CISA-KR 문제 416
조직은 타사 서비스 제공업체로부터 자동화된 데이터 피드를 엔터프라이즈 데이터 웨어하우스로 수신할 계획입니다. 다음 중 잘못된 데이터 수신을 방지하는 가장 좋은 방법은 무엇일까요?
정답: D
The best way to prevent accepting bad data from a third-party service provider is to implement business rules to reject invalid data. Business rules are logical statements that define the data quality requirements and standards for the organization. By implementing business rules, the organization can ensure that only data that meets the predefined criteria is accepted into the enterprise data warehouse. Obtaining error codes indicating failed data feeds, purchasing data cleansing tools from a reputable vendor, and appointing data quality champions across the organization are useful measures to improve data quality, but they do not prevent accepting bad data in the first place. References: ISACA Journal Article: Data Quality Management
CISA-KR 문제 417
조직의 최종 사용자 컴퓨팅(EUC)과 관련된 위험을 평가하는 IS 감사자에게 가장 큰 관심사가 되어야 하는 결과는 무엇입니까?
정답: D
The finding that should be of greatest concern to an IS auditor assessing the risk associated with end-user computing (EUC) in an organization is the lack of defined criteria for EUC applications. EUC applications are applications that are developed and maintained by end-users, rather than by IT professionals, to support their business functions and processes. Examples of EUC applications include spreadsheets, databases, reports, and scripts. The lack of defined criteria for EUC applications means that the organization does not have clear and consistent standards or guidelines to identify, classify, and manage EUC applications. This can lead to various risks, such as:
* Inaccurate or unreliable data and results from EUC applications that are not validated, verified, or tested
* Unauthorized or inappropriate access or use of EUC applications that are not secured, controlled, or monitored
* Inconsistent or incompatible data and results from EUC applications that are not integrated, documented, or updated
* Loss or corruption of data and results from EUC applications that are not backed up, recovered, or archived Therefore, the IS auditor should be most concerned about the lack of defined criteria for EUC applications, as it can affect the quality, integrity, and availability of the EUC applications and the data they produce.
Insufficient processes to track ownership of each EUC application is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. The ownership of an EUC application refers to the person or group who is responsible for creating, maintaining, and using the EUC application. Insufficient processes to track ownership of each EUC application means that the organization does not have adequate mechanisms or records to identify and communicate who owns each EUC application. This can lead to risks, such as:
* Lack of accountability or ownership for the quality and accuracy of the EUC application and its data
* Lack of support or maintenance for the EUC application when the owner leaves or changes roles
* Lack of awareness or training for the users of the EUC application on its purpose and functionality However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
Insufficient processes to test for version control is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. Version control is a process that tracks and manages the changes made to an EUC application over time. Insufficient processes to test for version control means that the organization does not have adequate procedures or tools to ensure that the changes made to an EUC application are authorized, documented, and tested. This can lead to risks, such as:
* Errors or inconsistencies in the data and results from different versions of the EUC application
* Conflicts or confusion among the users of the EUC application on which version is current or correct
* Loss or overwrite of data and results from previous versions of the EUC application However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
Lack of awareness training for EUC users is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. Awareness training for EUC users is a process that educates and informs the users of the EUC applications on their roles, responsibilities, and risks. Lack of awareness training for EUC users means that the organization does not have adequate programs or materials to raise the knowledge and skills of the users on how to use and manage the EUC applications effectively and securely. This can lead to risks, such as:
* Misuse or abuse of the EUC applications by users who are not aware of their impact or implications
* Non-compliance or violation of policies or regulations by users who are not aware of their requirements or expectations
* Dissatisfaction or frustration among users who are not aware of their benefits or limitations However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
References:
* End-user computing - Wikipedia 1
* How to Manage the Risks Associated with End User Computing 2
* Managing end user computing risks - KPMG UK 3
* Inaccurate or unreliable data and results from EUC applications that are not validated, verified, or tested
* Unauthorized or inappropriate access or use of EUC applications that are not secured, controlled, or monitored
* Inconsistent or incompatible data and results from EUC applications that are not integrated, documented, or updated
* Loss or corruption of data and results from EUC applications that are not backed up, recovered, or archived Therefore, the IS auditor should be most concerned about the lack of defined criteria for EUC applications, as it can affect the quality, integrity, and availability of the EUC applications and the data they produce.
Insufficient processes to track ownership of each EUC application is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. The ownership of an EUC application refers to the person or group who is responsible for creating, maintaining, and using the EUC application. Insufficient processes to track ownership of each EUC application means that the organization does not have adequate mechanisms or records to identify and communicate who owns each EUC application. This can lead to risks, such as:
* Lack of accountability or ownership for the quality and accuracy of the EUC application and its data
* Lack of support or maintenance for the EUC application when the owner leaves or changes roles
* Lack of awareness or training for the users of the EUC application on its purpose and functionality However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
Insufficient processes to test for version control is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. Version control is a process that tracks and manages the changes made to an EUC application over time. Insufficient processes to test for version control means that the organization does not have adequate procedures or tools to ensure that the changes made to an EUC application are authorized, documented, and tested. This can lead to risks, such as:
* Errors or inconsistencies in the data and results from different versions of the EUC application
* Conflicts or confusion among the users of the EUC application on which version is current or correct
* Loss or overwrite of data and results from previous versions of the EUC application However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
Lack of awareness training for EUC users is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. Awareness training for EUC users is a process that educates and informs the users of the EUC applications on their roles, responsibilities, and risks. Lack of awareness training for EUC users means that the organization does not have adequate programs or materials to raise the knowledge and skills of the users on how to use and manage the EUC applications effectively and securely. This can lead to risks, such as:
* Misuse or abuse of the EUC applications by users who are not aware of their impact or implications
* Non-compliance or violation of policies or regulations by users who are not aware of their requirements or expectations
* Dissatisfaction or frustration among users who are not aware of their benefits or limitations However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
References:
* End-user computing - Wikipedia 1
* How to Manage the Risks Associated with End User Computing 2
* Managing end user computing risks - KPMG UK 3
CISA-KR 문제 418
다음 중 폭포수 방법론보다 애자일 소프트웨어 개발 방법론을 사용하는 이점은 무엇입니까?
정답: B
The advantage of using agile software development methodology over the waterfall methodology is that it allows for quicker deliverables. Agile software development is an iterative and incremental approach that emphasizes customer feedback, collaboration, and adaptation. Agile software development delivers working software in short cycles, called sprints, that typically last from two to four weeks. This enables the development team to respond to changing requirements, deliver value faster, and improve quality. Waterfall software development is a linear and sequential approach that follows a predefined set of phases, such as planning, analysis, design, implementation, testing, and maintenance. Waterfall software development requires a clear and stable definition of the project scope, deliverables, and expectations before starting the development process. Waterfall software development can be slow, rigid, and costly, especially if changes occur during the later stages of the project. References: CISA Review Manual (Digital Version), Chapter 3:
Information Systems Acquisition, Development & Implementation, Section 3.1: Project Management Practices
Information Systems Acquisition, Development & Implementation, Section 3.1: Project Management Practices
CISA-KR 문제 419
IS 감사원은 특정 공급업체의 미지급금 거래 샘플을 분석하고 평균 거래보다 5배 높은 가치를 가진 거래를 하나 식별합니다. 감사원은 다음 중 무엇을 다음으로 해야 합니까?
정답: B
An IS auditor is analyzing a sample of accounts payable transactions for a specific vendor and identifies one transaction with a value five times as high as the average transaction. The next step that the auditor should do is to request an explanation of the variance from the auditee. This is because the variance may indicate an error, fraud, or an unusual but legitimate transaction that requires further investigation. The auditor should not report the variance immediately to the audit committee without verifying its cause and significance. The auditor should not increase the sample size to 100% of the population without considering the cost-benefit analysis and the sampling methodology. The auditor should not exclude the transaction from the sample population without justification, as itmay affect the validity and reliability of the audit results. References: CISA Review Manual (Digital Version), [ISACA Auditing Standards]
CISA-KR 문제 420
엔터프라이즈 리소스 플래닝(ERP) 시스템 감사 중에 IS 감사자는 프로덕션 환경에 애플리케이션 패치가 적용되었음을 발견했습니다. IS 감사자가 다음으로부터 승인을 확인하는 것이 가장 중요합니다.
정답: A
- 다른 버전
- 242ISACA.CISA-KR.v2026-08-15.q712
- 4250ISACA.CISA-KR.v2026-05-16.q709
- 1832ISACA.CISA-KR.v2026-05-06.q261
- 3201ISACA.CISA-KR.v2026-03-16.q665
- 4691ISACA.CISA-KR.v2026-03-07.q651
- 4499ISACA.CISA-KR.v2025-04-03.q628
- 3792ISACA.CISA-KR.v2025-04-02.q544
- 4293ISACA.CISA-KR.v2025-03-31.q534
- 5446ISACA.CISA-KR.v2025-03-28.q617
- 3273ISACA.CISA-KR.v2025-03-19.q581
- 4101ISACA.CISA-KR.v2025-03-03.q807
- 5235ISACA.CISA-KR.v2024-02-07.q421
- 2904ISACA.CISA-KR.v2024-01-31.q392
- 5412ISACA.CISA-KR.v2023-10-24.q329
- 5244ISACA.CISA-KR.v2023-07-31.q266
- 3244ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 242ISACA.CISA-KR.v2026-08-15.q712
- 181Microsoft.MS-700-KR.v2026-08-15.q203
- 134Microsoft.AZ-305-KR.v2026-08-14.q177
- 204Microsoft.DP-900-KR.v2026-08-13.q130
- 290Microsoft.PL-600.v2026-08-11.q206
- 226Microsoft.DP-100.v2026-08-11.q160
- 189Oracle.1Z0-1048-25.v2026-08-11.q68
- 160ISQI.CTAL-TAE.v2026-08-11.q37
- 202ServiceNow.CIS-HR.v2026-08-11.q84
- 282Salesforce.Plat-Arch-201.v2026-08-10.q101
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-04-07.q633 모의시험 시험자료를 다운 받으세요.