CISA-KR 문제 196
재무 애플리케이션 감사 중에 많은 해지된 사용자의 계정이 비활성화되지 않은 것으로 확인되었습니다. 다음 중 IS 감사원의 다음 단계는 무엇이어야 합니까?
정답: B
The IS auditor's next step after determining that many terminated users' accounts were not disabled is to perform a review of terminated users' account activity. This means that the IS auditor should check whether any of the terminated users' accounts were accessed or used after their termination date, which could indicate unauthorized or fraudulent activity. The IS auditor should also assess the impact and risk of such activity on the confidentiality, integrity, and availability of IT resources and data. The other options are not as appropriate as performing a review of terminated users' account activity, as they do not provide sufficient evidence or assurance of the extent and effect of the problem. References: CISA Review Manual, 27th Edition, page 240
CISA-KR 문제 197
다음 중 시스템에서 허가받은 소프트웨어의 무단 복사본을 감지하는 가장 좋은 방법은 무엇입니까?
정답: B
The best way to detect unauthorized copies of licensed software on systems is to conduct periodic software scanning. Software scanning is a process of using specialized tools or programs to scan the systems and identify the software installed, the license status, the usage, and the compliance with the software policies and agreements. Software scanning can help to detect any unauthorized, unlicensed, or illegal copies of software on the systems, as well as any discrepancies or violations of the software licenses. Software scanning can also help to optimize the software inventory, reduce the software costs, and improve the security and performance of the systems12.
Some examples of software scanning tools are:
* Microsoft Software Inventory Analyzer (MSIA): A free tool that scans Windows-based computers and servers and generates reports on the Microsoft products installed, such as operating systems, applications, and updates3.
* Belarc Advisor: A free tool that scans Windows-based computers and generates reports onthe hardware and software installed, including license keys, versions, usage, and security status4.
* Lansweeper: A paid tool that scans Windows, Linux, Mac, and other network devices and generates reports on the hardware and software inventory, license compliance, configuration, and vulnerabilities5.
To conduct periodic software scanning, you need to:
* Choose a suitable software scanning tool that meets your needs and budget.
* Define the scope and frequency of the software scanning, such as which systems to scan, how often to scan, and what information to collect.
* Configure and run the software scanning tool according to the instructions and settings.
* Review and analyze the software scanning reports and identify any unauthorized copies of licensed software on the systems.
* Take appropriate actions to remove or regularize the unauthorized copies of licensed software on the systems.
* Document and report the results and findings of the software scanning.
Some examples of software scanning tools are:
* Microsoft Software Inventory Analyzer (MSIA): A free tool that scans Windows-based computers and servers and generates reports on the Microsoft products installed, such as operating systems, applications, and updates3.
* Belarc Advisor: A free tool that scans Windows-based computers and generates reports onthe hardware and software installed, including license keys, versions, usage, and security status4.
* Lansweeper: A paid tool that scans Windows, Linux, Mac, and other network devices and generates reports on the hardware and software inventory, license compliance, configuration, and vulnerabilities5.
To conduct periodic software scanning, you need to:
* Choose a suitable software scanning tool that meets your needs and budget.
* Define the scope and frequency of the software scanning, such as which systems to scan, how often to scan, and what information to collect.
* Configure and run the software scanning tool according to the instructions and settings.
* Review and analyze the software scanning reports and identify any unauthorized copies of licensed software on the systems.
* Take appropriate actions to remove or regularize the unauthorized copies of licensed software on the systems.
* Document and report the results and findings of the software scanning.
CISA-KR 문제 198
다음 중 사이버 회복력의 주요 목표는 무엇입니까?
정답: B
CISA-KR 문제 199
조직은 클라우드 기반 SaaS(Software as a Service) 모델을 사용하여 데이터를 백업하는 외부 공급업체에 의존합니다. 다음 중 데이터 백업 및 검색과 관련하여 조직에 가장 큰 위험은 무엇입니까?
정답: B
An organization relies on an external vendor that uses a cloud-based Software as a Service (SaaS) model to back up its data. SaaS is a model in which the software is centrally hosted and accessed by the user via a web browser using the internet1. The vendor owns and maintains the software and the data, and the organization pays for the use of the service on a subscription or usage basis1. The greatest risk to the organization related to data backup and retrieval is that the vendor may be unable to restore critical data.
Data backup and retrieval are essential processes for ensuring the availability, integrity, and security of data in case of loss, corruption, or damage2. Data backup is the process of creating and storing copies of data in a separate location from the original data2. Data retrieval is the process of accessing and restoring the backed- up data when needed2. Critical data are data that are vital for the operation, continuity, and recovery of the organization3.
If the vendor is unable to restore critical data, the organization may face severe consequences, such as:
Business disruption: The organization may not be able to perform its core functions, deliver its products or services, or meet its customer or stakeholder expectations3.
Revenue loss: The organization may lose income, market share, or competitive advantage due to reduced sales, customer dissatisfaction, or reputation damage3.
Legal liability: The organization may face lawsuits, fines, or penalties for breaching contractual, regulatory, or statutory obligations related to data protection, privacy, or security3.
Recovery cost: The organization may incur additional expenses for repairing or replacing the lost or corrupted data, restoring the system functionality, or compensating the affected parties3.
The other options are not as great as the vendor's inability to restore critical data. The organization may be locked into an unfavorable contract with the vendor, which may limit its flexibility, control, or choice over the service quality, cost, or duration4. However, this risk can be mitigated by negotiating better terms and conditions, reviewing the contract periodically, or switching to another vendor if possible4. The vendor may be unable to restore data by recovery time objective (RTO) requirements, which are the maximum acceptable time frames for restoring data after a disruption5. However, this risk can be reduced by setting realistic and achievable RTOs, monitoring the vendor's performance, or implementing alternative recovery strategies if needed5. The organization may not be allowed to inspect the vendor's data center, which may limit its visibility, transparency, or assurance over the service provider's infrastructure, security, or compliance.
However, this risk can be overcome by requesting third-party audits, certifications, or reports from the vendor that demonstrate their adherence to industry standards and best practices. Therefore, option B is the correct answer.
References:
What is SaaS? Software as a Service | Microsoft Azure
What is Data Backup? - Definition from Techopedia
Critical Data Definition
The Risks of Cloud Computing | Cloud Academy
Recovery Time Objective (RTO) Definition
[Cloud Computing Security Risks: What You Need To Know | CloudHealth by VMware]
Data backup and retrieval are essential processes for ensuring the availability, integrity, and security of data in case of loss, corruption, or damage2. Data backup is the process of creating and storing copies of data in a separate location from the original data2. Data retrieval is the process of accessing and restoring the backed- up data when needed2. Critical data are data that are vital for the operation, continuity, and recovery of the organization3.
If the vendor is unable to restore critical data, the organization may face severe consequences, such as:
Business disruption: The organization may not be able to perform its core functions, deliver its products or services, or meet its customer or stakeholder expectations3.
Revenue loss: The organization may lose income, market share, or competitive advantage due to reduced sales, customer dissatisfaction, or reputation damage3.
Legal liability: The organization may face lawsuits, fines, or penalties for breaching contractual, regulatory, or statutory obligations related to data protection, privacy, or security3.
Recovery cost: The organization may incur additional expenses for repairing or replacing the lost or corrupted data, restoring the system functionality, or compensating the affected parties3.
The other options are not as great as the vendor's inability to restore critical data. The organization may be locked into an unfavorable contract with the vendor, which may limit its flexibility, control, or choice over the service quality, cost, or duration4. However, this risk can be mitigated by negotiating better terms and conditions, reviewing the contract periodically, or switching to another vendor if possible4. The vendor may be unable to restore data by recovery time objective (RTO) requirements, which are the maximum acceptable time frames for restoring data after a disruption5. However, this risk can be reduced by setting realistic and achievable RTOs, monitoring the vendor's performance, or implementing alternative recovery strategies if needed5. The organization may not be allowed to inspect the vendor's data center, which may limit its visibility, transparency, or assurance over the service provider's infrastructure, security, or compliance.
However, this risk can be overcome by requesting third-party audits, certifications, or reports from the vendor that demonstrate their adherence to industry standards and best practices. Therefore, option B is the correct answer.
References:
What is SaaS? Software as a Service | Microsoft Azure
What is Data Backup? - Definition from Techopedia
Critical Data Definition
The Risks of Cloud Computing | Cloud Academy
Recovery Time Objective (RTO) Definition
[Cloud Computing Security Risks: What You Need To Know | CloudHealth by VMware]
CISA-KR 문제 200
양자 컴퓨팅의 등장은 기존 데이터 암호화 방식에 어떤 영향을 미칠까요?
정답: A
Quantum algorithms, such as Shor's algorithm, can factor large prime numbers exponentially faster than classical computers, threatening the security of RSA and elliptic-curve cryptography. Similarly, Grover's algorithm reduces the effective strength of symmetric key algorithms by half, requiring larger key sizes.
While post-quantum cryptography is being developed, current algorithms may become obsolete once practical quantum computers exist. Options B, C, and D are incorrect because quantum does not inherently improve encryption, nor is training the key issue-it is the fundamental breakage of cryptographic assumptions.
References (ISACA): ISACA Journal - Cryptographic Risks and Quantum Computing; CISA Review Manual, Cryptography.
While post-quantum cryptography is being developed, current algorithms may become obsolete once practical quantum computers exist. Options B, C, and D are incorrect because quantum does not inherently improve encryption, nor is training the key issue-it is the fundamental breakage of cryptographic assumptions.
References (ISACA): ISACA Journal - Cryptographic Risks and Quantum Computing; CISA Review Manual, Cryptography.
- 다른 버전
- 249ISACA.CISA-KR.v2026-08-15.q712
- 4273ISACA.CISA-KR.v2026-05-16.q709
- 1842ISACA.CISA-KR.v2026-05-06.q261
- 3228ISACA.CISA-KR.v2026-03-16.q665
- 9420ISACA.CISA-KR.v2025-04-07.q633
- 4511ISACA.CISA-KR.v2025-04-03.q628
- 3795ISACA.CISA-KR.v2025-04-02.q544
- 4297ISACA.CISA-KR.v2025-03-31.q534
- 5455ISACA.CISA-KR.v2025-03-28.q617
- 3295ISACA.CISA-KR.v2025-03-19.q581
- 4157ISACA.CISA-KR.v2025-03-03.q807
- 5235ISACA.CISA-KR.v2024-02-07.q421
- 2904ISACA.CISA-KR.v2024-01-31.q392
- 5412ISACA.CISA-KR.v2023-10-24.q329
- 5247ISACA.CISA-KR.v2023-07-31.q266
- 3245ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 249ISACA.CISA-KR.v2026-08-15.q712
- 212Microsoft.MS-700-KR.v2026-08-15.q203
- 148Microsoft.AZ-305-KR.v2026-08-14.q177
- 219Microsoft.DP-900-KR.v2026-08-13.q130
- 291Microsoft.PL-600.v2026-08-11.q206
- 232Microsoft.DP-100.v2026-08-11.q160
- 194Oracle.1Z0-1048-25.v2026-08-11.q68
- 161ISQI.CTAL-TAE.v2026-08-11.q37
- 204ServiceNow.CIS-HR.v2026-08-11.q84
- 283Salesforce.Plat-Arch-201.v2026-08-10.q101
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-07.q651 모의시험 시험자료를 다운 받으세요.