무료 온라인 액세스 ISACA.CISA-KR.v2026-03-07.q651 모의 시험 (Page 34)

CISA-KR 문제 161

다음 중 시스템 성능 제약 조건을 식별하는 데 가장 유용한 것은 무엇입니까?

A. 운영 로그

B. 디렉토리 서비스 로그

C. 프록시 로그

D. 보안로그

CISA-KR 문제 162

조직의 민감한 데이터는 클라우드 컴퓨팅 환경에 저장되고 암호화됩니다. 다음 중 IS 감사자에게 가장 큰 관심사가 되어야 하는 것은 무엇입니까?

A. 암호화 키는 이중 제어되지 않습니다.

B. 서비스 제공자가 데이터 암호화 키에 접근할 수 있습니다.

C. 암호화에는 대칭 키가 사용됩니다.

D. 클라우드 공급업체는 여러 지역에 걸쳐 존재하지 않습니다.

CISA-KR 문제 163

어떤 기업이 애플리케이션에 저장된 정보가 적절하게 보호되는지 확인하기 위해 감사를 요청했습니다. 감사 작업을 시작하기 전에 가장 중요한 조치는 무엇입니까?

A. 수정 보고서 검토

B. 통제 목표를 설정합니다.

C. 위협 환경을 평가합니다.

D. 침투 테스트를 수행합니다.

정답: B

The most important action before the audit work begins is to establish control objectives. Control objectives are the specific goals or outcomes that the audit intends to achieve or verify in relation to the information protection in the application1. Control objectives provide the basis for designing and performing the audit procedures, evaluating the audit evidence, and reporting the audit findings and recommendations2. Control objectives also help to align the audit scope and criteria with the business needs and expectations, and to ensure that the audit is relevant, reliable, and efficient3.
Some examples of control objectives for an information protection audit are:
To ensure that the information stored in the application is classified according to its sensitivity, value, and regulatory requirements To ensure that the information stored in the application is encrypted, masked, or anonymized as appropriate To ensure that the information stored in the application is accessible only by authorized users and processes To ensure that the information stored in the application is backed up, restored, and retained according to the business continuity and retention policies To ensure that the information stored in the application is monitored, logged, and audited for any unauthorized or anomalous activities Therefore, option B is the correct answer.
Option A is not correct because reviewing remediation reports is not the most important action before the audit work begins. Remediation reports are documents that describe how previous audit findings or issues have been resolved or addressed by the auditee4. While reviewing remediation reports may be useful for understanding the current state of information protection in the application, it is not a prerequisite for defining the control objectives of the audit.
Option C is not correct because assessing the threat landscape is not the most important action before the audit work begins. The threat landscape is the set of potential sources, methods, and impacts of cyberattacks or data breaches that may affect the information stored in the application5. While assessing the threat landscape may be helpful for identifying and prioritizing the risks and vulnerabilities of information protection in the application, it is not a prerequisite for defining the control objectives of the audit.
Option D is not correct because performing penetration testing is not the most important action before the audit work begins. Penetration testing is a technique that simulates real-world cyberattacks or data breaches to test the security and resilience of information systems or applications.

CISA-KR 문제 164

현재 규정은 조직이 중대한 보안 사고를 식별한 후 24시간 이내에 규제 기관에 보고하도록 요구합니다. 다음 중 IS 감사자가 규정 준수를 용이하게 하기 위해 가장 권장하는 것은 무엇입니까?

A. 보안 사고를 적시에 식별하기 위한 핵심 성과 지표(KPls)를 수립합니다.

B. 사고 처리를 위해 외부 보안 사고 대응 전문가를 고용하세요.

C. 침입 탐지 시스템(IDS)의 경고 기능을 향상시킵니다.

D. 사고 관리 대응 계획에 해당 요구 사항을 포함하세요.

정답: D

The best recommendation for the IS auditor to facilitate compliance with the new regulation is to include the requirement in the incident management response plan. An incident management response plan is a document that defines the roles, responsibilities, processes, and procedures for responding to security incidents. By including the new regulation in the plan, the IS auditor can ensure that the organization is aware of the reporting obligation, has a clear workflow for notifying the regulator within 24 hours, and has the necessary documentation and evidence to support the report.
The other options are not as effective as including the requirement in the incident management response plan:
* Establishing key performance indicators (KPIs) for timely identification of security incidents is a good practice, but it does not guarantee compliance with the regulation. KPIs are metrics that measure the performance of a process or activity, but they do not specify how to perform it. The IS auditor should also provide guidance on how to identify and report security incidents within 24 hours.
* Engaging an external security incident response expert for incident handling is a possible option, but it may not be feasible or cost-effective. The organization may not have the budget or time to hire an external expert, or may prefer to handle the incidents internally. The IS auditor should also evaluate the qualifications and trustworthiness of the external expert, and ensure that they comply with the regulation and other contractual or legal obligations.
* Enhancing the alert functionality of the intrusion detection system (IDS) is a useful measure, but it is not sufficient to comply with the regulation. An IDS is a tool that monitors network traffic for malicious activity and alerts the network administrator or takes preventive action. However, an IDS may not detect all types of security incidents, or may generate false positives or negatives. The IS auditor should also consider other sources of incident detection, such as logs, reports, audits, or user feedback.

CISA-KR 문제 165

IS 감사 학습은 IT 및 비즈니스 관리에서 수행한 가장 최근의 애플리케이션 사용자 액세스 검토와 관련된 문서를 평가하는 것입니다. 사용자 목록이 시스템에서 생성되지 않은 것으로 확인되었습니다. 다음 중 가장 큰 우려 사항은 무엇입니까?

A. 사용자 목록의 기밀성 검토

B. 검토된 사용자 목록의 완전성

C. 검토된 사용자 목록의 소스

D. 사용자 목록의 가용성을 검토했습니다.

프리미엄 번들

DumpTop 에서 공유하는 최신 CISA-KR 시험 덤프는 CISA-KR 시험패스를 도와드릴수 있습니다! DumpTop 은 최근 업데이트된 CISA-KR 시험자료를 제공해드립니다. DumpTop CISA-KR 덤프도 시험문제 변경에 따라 업데이트되었으며 오답도 수정되었습니다. DumpTop CISA-KR 덤프 최신버전을 공유받아보세요.

CISA-KR 덤프 프리미엄 버전 액세스

(1562 Q&As 덤프, 30%OFF할인코드: KrDump)

다른 버전: 223ISACA.CISA-KR.v2026-08-15.q712; 4200ISACA.CISA-KR.v2026-05-16.q709; 1824ISACA.CISA-KR.v2026-05-06.q261; 3190ISACA.CISA-KR.v2026-03-16.q665; 9339ISACA.CISA-KR.v2025-04-07.q633; 4491ISACA.CISA-KR.v2025-04-03.q628; 3732ISACA.CISA-KR.v2025-04-02.q544; 4274ISACA.CISA-KR.v2025-03-31.q534; 5421ISACA.CISA-KR.v2025-03-28.q617; 3253ISACA.CISA-KR.v2025-03-19.q581; 4058ISACA.CISA-KR.v2025-03-03.q807; 5218ISACA.CISA-KR.v2024-02-07.q421; 2871ISACA.CISA-KR.v2024-01-31.q392; 5389ISACA.CISA-KR.v2023-10-24.q329; 5230ISACA.CISA-KR.v2023-07-31.q266; 3229ISACA.CISA-KR.v2023-06-23.q324

최근 업로드: 223ISACA.CISA-KR.v2026-08-15.q712; 165Microsoft.MS-700-KR.v2026-08-15.q203; 130Microsoft.AZ-305-KR.v2026-08-14.q177; 190Microsoft.DP-900-KR.v2026-08-13.q130; 288Microsoft.PL-600.v2026-08-11.q206; 218Microsoft.DP-100.v2026-08-11.q160; 187Oracle.1Z0-1048-25.v2026-08-11.q68; 159ISQI.CTAL-TAE.v2026-08-11.q37; 200ServiceNow.CIS-HR.v2026-08-11.q84; 281Salesforce.Plat-Arch-201.v2026-08-10.q101