CISA-KR 문제 86
정보 자산 분류의 주요 이점은 다음과 같습니다.
정답: D
The primary benefit of information asset classification is that it enables risk management decisions.
Information asset classification helps to identify the value, sensitivity and criticality of information assets, and to determine the appropriate level of protection and controls required for them. This facilitates risk assessment and risk treatment processes, and ensures that information assets are aligned with business objectives and regulatory requirements. Preventing loss of assets, helping to align organizational objectives or facilitating budgeting accuracy are secondary benefits of information asset classification, but not the main purpose. References: ISACA, CISA Review Manual, 27th Edition, 2018, page 300
Information asset classification helps to identify the value, sensitivity and criticality of information assets, and to determine the appropriate level of protection and controls required for them. This facilitates risk assessment and risk treatment processes, and ensures that information assets are aligned with business objectives and regulatory requirements. Preventing loss of assets, helping to align organizational objectives or facilitating budgeting accuracy are secondary benefits of information asset classification, but not the main purpose. References: ISACA, CISA Review Manual, 27th Edition, 2018, page 300
CISA-KR 문제 87
한 조직에서 자동화된 지속적 통합/지속적 배포(CI/CD) 도구를 사용하여 변경 사항을 운영 환경에 배포합니다. 이 상황에서 IS 감사자가 가장 우려하는 사항은 무엇일까요?
정답: C
The greatest concern in a CI/CD environment is the accuracy of automated testing. Since code is deployed rapidly and often without manual intervention, weak or inaccurate test cases can allow vulnerabilities and defects to be pushed directly into production. Release frequency (A) and changing user requirements (D) are expected characteristics of agile/DevOps models and can be managed with governance. Delayed post- implementation reviews (B) may reduce oversight but do not directly undermine the core pipeline integrity.
ISACA's DevOps guidance emphasizes that automated testing and validation of requirements must be thorough and reliable to ensure continuous deployment does not compromise quality or security.
References (ISACA): COBIT Focus Area for DevOps; BAI06 Managed IT Changes.
ISACA's DevOps guidance emphasizes that automated testing and validation of requirements must be thorough and reliable to ensure continuous deployment does not compromise quality or security.
References (ISACA): COBIT Focus Area for DevOps; BAI06 Managed IT Changes.
CISA-KR 문제 88
내부 네트워크 세그먼트 간의 방화벽은 다음과 같은 방법으로 보안을 강화하고 위험을 줄입니다.
정답: B
A firewall between internal network segments improves security and reduces risk by inspecting all traffic flowing between network segments and applying security policies. This will prevent unauthorized or malicious access, data leakage, or network attacks from compromising the network resources or data. Logging all packets passing through network segments may provide audit trails and evidence, but not prevent or mitigate security incidents. Monitoring and reporting on sessions between network participants may help to identify anomalous or suspicious activities, but not block or filter them. Ensuring all connecting systems have appropriate security controls enabled may enhance the overall network security posture, but not isolate or segregate different network segments. References: Info Technology & Systems Resources | COBIT, Risk, Governance ... - ISACA, section "Book COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution | Digital | English"
CISA-KR 문제 89
다음 중 기존 시스템과 호환되지 않는 기술을 사용하는 새 시스템으로 전환하는 데 따른 위험을 가장 잘 줄이는 방법은 무엇입니까?
정답: A
The best method to reduce the risk associated with the transition to a new system using technologies that are not compatible with the old system is parallel changeover. Parallel changeover is a method of system conversion that involves running both the old and the new systems simultaneously for a period of time, until the new system is verified to be working correctly and completely. Parallel changeover can help reduce the risk of data loss, errors, or disruptions that may occur due to the incompatibility of the technologies, as well as provide a backup option in case of failure or malfunction of the new system. Parallel changeover can also help users compare and validate the results of both systems, and facilitate their training and adaptation to the new system.
Modular changeover is a method of system conversion that involves replacing one module or component of the old system with a corresponding module or component of the new system at a time, until the entire system is replaced. Modular changeover can help reduce the complexity and scope of the conversion, as well as minimize the impact on the users and operations. However, modular changeover may not be feasible or effective when the technologies of the old and new systems are not compatible, as it may create integration or interoperability issues among the modules.
Phased operation is a method of system conversion that involves implementing the new system in stages or increments, each with a subset of functions or features, until the entire system is operational. Phased operation can help reduce the risk and cost of implementing a large and complex system, as well as allow for testing and feedback at each stage. However, phased operation may not be suitable or efficient when the technologies of the old and new systems are not compatible, as it may require extensive modifications or adaptations to enable partial functionality.
Pilot operation is a method of system conversion that involves implementing the new system in a limited or controlled environment, such as a department or a location, before rolling it out to the entire organization.
Pilot operation can help test and evaluate the performance and usability of the new system, as well as identify and resolve any issues or problems before full-scale implementation. However, pilot operation may not be relevant or reliable when the technologies of the old and new systems are not compatible, as it may not reflect the actual conditions or challenges of operating both systems concurrently.
References:
* TRANSITION TO THE NEW SYSTEM - O'Reilly Media 1
* 10 Challenges To Think About When Upgrading From Legacy Systems - Forbes
Modular changeover is a method of system conversion that involves replacing one module or component of the old system with a corresponding module or component of the new system at a time, until the entire system is replaced. Modular changeover can help reduce the complexity and scope of the conversion, as well as minimize the impact on the users and operations. However, modular changeover may not be feasible or effective when the technologies of the old and new systems are not compatible, as it may create integration or interoperability issues among the modules.
Phased operation is a method of system conversion that involves implementing the new system in stages or increments, each with a subset of functions or features, until the entire system is operational. Phased operation can help reduce the risk and cost of implementing a large and complex system, as well as allow for testing and feedback at each stage. However, phased operation may not be suitable or efficient when the technologies of the old and new systems are not compatible, as it may require extensive modifications or adaptations to enable partial functionality.
Pilot operation is a method of system conversion that involves implementing the new system in a limited or controlled environment, such as a department or a location, before rolling it out to the entire organization.
Pilot operation can help test and evaluate the performance and usability of the new system, as well as identify and resolve any issues or problems before full-scale implementation. However, pilot operation may not be relevant or reliable when the technologies of the old and new systems are not compatible, as it may not reflect the actual conditions or challenges of operating both systems concurrently.
References:
* TRANSITION TO THE NEW SYSTEM - O'Reilly Media 1
* 10 Challenges To Think About When Upgrading From Legacy Systems - Forbes
CISA-KR 문제 90
데이터 분류 프로세스를 구현할 때 데이터 소유자의 가장 중요한 책임은 다음 중 무엇입니까?
정답: C
The most important responsibility of data owners when implementing a data classification process is determining appropriate user access levels (option C). This is because:
Data owners are the persons or entities that have the authority and responsibility for the business processes and functions that collect, use, store, and dispose of data1.
Data owners are accountable for ensuring that the data is handled in compliance with the applicable laws, regulations, policies, and standards, such as the GDPR and the PIPEDA1234.
Data owners are in the best position to determine the purpose and necessity of collecting and retaining data, as well as the risks and benefits associated with it1.
Data owners should consult with other stakeholders, such as the risk manager, the database administrator (DBA), and the privacy manager, to establish and implement appropriate data classification policies and procedures2.
Data classification is the process of organizing data in groups based on their attributes and characteristics, and then assigning class labels that describe a set of attributes that hold true for the corresponding data sets345.
Data classification helps organizations to identify, manage, protect, and understand their data, as well as to comply with modern data privacy regulations345.
Data classification also helps to determine appropriate user access levels, which means defining who can access, modify, share, or delete data based on their roles, responsibilities, and needs345.
Determining appropriate user access levels is the most important responsibility of data owners when implementing a data classification process, as it ensures that only authorized and legitimate users can access sensitive or important data. This provides confidentiality, integrity, availability, and accountability of data345.
Reviewing emergency changes to data (option A), authorizing application code changes (option B), and implementing access rules over database tables (option D) are not the most important responsibilities of data owners when implementing a data classification process. These are more related to the operational aspects of data management, which are usually delegated to other roles, such as the DBA or the IT staff. The data owner should oversee and approve these activities, but not perform them directly1.
Data owners are the persons or entities that have the authority and responsibility for the business processes and functions that collect, use, store, and dispose of data1.
Data owners are accountable for ensuring that the data is handled in compliance with the applicable laws, regulations, policies, and standards, such as the GDPR and the PIPEDA1234.
Data owners are in the best position to determine the purpose and necessity of collecting and retaining data, as well as the risks and benefits associated with it1.
Data owners should consult with other stakeholders, such as the risk manager, the database administrator (DBA), and the privacy manager, to establish and implement appropriate data classification policies and procedures2.
Data classification is the process of organizing data in groups based on their attributes and characteristics, and then assigning class labels that describe a set of attributes that hold true for the corresponding data sets345.
Data classification helps organizations to identify, manage, protect, and understand their data, as well as to comply with modern data privacy regulations345.
Data classification also helps to determine appropriate user access levels, which means defining who can access, modify, share, or delete data based on their roles, responsibilities, and needs345.
Determining appropriate user access levels is the most important responsibility of data owners when implementing a data classification process, as it ensures that only authorized and legitimate users can access sensitive or important data. This provides confidentiality, integrity, availability, and accountability of data345.
Reviewing emergency changes to data (option A), authorizing application code changes (option B), and implementing access rules over database tables (option D) are not the most important responsibilities of data owners when implementing a data classification process. These are more related to the operational aspects of data management, which are usually delegated to other roles, such as the DBA or the IT staff. The data owner should oversee and approve these activities, but not perform them directly1.
- 다른 버전
- 2301ISACA.CISA-KR.v2026-08-27.q676
- 4339ISACA.CISA-KR.v2026-08-15.q712
- 6849ISACA.CISA-KR.v2026-05-16.q709
- 2712ISACA.CISA-KR.v2026-05-06.q261
- 4588ISACA.CISA-KR.v2026-03-16.q665
- 10988ISACA.CISA-KR.v2025-04-07.q633
- 5661ISACA.CISA-KR.v2025-04-03.q628
- 4717ISACA.CISA-KR.v2025-04-02.q544
- 5266ISACA.CISA-KR.v2025-03-31.q534
- 6643ISACA.CISA-KR.v2025-03-28.q617
- 4270ISACA.CISA-KR.v2025-03-19.q581
- 5399ISACA.CISA-KR.v2025-03-03.q807
- 5999ISACA.CISA-KR.v2024-02-07.q421
- 3604ISACA.CISA-KR.v2024-01-31.q392
- 5916ISACA.CISA-KR.v2023-10-24.q329
- 5708ISACA.CISA-KR.v2023-07-31.q266
- 3793ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 173PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 187Splunk.SPLK-1002.v2026-10-15.q187
- 134Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 140AIChE.CCPSC.v2026-10-15.q37
- 209API.API-571.v2026-10-15.q131
- 129Microsoft.AB-210.v2026-10-14.q58
- 130Huawei.H12-893_V1.0.v2026-10-14.q46
- 167UiPath.UiPath-ADPv1.v2026-10-14.q114
- 227Salesforce.MCE-Dev-201.v2026-10-14.q64
- 140PMI.PMI-RMP.v2026-10-14.q125
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-07.q651 모의시험 시험자료를 다운 받으세요.