CISA-KR 문제 26
IS 감사원은 SaaS(Software as a Service) 공급업체를 선택하기 전에 경영진에게 가장 중요한 조치로 무엇을 권고해야 할까요?
정답: B
Before selecting a SaaS vendor, the most important action is to complete a risk assessment. A risk assessment is a process of identifying, analyzing, and evaluating the potential risks associated with outsourcing software and IT infrastructure to a third-party provider. A risk assessment helps to determine the impact and likelihood of various threats, such as data breaches, service disruptions, vendor lock-in, compliance issues, and legal disputes. A risk assessment also helps to identify the mitigation strategies and controls that can reduce or eliminate the risks.
A risk assessment is more important than determining service level requirements, performing a business impact analysis (BIA), or conducting a vendor audit because it provides the basis for these other actions.
Service level requirements are the expectations and obligations that define the quality and quantity of service that the vendor must provide to the customer. A BIA is a process of assessing the potential effects of an interruption or disruption of critical business functions or processes due to an incident or disaster. A vendor audit is a process of verifying the vendor's compliance with the contract terms, service levels, security policies, and best practices.
Service level requirements, BIA, and vendor audit are all important actions for selecting a SaaS vendor, but they depend on the results of the risk assessment. For example, service level requirements should reflect the risk appetite and tolerance of the customer, which are determined by the risk assessment. A BIA should prioritize the recovery of the most critical and vulnerable business functions or processes, which are identified by the risk assessment. A vendor audit should focus on the areas of highest risk and concern, which are highlighted by the risk assessment.
Therefore, an IS auditor should recommend to management that completing a risk assessment is the most important action before selecting a SaaS vendor.
References:
SaaS checklist: Nine factors to consider when selecting a vendor
SaaS vendor management: 10 best practices to achieve success
Best Practices for Software SaaS Vendor Selection and Negotiation
How to Evaluate SaaS Providers and Solutions by Developing ... - Gartner
A risk assessment is more important than determining service level requirements, performing a business impact analysis (BIA), or conducting a vendor audit because it provides the basis for these other actions.
Service level requirements are the expectations and obligations that define the quality and quantity of service that the vendor must provide to the customer. A BIA is a process of assessing the potential effects of an interruption or disruption of critical business functions or processes due to an incident or disaster. A vendor audit is a process of verifying the vendor's compliance with the contract terms, service levels, security policies, and best practices.
Service level requirements, BIA, and vendor audit are all important actions for selecting a SaaS vendor, but they depend on the results of the risk assessment. For example, service level requirements should reflect the risk appetite and tolerance of the customer, which are determined by the risk assessment. A BIA should prioritize the recovery of the most critical and vulnerable business functions or processes, which are identified by the risk assessment. A vendor audit should focus on the areas of highest risk and concern, which are highlighted by the risk assessment.
Therefore, an IS auditor should recommend to management that completing a risk assessment is the most important action before selecting a SaaS vendor.
References:
SaaS checklist: Nine factors to consider when selecting a vendor
SaaS vendor management: 10 best practices to achieve success
Best Practices for Software SaaS Vendor Selection and Negotiation
How to Evaluate SaaS Providers and Solutions by Developing ... - Gartner
CISA-KR 문제 27
직원이 모바일 기기를 잃어 민감한 기업 데이터가 손실되었습니다. 다음 중 어느 것이 데이터 유출을 가장 잘 막을 수 있었을까요?
정답: A
The best way to prevent data leakage from a lost mobile device is data encryption on the mobile device. Data encryption is a technique that transforms data into an unreadable format using a secret key or algorithm. Data encryption protects data from unauthorized access or disclosure in case of loss or theft of a mobile device.
Complex password policy for mobile devices, triggering of remote data wipe capabilities, and awareness training for mobile device users are useful measures to enhance data security on mobile devices, but they do not prevent data leakage as effectively as data encryption. A complex password policy can be bypassed by brute force attacks or password cracking tools. Remote data wipe capabilities depend on network connectivity and device power availability. Awareness training for mobile device users can reduce human errors or negligence, but it cannot guarantee compliance or behavior change. References: CISA Review Manual (Digital Version): Chapter 5 - Information Systems Operations and Business Resilience
Complex password policy for mobile devices, triggering of remote data wipe capabilities, and awareness training for mobile device users are useful measures to enhance data security on mobile devices, but they do not prevent data leakage as effectively as data encryption. A complex password policy can be bypassed by brute force attacks or password cracking tools. Remote data wipe capabilities depend on network connectivity and device power availability. Awareness training for mobile device users can reduce human errors or negligence, but it cannot guarantee compliance or behavior change. References: CISA Review Manual (Digital Version): Chapter 5 - Information Systems Operations and Business Resilience
CISA-KR 문제 28
원격 콜센터를 통해 고객 데이터베이스를 양방향으로 복제하는 제안된 프로젝트를 평가할 때 IS 감사자는 다음 사항을 확인해야 합니다.
정답: A
A database conflict occurs when the same data is modified at two separate servers, such as a customer database and a remote call center database, and the changes are not consistent with each other. For example, if a customer updates their phone number at the customer database, and a call center agent updates the same customer's address at the remote call center database, there is a conflict between the two updates. Database conflicts can cause data inconsistency, corruption, or loss if they are not detected and resolved properly.
Two-way replication is a process of synchronizing data between two databases, so that any changes made in one database are reflected in the other database, and vice versa. Two-way replication can improve data availability, performance, and scalability, but it also increases the risk of database conflicts. Therefore, when assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that database conflicts are managed during replication. This means that the project should have a clear and effective strategy for:
* Preventing or minimizing database conflicts by using techniques such as locking, timestamping, or partitioning.
* Detecting or identifying database conflicts by using tools such as triggers, logs, or alerts.
* Resolving or handling database conflicts by using methods such as priority-based, rule-based, or user- based resolution.
The other possible options are:
* B. end users are trained in the replication process: This is not a relevant or important factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. End users are not directly involved in the replication process, and they do not need to have detailed knowledge or skills about how replication works. The replication process should be transparent and seamless to the end users, and they should only interact with the data through their applications or interfaces.
* C. the source database is backed up on both sites: This is not a sufficient or necessary factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. Backing up the source database on both sites can provide some level of data protection and recovery, but it does not address the issue of database conflicts that can occur during replication. Moreover, backing up the source database on both sites may not be feasible or efficient, as it may consume more storage space and network bandwidth, and introduce more complexity and overhead to the replication process.
* D. user rights are identical on both databases: This is not a critical or relevant factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. User rights are the permissions or privileges that users have to access or modify data in a database. User rights do not directly affect the occurrence or resolution of database conflicts during replication. User rights may vary depending on the role or function of the users in different databases, and they should be defined and enforced according to the security policies and requirements of each database.
Two-way replication is a process of synchronizing data between two databases, so that any changes made in one database are reflected in the other database, and vice versa. Two-way replication can improve data availability, performance, and scalability, but it also increases the risk of database conflicts. Therefore, when assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that database conflicts are managed during replication. This means that the project should have a clear and effective strategy for:
* Preventing or minimizing database conflicts by using techniques such as locking, timestamping, or partitioning.
* Detecting or identifying database conflicts by using tools such as triggers, logs, or alerts.
* Resolving or handling database conflicts by using methods such as priority-based, rule-based, or user- based resolution.
The other possible options are:
* B. end users are trained in the replication process: This is not a relevant or important factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. End users are not directly involved in the replication process, and they do not need to have detailed knowledge or skills about how replication works. The replication process should be transparent and seamless to the end users, and they should only interact with the data through their applications or interfaces.
* C. the source database is backed up on both sites: This is not a sufficient or necessary factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. Backing up the source database on both sites can provide some level of data protection and recovery, but it does not address the issue of database conflicts that can occur during replication. Moreover, backing up the source database on both sites may not be feasible or efficient, as it may consume more storage space and network bandwidth, and introduce more complexity and overhead to the replication process.
* D. user rights are identical on both databases: This is not a critical or relevant factor for the IS auditor to ensure when assessing a proposed project for the two-way replication of a customer database with a remote call center. User rights are the permissions or privileges that users have to access or modify data in a database. User rights do not directly affect the occurrence or resolution of database conflicts during replication. User rights may vary depending on the role or function of the users in different databases, and they should be defined and enforced according to the security policies and requirements of each database.
CISA-KR 문제 29
다음 중 사물 인터넷(IoT) 기기를 잠재적인 사이버 공격으로부터 보호하는 데 가장 중요한 보안 조치는 무엇입니까?
정답: C
Changing default passwords is a critical security measure for IoT devices. Many IoT devices come with default credentials that are widely known and easily exploitable by attackers. Ensuring that these default passwords are changed to strong, unique passwords significantly reduces the risk of unauthorized access.
While logging, monitoring, firmware compliance, and network diagram reviews are important security practices, they are secondary to the fundamental step of securing device access through strong authentication.
References:
* ISACA CISA Review Manual, 28th Edition, Chapter 5: Protection of Information Assets.
While logging, monitoring, firmware compliance, and network diagram reviews are important security practices, they are secondary to the fundamental step of securing device access through strong authentication.
References:
* ISACA CISA Review Manual, 28th Edition, Chapter 5: Protection of Information Assets.
CISA-KR 문제 30
네트워크 장치(예: 라우터)가 다른 IP 주소와 통신할 때 성공 또는 실패를 나타내는 오류 메시지와 운영 정보를 전송하는 데 사용하는 네트워크 통신 프로토콜은 다음 중 무엇입니까?
정답: A
- 다른 버전
- 2307ISACA.CISA-KR.v2026-08-27.q676
- 4368ISACA.CISA-KR.v2026-08-15.q712
- 6875ISACA.CISA-KR.v2026-05-16.q709
- 2721ISACA.CISA-KR.v2026-05-06.q261
- 4610ISACA.CISA-KR.v2026-03-16.q665
- 6581ISACA.CISA-KR.v2026-03-07.q651
- 11007ISACA.CISA-KR.v2025-04-07.q633
- 4731ISACA.CISA-KR.v2025-04-02.q544
- 5307ISACA.CISA-KR.v2025-03-31.q534
- 6651ISACA.CISA-KR.v2025-03-28.q617
- 4279ISACA.CISA-KR.v2025-03-19.q581
- 5432ISACA.CISA-KR.v2025-03-03.q807
- 6007ISACA.CISA-KR.v2024-02-07.q421
- 3608ISACA.CISA-KR.v2024-01-31.q392
- 5921ISACA.CISA-KR.v2023-10-24.q329
- 5710ISACA.CISA-KR.v2023-07-31.q266
- 3801ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 146Nokia.SRAN-Radio-Network-Performance-Optimization.v2026-10-16.q18
- 161Pegasystems.PEGACPRSA22V1.v2026-10-16.q33
- 177PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 213Splunk.SPLK-1002.v2026-10-15.q187
- 139Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 144AIChE.CCPSC.v2026-10-15.q37
- 211API.API-571.v2026-10-15.q131
- 134Microsoft.AB-210.v2026-10-14.q58
- 135Huawei.H12-893_V1.0.v2026-10-14.q46
- 172UiPath.UiPath-ADPv1.v2026-10-14.q114
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-04-03.q628 모의시험 시험자료를 다운 받으세요.