CISA-KR 문제 186
CISA-KR 문제 187
CISA-KR 문제 188
Service accountsare used by applications or systems to perform automated tasks and shouldnot be allowed for interactive login, as they present security risks if compromised.
* Service Accounts (Correct Answer - D)
* Used for running background tasks (e.g., database services, scheduled jobs).
* Should have minimal permissions and be denied interactive logins.
* Example:A compromised service account with interactive login could allow attackers to gain system access.
* Local Accounts (Incorrect - A)
* Local administrator accounts should be restricted but may still be required for some systems.
* Administrator Accounts (Incorrect - B)
* Should be restricted, but disabling them entirely could lock out system management.
* Console Accounts (Incorrect - C)
* Console access is sometimes needed for system recovery and troubleshooting.
References:
* ISACA CISA Review Manual
* NIST 800-63B (Digital Identity Guidelines)
* CIS (Center for Internet Security) Best Practices
CISA-KR 문제 189
Option B is not correct because identifying approved data workflows across the enterprise is a subsequent step after conducting data inventory and classification. Data workflows are the processes and channels through which data are created, stored, accessed, shared, or transmitted within or outside the organization4. Identifying approved data workflows helps to define the normal and legitimate use of data, as well as to detect and prevent unauthorized or anomalous data activities5. However, before identifying approved data workflows, the organization needs to know what data it has and how it should be classified.
Option C is not correct because conducting a threat analysis against sensitive data usage is another subsequent step after conducting data inventory and classification. Threat analysis is the process of identifying and assessing the potential sources, methods, and impacts of data loss or leakage incidents. Threat analysis helps to design and implement effective DLP controls and countermeasures based on the risk profile of each data category. However, before conducting threat analysis, the organization needs to know what data it has and how it should be classified.
Option D is not correct because creating the DLP policies and templates is the final step after conducting data inventory and classification, identifying approved data workflows, and conducting threat analysis. DLP policies and templates are the rules and configurations that specify how the DLP solution should monitor, detect, report, and respond to data loss or leakage events. DLP policies and templates should be aligned with the organization's business needs, regulatory obligations, and risk appetite. However, before creating the DLP policies and templates, the organization needs to know what data it has, how it should be classified, how it should be used, and what threats it faces.
References:
Data Inventory & Classification: The First Step in Data Protection1
Data Classification: What It Is And Why You Need It2
How to Prioritize Your Data Loss Prevention Strategy in 20203
What Is Data Workflow? Definition & Examples4
How to Identify Data Workflows for Your Business5
Threat Analysis: A Comprehensive Guide for Beginners
How to Conduct a Threat Assessment for Your Business
What Is Data Loss Prevention (DLP)? Definition & Examples
How to Create Effective Data Loss Prevention Policies
CISA-KR 문제 190
References
1: The Basics and Principles of Continuous Improvement4 2: ISO 9001 Auditing Practices Group Guidance on5 3: INSIGHTS TO QUALITY3 4: Continuous Auditing: Coordinating Continuous Auditing and Monitoring to Provide Continuous Assurance2
- 다른 버전
- 249ISACA.CISA-KR.v2026-08-15.q712
- 4286ISACA.CISA-KR.v2026-05-16.q709
- 1844ISACA.CISA-KR.v2026-05-06.q261
- 4712ISACA.CISA-KR.v2026-03-07.q651
- 9421ISACA.CISA-KR.v2025-04-07.q633
- 4519ISACA.CISA-KR.v2025-04-03.q628
- 3795ISACA.CISA-KR.v2025-04-02.q544
- 4300ISACA.CISA-KR.v2025-03-31.q534
- 5473ISACA.CISA-KR.v2025-03-28.q617
- 3295ISACA.CISA-KR.v2025-03-19.q581
- 4166ISACA.CISA-KR.v2025-03-03.q807
- 5235ISACA.CISA-KR.v2024-02-07.q421
- 2917ISACA.CISA-KR.v2024-01-31.q392
- 5425ISACA.CISA-KR.v2023-10-24.q329
- 5247ISACA.CISA-KR.v2023-07-31.q266
- 3245ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 249ISACA.CISA-KR.v2026-08-15.q712
- 212Microsoft.MS-700-KR.v2026-08-15.q203
- 152Microsoft.AZ-305-KR.v2026-08-14.q177
- 223Microsoft.DP-900-KR.v2026-08-13.q130
- 292Microsoft.PL-600.v2026-08-11.q206
- 233Microsoft.DP-100.v2026-08-11.q160
- 194Oracle.1Z0-1048-25.v2026-08-11.q68
- 161ISQI.CTAL-TAE.v2026-08-11.q37
- 204ServiceNow.CIS-HR.v2026-08-11.q84
- 283Salesforce.Plat-Arch-201.v2026-08-10.q101
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-16.q665 모의시험 시험자료를 다운 받으세요.