CISA-KR 문제 641
The other options are not the first step when developing a DLP solution, but rather subsequent steps that depend on the outcome of the data inventory and classification exercise. Identifying approved data workflows across the enterprise is a step that helps to design and implement the DLP policies and controls that match the business processes and data flows. Conducting a threat analysis against sensitive data usage is a step that helps to assess and mitigate the risks associated with data leakage, theft, or misuse. Creating the DLP policies and templates is a step that helps to enforce the data protection rules and standards across the organization.
References:
* ISACA CISA Review Manual 27th Edition (2019), page 247
* Data Loss Prevention-Next Steps - ISACA1
* What is data loss prevention (DLP)? | Microsoft Security
CISA-KR 문제 642
Data classification typically involves assigning labels or tags to data assets, such as public, internal, confidential, or restricted. These labels indicate the level of protection and handling required for the data.
Based on the data classification, organizations can implement appropriate controls to safeguard the data, such as encryption, access control lists, audit logs, backup policies, etc. These controls help to prevent unauthorized access, disclosure, modification, or loss of data, and to ensure compliance with relevant laws and regulations.
If a data owner assigns an incorrect classification level to data, it can result in either underprotection or overprotection of the data. Underprotection means that the data is classified at a lower level than it should be, which exposes it to higher risks of compromise or breach. For example, if a data owner classifies personal health information (PHI) as public instead of confidential, it may allow anyone to access or share the data without proper authorization or consent. This can violate the privacy rights of the data subjects and the compliance requirements of regulations such as HIPAA (Health Insurance Portability and Accountability Act). Overprotection means that the data is classified at a higher level than it should be, which limits its availability or usability. For example, if a data owner classifies marketing materials as restricted instead of public, it may prevent potential customers or partners from accessing or viewing the data. This can reduce the business value and opportunities of the data.
Therefore, an IS auditor should be concerned about the accuracy and consistency of data classification by data owners, as it affects the security and efficiency of data management. An IS auditor should review the policies and procedures for data classification, verify that the data owners have adequate knowledge and skills to classify their data, and test that the data classification labels match with the actual sensitivity and impact of the data.
References:
* Data Classification: What It Is and How to Implement It
* What Is Data Classification? - Definition, Levels & Examples ...
* Data Classification: A Guide for Data Security Leaders
CISA-KR 문제 643
CISA-KR 문제 644
This ensures that security considerations are integrated from the beginning of the software development life cycle, leading to more secure software design and implementation.
References
* ISACA CISA Review Manual 27th Edition, Page 240-241 (SDLC Phases)
CISA-KR 문제 645
References:
1. IFRC. "Information Security: Acceptable Use Policy." 1(https://www.ifrc.org/sites/default/files/2021-11
/IFRC-Information-Security-Acceptable-Use-Policy.pdf)
2. UNSW Sydney. "Data Classification Standard." 2(https://www.unsw.edu.au/content/dam/pdfs/governance
/policy/2022-01-policies/datastandard.pdf)
3. Digital Guardian. "What is a Data Classification Policy?" 3(https://www.digitalguardian.com/blog/what- data-classification-policy)
4. Microsoft Service Trust Portal. "Data classification & sensitivity label taxonomy." 4(https://learn.microsoft.
com/en-us/compliance/assurance/assurance-data-classification-and-labels)
5. Clark University ITS Policies. "Data Classification - Data Security Policies." 5(https://www2.clarku.edu
/offices/its/policies/data_classification.cfm)
- 다른 버전
- 197ISACA.CISA-KR.v2026-08-15.q712
- 4148ISACA.CISA-KR.v2026-05-16.q709
- 1823ISACA.CISA-KR.v2026-05-06.q261
- 4554ISACA.CISA-KR.v2026-03-07.q651
- 9323ISACA.CISA-KR.v2025-04-07.q633
- 4478ISACA.CISA-KR.v2025-04-03.q628
- 3720ISACA.CISA-KR.v2025-04-02.q544
- 4251ISACA.CISA-KR.v2025-03-31.q534
- 5386ISACA.CISA-KR.v2025-03-28.q617
- 3250ISACA.CISA-KR.v2025-03-19.q581
- 4053ISACA.CISA-KR.v2025-03-03.q807
- 5218ISACA.CISA-KR.v2024-02-07.q421
- 2871ISACA.CISA-KR.v2024-01-31.q392
- 5387ISACA.CISA-KR.v2023-10-24.q329
- 5229ISACA.CISA-KR.v2023-07-31.q266
- 3228ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 197ISACA.CISA-KR.v2026-08-15.q712
- 151Microsoft.MS-700-KR.v2026-08-15.q203
- 126Microsoft.AZ-305-KR.v2026-08-14.q177
- 185Microsoft.DP-900-KR.v2026-08-13.q130
- 279Microsoft.PL-600.v2026-08-11.q206
- 217Microsoft.DP-100.v2026-08-11.q160
- 187Oracle.1Z0-1048-25.v2026-08-11.q68
- 159ISQI.CTAL-TAE.v2026-08-11.q37
- 200ServiceNow.CIS-HR.v2026-08-11.q84
- 273Salesforce.Plat-Arch-201.v2026-08-10.q101
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-16.q665 모의시험 시험자료를 다운 받으세요.