CISA-KR 문제 501
시스템에서 RFID를 사용할 때 IS 감사자가 가장 우려해야 할 점은 무엇입니까?
정답: A
RFID stands for Radio Frequency Identification, and it is a technology that uses radio waves to identify or track objects that have a small chip (RFID tag) attached to them. RFID tags can store various types of information, such as serial numbers, product codes, or personal data. RFID readers can scan the tags from a distance and access the information without physical contact1.
RFID has many benefits for different applications, such as inventory management, supply chain optimization, asset tracking, and access control. However, RFID also poses some challenges and risks for information security and privacy. Some of these risks are:
Privacy: RFID tags can be read by unauthorized or malicious parties, who can collect personal or sensitive data without the knowledge or consent of the tag owners. This can lead to identity theft, profiling, tracking, or surveillance2. For example, a hacker could scan an RFID-tagged passport or credit card and steal the personal information or financial details of the owner3.
Communication attacks: RFID systems are vulnerable to various types of attacks that target the wireless communication between the tags and the readers. These include eavesdropping, jamming, spoofing, replaying, cloning, or modifying the data transmitted by the tags or the readers4. For example, an attacker could intercept the data from an RFID tag and alter it before sending it to the reader, causing false or misleading information to be recorded.
Mafia fraud: This is a type of attack where an adversary acts as a man-in-the-middle and relays the information between two legitimate parties. This can allow the adversary to bypass authentication or authorization mechanisms and gain access to restricted areas or resources. For example, an attacker could use a device to relay the signal from an RFID-tagged car key to the car's ignition system and start the car without having the physical key.
RFID has many benefits for different applications, such as inventory management, supply chain optimization, asset tracking, and access control. However, RFID also poses some challenges and risks for information security and privacy. Some of these risks are:
Privacy: RFID tags can be read by unauthorized or malicious parties, who can collect personal or sensitive data without the knowledge or consent of the tag owners. This can lead to identity theft, profiling, tracking, or surveillance2. For example, a hacker could scan an RFID-tagged passport or credit card and steal the personal information or financial details of the owner3.
Communication attacks: RFID systems are vulnerable to various types of attacks that target the wireless communication between the tags and the readers. These include eavesdropping, jamming, spoofing, replaying, cloning, or modifying the data transmitted by the tags or the readers4. For example, an attacker could intercept the data from an RFID tag and alter it before sending it to the reader, causing false or misleading information to be recorded.
Mafia fraud: This is a type of attack where an adversary acts as a man-in-the-middle and relays the information between two legitimate parties. This can allow the adversary to bypass authentication or authorization mechanisms and gain access to restricted areas or resources. For example, an attacker could use a device to relay the signal from an RFID-tagged car key to the car's ignition system and start the car without having the physical key.
CISA-KR 문제 502
시스템 개발 프로젝트의 타당성 연구를 감사할 때 IS 감사자는 다음을 수행해야 합니다.
정답: C
A feasibility study is an assessment that determines the likelihood of a proposed project being successful, such as a new system development1. A feasibility study typically covers various aspects of the project, such as technical, economic, operational and legal feasibility2. The IS auditor's role is to audit the feasibility study and ensure that it is objective, realistic and reliable3.
One of the most important aspects of a feasibility study is the economic feasibility, which analyzes the costs and benefits of the proposed system and compares them with alternative solutions2. Theeconomic feasibility study should include a detailed breakdown of the development, implementation and operational costs, as well as the expected revenues, savings and intangible benefits of the system3. The IS auditor should review the cost-benefit documentation for reasonableness and accuracy, and verify that the assumptions and calculations are valid and supported by evidence3.
The other options are not directly related to auditing the feasibility study of a system development project.
Reviewing qualifications of key members of the project team (option A) is more relevant to auditing the project management and human resources aspects of the project. Reviewing the request for proposal (RFP) to ensure that it covers the scope of work (option B) is more relevant to auditing the procurement and vendor selection process of the project. Ensuring that vendor contracts are reviewed by legal counsel (option D) is more relevant to auditing the legal and contractual aspects of the project.
References: 3: Types of Feasibility Study in Software Project Development 2: Feasibility Analysis in System Development Process 1: What Is a Feasibility Study? Definition, Benefits and Types
One of the most important aspects of a feasibility study is the economic feasibility, which analyzes the costs and benefits of the proposed system and compares them with alternative solutions2. Theeconomic feasibility study should include a detailed breakdown of the development, implementation and operational costs, as well as the expected revenues, savings and intangible benefits of the system3. The IS auditor should review the cost-benefit documentation for reasonableness and accuracy, and verify that the assumptions and calculations are valid and supported by evidence3.
The other options are not directly related to auditing the feasibility study of a system development project.
Reviewing qualifications of key members of the project team (option A) is more relevant to auditing the project management and human resources aspects of the project. Reviewing the request for proposal (RFP) to ensure that it covers the scope of work (option B) is more relevant to auditing the procurement and vendor selection process of the project. Ensuring that vendor contracts are reviewed by legal counsel (option D) is more relevant to auditing the legal and contractual aspects of the project.
References: 3: Types of Feasibility Study in Software Project Development 2: Feasibility Analysis in System Development Process 1: What Is a Feasibility Study? Definition, Benefits and Types
CISA-KR 문제 503
다음 결과는 IS 감사자가 새로 구현한 시스템에 대한 구현 후 검토를 실시한 결과입니다. 다음 중 가장 중요한 결과는 무엇입니까?
정답: D
Comprehensive and Detailed Step-by-Step Explanation:
Ifmeasurable benefitswerenot defined, the organizationcannot assess whether the system achieved its intended goals, making it the mostcriticalissue.
* Measurable Benefits Not Defined (Correct Answer - D)
* No clear KPIs or success metricsmeans no way toevaluate ROI.
* Example:A company implementsan ERP systembut has no performance indicators to measure success.
* No Lessons Learned (Incorrect - A)
* Important but doesnot impact system effectiveness.
* Missing Dashboard Deliverables (Incorrect - B)
* A reporting issue,not a strategic failure.
* Budget Overrun (Incorrect - C)
* A financial concern butnot as critical as system success measurement.
References:
* ISACA CISA Review Manual
* COBIT 2019 (Project Governance)
Ifmeasurable benefitswerenot defined, the organizationcannot assess whether the system achieved its intended goals, making it the mostcriticalissue.
* Measurable Benefits Not Defined (Correct Answer - D)
* No clear KPIs or success metricsmeans no way toevaluate ROI.
* Example:A company implementsan ERP systembut has no performance indicators to measure success.
* No Lessons Learned (Incorrect - A)
* Important but doesnot impact system effectiveness.
* Missing Dashboard Deliverables (Incorrect - B)
* A reporting issue,not a strategic failure.
* Budget Overrun (Incorrect - C)
* A financial concern butnot as critical as system success measurement.
References:
* ISACA CISA Review Manual
* COBIT 2019 (Project Governance)
CISA-KR 문제 504
클라우드 기반 시스템의 애플리케이션 통제를 평가하기 위한 감사를 계획할 때 IS 감사자가 가장 중요하게 생각하는 것은 다음과 같습니다.
정답: B
The business process supported by the system is the most important factor for an IS auditor to understand when planning an audit to assess application controls of a cloud-based system. An IS auditor should have a clear understanding of the business objectives, requirements, and risks of the process, as well as the expected outputs and outcomes of the system. This will help the IS auditor to determine the scope, objectives, and criteria of the audit, as well as to identify and evaluate the key application controls that ensure the effectiveness, efficiency, and reliability of the process. The other options are less important factors that may provide additional information or context for the audit, but not its primary focus. References:
* CISA Review Manual (Digital Version), Chapter 5, Section 5.31
* CISA Review Questions, Answers & Explanations Database, Question ID 212
* CISA Review Manual (Digital Version), Chapter 5, Section 5.31
* CISA Review Questions, Answers & Explanations Database, Question ID 212
CISA-KR 문제 505
데이터 분류 프로그램을 구현할 때 다음 중 가장 중요한 것은 무엇입니까?
정답: B
Data classification is the process of organizing data into categories based on its sensitivity, value, and risk to the organization. Data classification helps to ensure that data is protected according to its importance and regulatory requirements. Data classification also enables data owners to make informed decisions about data access, retention, and disposal.
To implement a data classification program, it is most important to formalize data ownership. Data owners are the individuals or business units that have the authority and responsibility for the data they create or use. Data owners should be involved in defining the data classification levels, assigning the appropriate classification to their data, and ensuring that the data is handled according to the established policies and procedures. Data owners should also review and update the data classification periodically or when there are changes in the data or its usage.
The other options are not as important as formalizing data ownership when implementing a data classification program. Understanding the data classification levels is necessary, but it is not sufficient without identifying the data owners who will apply them. Developing a privacy policy is a good practice, but it is not specific to data classification. Planning for secure storage capacity is a technical consideration, but it does not address the business and legal aspects of data classification.
References:
* ISACA, CISA Review Manual, 27th Edition, 2020, page 247
* Data Classification: What It Is and Howto Implement It
To implement a data classification program, it is most important to formalize data ownership. Data owners are the individuals or business units that have the authority and responsibility for the data they create or use. Data owners should be involved in defining the data classification levels, assigning the appropriate classification to their data, and ensuring that the data is handled according to the established policies and procedures. Data owners should also review and update the data classification periodically or when there are changes in the data or its usage.
The other options are not as important as formalizing data ownership when implementing a data classification program. Understanding the data classification levels is necessary, but it is not sufficient without identifying the data owners who will apply them. Developing a privacy policy is a good practice, but it is not specific to data classification. Planning for secure storage capacity is a technical consideration, but it does not address the business and legal aspects of data classification.
References:
* ISACA, CISA Review Manual, 27th Edition, 2020, page 247
* Data Classification: What It Is and Howto Implement It
- 다른 버전
- 250ISACA.CISA-KR.v2026-08-15.q712
- 4288ISACA.CISA-KR.v2026-05-16.q709
- 1844ISACA.CISA-KR.v2026-05-06.q261
- 4712ISACA.CISA-KR.v2026-03-07.q651
- 9421ISACA.CISA-KR.v2025-04-07.q633
- 4525ISACA.CISA-KR.v2025-04-03.q628
- 3795ISACA.CISA-KR.v2025-04-02.q544
- 4300ISACA.CISA-KR.v2025-03-31.q534
- 5486ISACA.CISA-KR.v2025-03-28.q617
- 3295ISACA.CISA-KR.v2025-03-19.q581
- 4173ISACA.CISA-KR.v2025-03-03.q807
- 5235ISACA.CISA-KR.v2024-02-07.q421
- 2917ISACA.CISA-KR.v2024-01-31.q392
- 5425ISACA.CISA-KR.v2023-10-24.q329
- 5247ISACA.CISA-KR.v2023-07-31.q266
- 3246ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 250ISACA.CISA-KR.v2026-08-15.q712
- 214Microsoft.MS-700-KR.v2026-08-15.q203
- 153Microsoft.AZ-305-KR.v2026-08-14.q177
- 225Microsoft.DP-900-KR.v2026-08-13.q130
- 293Microsoft.PL-600.v2026-08-11.q206
- 233Microsoft.DP-100.v2026-08-11.q160
- 196Oracle.1Z0-1048-25.v2026-08-11.q68
- 162ISQI.CTAL-TAE.v2026-08-11.q37
- 204ServiceNow.CIS-HR.v2026-08-11.q84
- 283Salesforce.Plat-Arch-201.v2026-08-10.q101
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-16.q665 모의시험 시험자료를 다운 받으세요.