CISA-KR 문제 71
Who initiated, approved, modified, or deleted a transaction
When a transaction occurred (date and time)
Where a transaction took place (location or device)
What type of transaction was performed (action or operation)
Why a transaction was executed (purpose or reason)
By analyzing audit trails, an IS auditor can verify whether transactions have been executed by authorized employees or not. Audit trails can also identify any unauthorized, fraudulent, or erroneous transactions that may have occurred. Audit trails can also help to resolve any disputes or discrepancies that may arise from transactions.
References:
What Is an Audit Trail? Everything You Need to Know
CISA-KR 문제 72
Consolidating multiple applications on asingle serverincreases the risk that aserver outagewillimpact multiple applicationssimultaneously.
* More Applications Affected by Outage (Correct Answer - B)
* Asingle point of failurecoulddisrupt multiple services.
* Example:If aconsolidated server crashes, all hosted applications gooffline.
* Higher OS License Fees (Incorrect - A)
* License feesmay increase, butdowntime risk is a greater concern.
* Simplified Asset Management (Incorrect - C)
* True, butdoes not outweigh the availability risk.
* Fewer Vulnerability Scans (Incorrect - D)
* Reducing the number of serversdoes not reduce security risks.
References:
* ISACA CISA Review Manual
* NIST 800-160 (System Security Engineering)
CISA-KR 문제 73
However, if an application uses individual end-user accounts to access the underlying database, it means that the users have direct access to the database without going through the application layer. This can expose the database to potential risks such as:
Users may be able to bypass the application controls and manipulate the data in the database directly using SQL commands or other tools. For example, users may be able to change their own or others' salaries, grades, or balances without proper authorization or validation.
Users may be able to access or disclose sensitive or confidential data that they are not supposed to see or share. For example, users may be able to view other users' personal information, passwords, or credit card numbers.
Users may be able to introduce errors or inconsistencies in the data by entering invalid or incorrect data or by deleting or modifying existing data. For example, users may be able to create duplicate records, break referential integrity, or cause data loss or corruption.
Users may be able to compromise the security and performance of the database by creating unauthorized objects, granting excessive privileges, executing malicious code, or consuming excessive resources. For example, users may be able to create backdoors, viruses, or denial-of-service attacks.
Therefore, using individual end-user accounts to access the underlying database can pose a serious threat to the integrity, confidentiality, availability, and reliability of the data and the application.
The other options are not as significant as option C. Multiple connects to the database are used and slow the process is a performance issue that can affect the efficiency and responsiveness of the application and the database, but it does not necessarily compromise the data quality or security. User accounts may remain active after a termination is a security issue that can increase the risk of unauthorized access or misuse of data by former employees or others who have access to their credentials, but it can be mitigated by implementing proper account management and monitoring processes. Application may not capture a complete audit trail is a compliance issue that can affect the accountability and traceability of transactions and data within the application and the database, but it does not directly affect the data accuracy or protection.
References:
Should application users be database users? - Stack Overflow1
An Approach Toward Sarbanes-Oxley ITGC Risk Assessment - ISACA2
ISACA CISA Certified Information Systems Auditor Exam ... - PUPUWEB3
Why inactive accounts are a security risk | Stratosphere4
CISA-KR 문제 74
드라이브를 보내기 전에 가장 중요한 것은 무엇입니까?
CISA-KR 문제 75
3, Section 3.5.2
- 다른 버전
- 3978ISACA.CISA-KR.v2026-05-16.q709
- 1797ISACA.CISA-KR.v2026-05-06.q261
- 3118ISACA.CISA-KR.v2026-03-16.q665
- 4484ISACA.CISA-KR.v2026-03-07.q651
- 4451ISACA.CISA-KR.v2025-04-03.q628
- 3672ISACA.CISA-KR.v2025-04-02.q544
- 4221ISACA.CISA-KR.v2025-03-31.q534
- 5320ISACA.CISA-KR.v2025-03-28.q617
- 3151ISACA.CISA-KR.v2025-03-19.q581
- 3976ISACA.CISA-KR.v2025-03-03.q807
- 5133ISACA.CISA-KR.v2024-02-07.q421
- 2806ISACA.CISA-KR.v2024-01-31.q392
- 5268ISACA.CISA-KR.v2023-10-24.q329
- 5215ISACA.CISA-KR.v2023-07-31.q266
- 3111ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 114Microsoft.AZ-305-KR.v2026-08-14.q177
- 154Microsoft.DP-900-KR.v2026-08-13.q130
- 244Microsoft.PL-600.v2026-08-11.q206
- 183Microsoft.DP-100.v2026-08-11.q160
- 177Oracle.1Z0-1048-25.v2026-08-11.q68
- 145ISQI.CTAL-TAE.v2026-08-11.q37
- 195ServiceNow.CIS-HR.v2026-08-11.q84
- 259Salesforce.Plat-Arch-201.v2026-08-10.q101
- 245Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 192F5.F5CAB2.v2026-08-10.q41
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-04-07.q633 모의시험 시험자료를 다운 받으세요.