the system meets the user requirements and expectations. Acceptance testing is usually performed by end-users or customers after system testing and before deploying the system to production. Acceptance testing helps to ensure that the system delivers the desired value and quality to the users, but it does not ensure that the system as a whole works as expected after a change.
References: 1: What is Regression Testing? Test Cases (Example) - Guru99 2: What is Regression Testing? Definition, Tools, Examples - Katalon 3: Regression testing - Wikipedia : What is Unit Testing?
Definition, Types, Tools & Examples - Guru99 : What is Integration Testing? Definition, Types, Tools & Examples - Guru99 : What is Acceptance Testing? Definition, Types, Tools & Examples - Guru99
CISA-KR 문제 180
외국에서 조직의 사이버 보안 규정 준수 여부를 감사할 계획을 세울 때 다음 중 가장 유용한 것은 무엇입니까?
정답: D
The most useful thing to do when planning to audit an organization's compliance with cybersecurity regulations in foreign countries is to map the different regulatory requirements to the organization's IT governance framework. This is because an IT governance framework is a roadmap that defines the methods used by an organization to implement, manage and report on IT governance within said organization1. IT governance helps align business and IT strategies using a solid and formal framework2. By mapping the different regulatory requirements to the IT governance framework, the auditor can:
Identify the commonalities and differences among the various cybersecurity regulations that apply to the organization's operations in different countries.
Assess the level of compliance and maturity of the organization's IT governance practices against each regulatory requirement.
Evaluate the risks and gaps associated with non-compliance or partial compliance with any of the regulatory requirements.
Recommend appropriate actions or improvements to enhance the organization's IT governance and cybersecurity posture.
Option D is correct because mapping the different regulatory requirements to the organization's IT governance framework is a systematic and effective way to plan and conduct an audit of compliance with cybersecurity regulations in foreign countries.
Identify the commonalities and differences among the various cybersecurity regulations that apply to the organization's operations in different countries.
Assess the level of compliance and maturity of the organization's IT governance practices against each regulatory requirement.
Evaluate the risks and gaps associated with non-compliance or partial compliance with any of the regulatory requirements.
Recommend appropriate actions or improvements to enhance the organization's IT governance and cybersecurity posture.
Option D is correct because mapping the different regulatory requirements to the organization's IT governance framework is a systematic and effective way to plan and conduct an audit of compliance with cybersecurity regulations in foreign countries.
- 다른 버전
- 303ISACA.CISA-KR.v2026-08-15.q712
- 4318ISACA.CISA-KR.v2026-05-16.q709
- 1866ISACA.CISA-KR.v2026-05-06.q261
- 3332ISACA.CISA-KR.v2026-03-16.q665
- 4742ISACA.CISA-KR.v2026-03-07.q651
- 9445ISACA.CISA-KR.v2025-04-07.q633
- 3810ISACA.CISA-KR.v2025-04-02.q544
- 4314ISACA.CISA-KR.v2025-03-31.q534
- 5524ISACA.CISA-KR.v2025-03-28.q617
- 3313ISACA.CISA-KR.v2025-03-19.q581
- 4197ISACA.CISA-KR.v2025-03-03.q807
- 5245ISACA.CISA-KR.v2024-02-07.q421
- 2921ISACA.CISA-KR.v2024-01-31.q392
- 5430ISACA.CISA-KR.v2023-10-24.q329
- 5260ISACA.CISA-KR.v2023-07-31.q266
- 3259ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 126Microsoft.AZ-305-KR.v2026-08-17.q162
- 140IIA.IAA-IAP-KR.v2026-08-17.q41
- 303ISACA.CISA-KR.v2026-08-15.q712
- 238Microsoft.MS-700-KR.v2026-08-15.q203
- 173Microsoft.AZ-305-KR.v2026-08-14.q177
- 238Microsoft.DP-900-KR.v2026-08-13.q130
- 315Microsoft.PL-600.v2026-08-11.q206
- 267Microsoft.DP-100.v2026-08-11.q160
- 209Oracle.1Z0-1048-25.v2026-08-11.q68
- 177ISQI.CTAL-TAE.v2026-08-11.q37
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-04-03.q628 모의시험 시험자료를 다운 받으세요.