무료 온라인 액세스 ISACA.CISA-KR.v2025-04-07.q633 모의 시험 (Page 30)

CISA-KR 문제 141

IS 감사원이 은행의 2차 데이터 센터를 호스팅하는 제3자 공급업체와 체결한 은행의 서비스 수준 계약(SLA)을 검토하고 있습니다. 다음 중 감사원이 가장 우려해야 할 사항은 무엇입니까?

A. 복구 시간 목표(RTO)가 재해 복구 계획(ORP)에 기록된 것보다 더 깁니다.

B. SLA가 1년 이상 검토되지 않았습니다.

C. 백업 데이터는 온라인에만 호스팅됩니다.

D. 복구 지점 목표(RPO)의 기간이 재해 복구 계획(DRP)에 기록된 것보다 짧습니다.

정답: A

The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP) should be of greatest concern to the auditor when reviewing a bank's SLA with a third-party provider that hosts the bank's secondary data center. This is because the RTO is the maximum acceptable time for restoring a system or an application after a disaster or a disruption. A longer RTO than the DRP means that the bank may not be able to resume its critical business operations within the expected time frame, which may result in significant financial losses, reputational damage, customer dissatisfaction, or regulatory non- compliance12.
The SLA has not been reviewed in more than a year is not the greatest concern, although it is a good practice to review and update the SLA periodically to ensure that it reflects the current business needs and expectations, as well as any changes in the service provider's capabilities or performance. However, a lack of review does not necessarily imply a lack of compliance or quality of service, as long as the SLA is still valid and enforceable34.
Backup data is hosted online only is not the greatest concern, although it may pose some security risks if the backup data is not encrypted or protected by adequate access controls. Online backup data means that the backup data is stored on a remote server that can be accessed via the Internet, which may offer some advantages such as faster recovery, lower cost, and higher availability than offline backup data that is stored on physical media such as tapes or disks. However, online backup data also requires reliable network connectivity and bandwidth, as well as proper security measures to prevent unauthorized access or tampering56.
The recovery point objective (RPO) has a shorter duration than documented in the DRP is not the greatest concern, although it may indicate some inconsistency or misalignment between the SLA and the DRP. The RPO is the maximum acceptable amount of data loss measured in time from a disaster or a disruption. A shorter RPO than the DRP means that the bank may lose less data than expected, which may be beneficial for its business continuity and recovery. However, a shorter RPO may also imply more frequent backups, which may increase the cost and complexity of the backup process

CISA-KR 문제 142

경영진이 프로젝트 포트폴리오를 검토할 때 고려해야 할 가장 유용한 지표는 다음 중 어느 것일까요?

A. 총 IT 비용으로 나눈 프로젝트 비용

B. 총 프로젝트 비용으로 나눈 예상 수익

C. 포트폴리오의 순현재가치(NPV)

D. 각 프로젝트의 총 비용

정답: C

The most useful metric for management to consider when reviewing a project portfolio is the net present value (NPV) of the portfolio. NPV is a measure of the profitability and value of a project or a portfolio of projects, taking into account the time value of money and the expected cash flows. NPV compares the present value of the future cash inflows with the present value of the initial investment and shows how much value is created or lost by undertaking a project or a portfolio of projects1. A positive NPV indicates that the project or portfolio is worth more than its cost and will generate a positive return on investment. A negative NPV indicates that the project or portfolio is worth less than its cost and will result in a loss. Therefore, NPV helps management to prioritize and select the most profitable and valuable projects or portfolios that align with the organizational strategy and objectives2. The other options are less useful or incorrect because:
* A. Cost of projects divided by total IT cost is not a useful metric for reviewing a project portfolio, as it does not reflect the benefits, value, or return of the projects. It only shows the proportion of IT budget allocated to the projects, which may not be indicative of their strategic importance or alignment3.
* B. Expected return divided by total project cost is not a useful metric for reviewing a project portfolio, as it does not account for the time value of money and the timing of cash flows. It only shows the average return per unit of cost, which may not be comparable across different projects or portfolios with different durations, risks, and cash flow patterns4.
* D. Total cost of each project is not a useful metric for reviewing a project portfolio, as it does not reflect the benefits, value, or return of the projects. It only shows the initial investment required for each project, which may not be indicative of their profitability or viability5. References: Portfolio, Program and Project Management Using COBIT 5 - ISACA, Project Portfolio Management - ISACA, CISA Review Manual (Digital Version), Standards, Guidelines, Tools and Techniques

CISA-KR 문제 143

IS 감사자는 조직의 정보 자산 관리 프로세스를 검토하고 있습니다. 다음 중 감사자에게 가장 큰 관심사는 무엇일까요?

A. 이 프로세스에서는 자산의 물리적 위치를 지정할 필요가 없습니다.

B. 프로세스 소유권이 설정되지 않았습니다.

C. 해당 프로세스에는 자산 검토가 포함되지 않습니다.

D. 자산 가치 식별은 이 과정에 포함되지 않습니다.

CISA-KR 문제 144

IS 감사인은 불규칙성이 발생했음을 발견했지만, 감사 대상 경영진은 이를 무시하기로 선택했습니다.
외부 기관에 보고해야 하는 경우 IS 감사자가 취해야 할 가장 좋은 조치는 다음 중 무엇입니까?

A. 감사 및 감사 대상자 경영진으로부터 보고서를 발행하기 위한 승인을 받습니다.

B. 감사대상자 경영진으로부터 보고서 발행에 대한 승인을 받습니다.

C. 감사 관리부서로부터 보고서 제출에 대한 승인을 받으세요.

D. 해당 규제 기관에 즉시 보고서를 제출하세요.

CISA-KR 문제 145

조직의 정보 보안 프레임워크를 검토하는 IS 감사자가 가장 우려해야 할 사항은 다음 중 무엇입니까?

A. 정보보안정책은 지난 2년간 업데이트되지 않았습니다.

B. 고위 경영진은 정보 보안 정책 개발에 참여하지 않았습니다.

C. 정보 보안 정책에 중요 정보 자산 목록이 포함되지 않았습니다.

D. 정보 보안 정책이 규정 요구 사항과 일치하지 않습니다.

다른 버전: 4007ISACA.CISA-KR.v2026-05-16.q709; 1799ISACA.CISA-KR.v2026-05-06.q261; 3124ISACA.CISA-KR.v2026-03-16.q665; 4489ISACA.CISA-KR.v2026-03-07.q651; 4453ISACA.CISA-KR.v2025-04-03.q628; 3691ISACA.CISA-KR.v2025-04-02.q544; 4223ISACA.CISA-KR.v2025-03-31.q534; 5321ISACA.CISA-KR.v2025-03-28.q617; 3152ISACA.CISA-KR.v2025-03-19.q581; 3992ISACA.CISA-KR.v2025-03-03.q807; 5135ISACA.CISA-KR.v2024-02-07.q421; 2846ISACA.CISA-KR.v2024-01-31.q392; 5282ISACA.CISA-KR.v2023-10-24.q329; 5215ISACA.CISA-KR.v2023-07-31.q266; 3133ISACA.CISA-KR.v2023-06-23.q324

최근 업로드: 116Microsoft.AZ-305-KR.v2026-08-14.q177; 155Microsoft.DP-900-KR.v2026-08-13.q130; 244Microsoft.PL-600.v2026-08-11.q206; 183Microsoft.DP-100.v2026-08-11.q160; 177Oracle.1Z0-1048-25.v2026-08-11.q68; 145ISQI.CTAL-TAE.v2026-08-11.q37; 195ServiceNow.CIS-HR.v2026-08-11.q84; 259Salesforce.Plat-Arch-201.v2026-08-10.q101; 245Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76; 192F5.F5CAB2.v2026-08-10.q41