CISA-KR 문제 231
다음 중 장치 간 데이터 전송의 최대 범위가 가장 작은 기술은 무엇입니까?
정답: D
The technology that has the smallest maximum range for data transmission between devices is near-field communication (NFC). NFC is a short-range wireless technology that enables two devices to communicate when they are in close proximity, usually within a few centimeters. NFC is commonly used for contactless payments, smart cards, and device pairing. According to the Bluetooth Technology Website1, the effective range of NFC is less than a meter, while the other technologies have much longer ranges. Wi-Fi can reach up to 100 meters indoors and 300 meters outdoors2. Bluetooth can reach up to 800 feet with Bluetooth 5.0 specification3. Long-term evolution (LTE) can reach up to several kilometers depending on the cell tower and the device4.
References:
* 5: What is Wi-Fi? - Definition from WhatIs.com
* 6: Understanding Bluetooth Range | Bluetooth Technology Website
* 7: What is Bluetooth Range? What You Need to Know
* 8: How far can LTE signals travel? - Quora
References:
* 5: What is Wi-Fi? - Definition from WhatIs.com
* 6: Understanding Bluetooth Range | Bluetooth Technology Website
* 7: What is Bluetooth Range? What You Need to Know
* 8: How far can LTE signals travel? - Quora
CISA-KR 문제 232
다음 중 IS 감사자가 IT 감사 계획에 포함할 프로젝트를 선택할 때 가장 유용한 정보를 제공하는 것은 무엇입니까?
정답: D
A project business case is a document that describes the rationale and justification for initiating a project, based on its expected costs, benefits, risks, and feasibility. A project business case provides the most useful information to an IS auditor when selecting projects for inclusion in an IT audit plan, because it helps the IS auditor to:
* Understand the purpose, scope, objectives, and deliverables of the project
* Assess the alignment of the project with the organization's strategy, vision, and goals
* Evaluate the value proposition and return on investment of the project
* Identify the key stakeholders, sponsors, and owners of the project
* Analyze the potential risks and issues associated with the project
* Compare and prioritize the project with other competing projects
The other possible options are:
* A. Project charter: A project charter is a document that formally authorizes and defines the high-level scope, roles, responsibilities, and authority of a project. A project charter provides some useful information to an IS auditor when selecting projects for inclusion in an IT audit plan, but it is not the most useful information. A project charter does not provide enough details about the costs, benefits, risks, and feasibility of the project, which are essential for evaluating its suitability for an IT audit plan.
* B. Project plan: A project plan is a document that outlines the detailed scope, schedule, budget, resources, quality, and communication plans of a project. A project plan provides some useful information to an IS auditor when selecting projects for inclusion in an IT audit plan, but it is not the most useful information. A project plan does not provide enough information about the rationale, justification, value proposition, and alignment of the project with the organization's strategy and goals, which are important for assessing its relevance for an IT audit plan.
* C. Project issue log: A project issue log is a document that records and tracks the issues that arise during a project's execution and how they are resolved. A project issue log provides some useful information to an IS auditor when selecting projects for inclusion in an IT audit plan, but it is not the most useful information. A project issue log does not provide enough information about the purpose, objectives, benefits, and feasibility of the project, which are critical for determining its priority for an IT audit plan.
* Understand the purpose, scope, objectives, and deliverables of the project
* Assess the alignment of the project with the organization's strategy, vision, and goals
* Evaluate the value proposition and return on investment of the project
* Identify the key stakeholders, sponsors, and owners of the project
* Analyze the potential risks and issues associated with the project
* Compare and prioritize the project with other competing projects
The other possible options are:
* A. Project charter: A project charter is a document that formally authorizes and defines the high-level scope, roles, responsibilities, and authority of a project. A project charter provides some useful information to an IS auditor when selecting projects for inclusion in an IT audit plan, but it is not the most useful information. A project charter does not provide enough details about the costs, benefits, risks, and feasibility of the project, which are essential for evaluating its suitability for an IT audit plan.
* B. Project plan: A project plan is a document that outlines the detailed scope, schedule, budget, resources, quality, and communication plans of a project. A project plan provides some useful information to an IS auditor when selecting projects for inclusion in an IT audit plan, but it is not the most useful information. A project plan does not provide enough information about the rationale, justification, value proposition, and alignment of the project with the organization's strategy and goals, which are important for assessing its relevance for an IT audit plan.
* C. Project issue log: A project issue log is a document that records and tracks the issues that arise during a project's execution and how they are resolved. A project issue log provides some useful information to an IS auditor when selecting projects for inclusion in an IT audit plan, but it is not the most useful information. A project issue log does not provide enough information about the purpose, objectives, benefits, and feasibility of the project, which are critical for determining its priority for an IT audit plan.
CISA-KR 문제 233
감사 중에 IS 감사원은 많은 경우 시스템에서 과도한 권한이 제거되지 않았다는 것을 발견했습니다.
다음 중 감사인의 가장 좋은 권고사항은 무엇인가?
다음 중 감사인의 가장 좋은 권고사항은 무엇인가?
정답: D
The best recommendation for the auditor to make is D. Line management should regularly review and request modification of access rights. Access rights are the permissions and privileges granted to users to access, view, modify, or delete data or resources on a system or network1. Excessive rights are access rights that are not necessary or appropriate for a user's role or function, and may pose a risk of unauthorized or inappropriate use of data or resources2. Therefore, it is important to ensure that access rights are aligned with the principle of least privilege, which means that users should only have the minimum level of access required to perform their duties2.
Line management is responsible for overseeing and supervising the activities and performance of their staff, and ensuring that they comply with the organization's policies and standards3. Therefore, line management should regularly review and request modification of access rights for their staff, as they are in the best position to:
Understand the roles and functions of their staff, and determine the appropriate level of access rights needed for them to perform their duties effectively and efficiently.
Monitor and evaluate the usage and behavior of their staff, and identify any changes or anomalies that may indicate excessive or inappropriate access rights.
Communicate and collaborate with IT security or system administrators, who are responsible for granting, revoking, or modifying access rights, and request any necessary adjustments or corrections.
Line management is responsible for overseeing and supervising the activities and performance of their staff, and ensuring that they comply with the organization's policies and standards3. Therefore, line management should regularly review and request modification of access rights for their staff, as they are in the best position to:
Understand the roles and functions of their staff, and determine the appropriate level of access rights needed for them to perform their duties effectively and efficiently.
Monitor and evaluate the usage and behavior of their staff, and identify any changes or anomalies that may indicate excessive or inappropriate access rights.
Communicate and collaborate with IT security or system administrators, who are responsible for granting, revoking, or modifying access rights, and request any necessary adjustments or corrections.
CISA-KR 문제 234
IS 감사원은 제대로 체크아웃되지 않은 서버에 대한 관리자 계정을 결정하고 각 사용 후 다시 로그인합니다. 다음 중 문제의 범위를 결정하는 데 가장 적합한 샘플링 기술은 무엇입니까?
정답: B
CISA-KR 문제 235
데이터 손실 방지(DLP) 감사의 계획 단계에서 경영진은 모바일 컴퓨팅에 대한 우려를 표명합니다. IS 감사자는 다음 중 어떤 것을 관련 위험으로 식별해야 합니까?
정답: C
The associated risk of mobile computing that an IS auditor should identify during the planning phase of a data loss prevention (DLP) audit is increased vulnerability due to anytime, anywhere accessibility. Mobile computing refers to the use of portable devices, such as laptops, tablets, smartphones, or wearable devices, that can access data and applications over wireless networks from any location6. Mobile computing enables greater flexibility, productivity, and convenience for users, but also poses significant security challenges for organizations. One of these challenges is increased vulnerability due to anytime, anywhere accessibility. This means that mobile devices are exposed to a higher risk of loss, theft, damage, or unauthorized access than stationary devices7. If mobile devices contain or access sensitive data without proper protection, such as encryption or authentication, they could result in data leakage or breach in case of compromise8. Therefore, an IS auditor should identify this risk as part of a DLP audit. The other options are less relevant or incorrect because:
* A. The use of cloud negatively impacting IT availability is not an associated risk of mobile computing that an IS auditor should identify during the planning phase of a DLP audit, as it is more related to cloud computing than mobile computing. Cloud computing refers to the delivery of computing services, such as data storage or processing, over the Internet from remote servers. Cloud computing may enable or support mobile computing by providing access to data and applications from any device or location, but it does not necessarily imply mobile computing. The use of cloud may negatively impact IT availability if there are disruptions or outages in the cloud service provider's network or infrastructure, but this is not a direct consequence of mobile computing.
* B. Increased need for user awareness training is not an associated risk of mobile computing that an IS auditor should identify during the planning phase of a DLP audit, as it is more of a control or mitigation measure than a risk. User awareness training refers to educating users about security policies, procedures, and best practices for using mobile devices and protecting data. User awareness training may help to reduce the risk of data loss or breach due to mobile computing by increasing user knowledge and responsibility, but it does not eliminate or prevent the risk.
* D. Lack of governance and oversight for IT infrastructure and applications is not an associated risk of mobile computing that an IS auditor should identify during the planning phase of a DLP audit, as it is more of a general or organizational risk than a specific or technical risk. Governance and oversight refer to the establishment and implementation of policies, standards, and procedures for managing IT resources and aligning them with business objectives. Lack of governance and oversight for IT infrastructure and applications may affect the security and performance of mobile devices and data, but it is not a direct or inherent result of mobile computing. References: Mobile Computing - ISACA, Mobile Computing Device Threats, Vulnerabilities and Risk Factors Are Ubiquitous - ISACA, Data Loss Prevention-Next Steps - ISACA, [Cloud Computing - ISACA], [Cloud Computing Risk Assessment - ISACA], [User Awareness Training - ISACA], [Governance and Oversight - ISACA]
* A. The use of cloud negatively impacting IT availability is not an associated risk of mobile computing that an IS auditor should identify during the planning phase of a DLP audit, as it is more related to cloud computing than mobile computing. Cloud computing refers to the delivery of computing services, such as data storage or processing, over the Internet from remote servers. Cloud computing may enable or support mobile computing by providing access to data and applications from any device or location, but it does not necessarily imply mobile computing. The use of cloud may negatively impact IT availability if there are disruptions or outages in the cloud service provider's network or infrastructure, but this is not a direct consequence of mobile computing.
* B. Increased need for user awareness training is not an associated risk of mobile computing that an IS auditor should identify during the planning phase of a DLP audit, as it is more of a control or mitigation measure than a risk. User awareness training refers to educating users about security policies, procedures, and best practices for using mobile devices and protecting data. User awareness training may help to reduce the risk of data loss or breach due to mobile computing by increasing user knowledge and responsibility, but it does not eliminate or prevent the risk.
* D. Lack of governance and oversight for IT infrastructure and applications is not an associated risk of mobile computing that an IS auditor should identify during the planning phase of a DLP audit, as it is more of a general or organizational risk than a specific or technical risk. Governance and oversight refer to the establishment and implementation of policies, standards, and procedures for managing IT resources and aligning them with business objectives. Lack of governance and oversight for IT infrastructure and applications may affect the security and performance of mobile devices and data, but it is not a direct or inherent result of mobile computing. References: Mobile Computing - ISACA, Mobile Computing Device Threats, Vulnerabilities and Risk Factors Are Ubiquitous - ISACA, Data Loss Prevention-Next Steps - ISACA, [Cloud Computing - ISACA], [Cloud Computing Risk Assessment - ISACA], [User Awareness Training - ISACA], [Governance and Oversight - ISACA]
- 다른 버전
- 288ISACA.CISA-KR.v2026-08-15.q712
- 4303ISACA.CISA-KR.v2026-05-16.q709
- 1857ISACA.CISA-KR.v2026-05-06.q261
- 4727ISACA.CISA-KR.v2026-03-07.q651
- 9433ISACA.CISA-KR.v2025-04-07.q633
- 4541ISACA.CISA-KR.v2025-04-03.q628
- 3804ISACA.CISA-KR.v2025-04-02.q544
- 4310ISACA.CISA-KR.v2025-03-31.q534
- 5508ISACA.CISA-KR.v2025-03-28.q617
- 3306ISACA.CISA-KR.v2025-03-19.q581
- 4190ISACA.CISA-KR.v2025-03-03.q807
- 5242ISACA.CISA-KR.v2024-02-07.q421
- 2918ISACA.CISA-KR.v2024-01-31.q392
- 5427ISACA.CISA-KR.v2023-10-24.q329
- 5257ISACA.CISA-KR.v2023-07-31.q266
- 3254ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 104Microsoft.AZ-305-KR.v2026-08-17.q162
- 113IIA.IAA-IAP-KR.v2026-08-17.q41
- 288ISACA.CISA-KR.v2026-08-15.q712
- 234Microsoft.MS-700-KR.v2026-08-15.q203
- 163Microsoft.AZ-305-KR.v2026-08-14.q177
- 230Microsoft.DP-900-KR.v2026-08-13.q130
- 304Microsoft.PL-600.v2026-08-11.q206
- 240Microsoft.DP-100.v2026-08-11.q160
- 201Oracle.1Z0-1048-25.v2026-08-11.q68
- 167ISQI.CTAL-TAE.v2026-08-11.q37
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-16.q665 모의시험 시험자료를 다운 받으세요.