CISA-KR 문제 266
다음 중 새로운 시스템에서 직무 분리 위반을 식별하는 가장 효율적인 방법은 무엇입니까?
정답: A
The most efficient way to identify segregation of duties violations in a new system is to review a report of security rights in the system. Segregation of duties is a control principle that aims to prevent or detect errors, fraud, or abuse by ensuring that no single individual has the ability to perform incompatible or conflicting functions or activities within a system or process. A report of security rights in the system can provide a comprehensive and accurate overview of the roles, responsibilities, and access levels assigned to different users or groups in the system, and can help to identify any potential segregation of duties violations or risks. The other options are not as efficient as reviewing a report of security rights in the system, because they either rely on observation or testing rather than analysis, or they focus on existing rather than potential violations. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.2
CISA-KR 문제 267
조직의 운영 환경에 새로운 애플리케이션을 출시하기 전에 적절한 테스트가 실시되었고 롤백 계획이 수립되었는지 확인하기 위해 다음 중 어떤 조치를 취해야 합니까?
정답: A
Comprehensive and Detailed Step-by-Step Explanation:
AChange Approval Board (CAB)ensures thatall necessary testing and rollback planshave been reviewed before deployment.
* Option A (Correct):ACABensures thatchanges are reviewed, tested, and approved, minimizing risks before an application is deployed. This includes confirming thatrollback plans are in place.
* Option B (Incorrect):Standardized change requestsare important but donot guarantee review and approvalby management and stakeholders.
* Option C (Incorrect):Third-party approvalmay be useful, but internalgovernance and control via a CABis more comprehensive.
* Option D (Incorrect):Secure code reviewshelp identify vulnerabilities, but they donot confirm proper deployment and rollback procedures.
Reference:ISACA CISA Review Manual -Domain 3: Information Systems Acquisition, Development, and Implementation- Coverschange management and deployment best practices.
AChange Approval Board (CAB)ensures thatall necessary testing and rollback planshave been reviewed before deployment.
* Option A (Correct):ACABensures thatchanges are reviewed, tested, and approved, minimizing risks before an application is deployed. This includes confirming thatrollback plans are in place.
* Option B (Incorrect):Standardized change requestsare important but donot guarantee review and approvalby management and stakeholders.
* Option C (Incorrect):Third-party approvalmay be useful, but internalgovernance and control via a CABis more comprehensive.
* Option D (Incorrect):Secure code reviewshelp identify vulnerabilities, but they donot confirm proper deployment and rollback procedures.
Reference:ISACA CISA Review Manual -Domain 3: Information Systems Acquisition, Development, and Implementation- Coverschange management and deployment best practices.
CISA-KR 문제 268
재해 복구 감사 중에 IS 감사원은 비즈니스 영향 분석(BIA)이 수행되지 않았다는 것을 발견합니다. 감사원은 먼저 다음을 수행해야 합니다.
정답: C
The first step that an IS auditor should take when finding that a business impact analysis (BIA) has not been performed is to evaluate the impact on current disaster recovery capability. A BIA is a process that identifies and analyzes the potential effects of disruptions to critical business functions and processes. A BIA helps determine the recovery priorities, objectives, and strategies for the organization. Without a BIA, the disaster recovery plan may not be aligned with the business needs and expectations, and may not provide adequate protection and recovery for the most critical assets and activities. Therefore, an IS auditor should assess how the lack of a BIA affects the current disaster recovery capability and identify any gaps or risks that need to be addressed.
Performing a BIA, issuing an intermediate report to management, and conducting additional compliance testing are not the first steps that an IS auditor should take when finding that a BIA has not been performed.
These steps may be done later in the audit process, after evaluating the impact on current disaster recovery capability. Performing a BIA is not the responsibility of the IS auditor, but of the business owners and managers. Issuing an intermediate report to management may be premature without sufficient evidence and analysis. Conducting additional compliance testing may not be relevant ornecessary without a clear understanding of the disaster recovery requirements and objectives.
Performing a BIA, issuing an intermediate report to management, and conducting additional compliance testing are not the first steps that an IS auditor should take when finding that a BIA has not been performed.
These steps may be done later in the audit process, after evaluating the impact on current disaster recovery capability. Performing a BIA is not the responsibility of the IS auditor, but of the business owners and managers. Issuing an intermediate report to management may be premature without sufficient evidence and analysis. Conducting additional compliance testing may not be relevant ornecessary without a clear understanding of the disaster recovery requirements and objectives.
CISA-KR 문제 269
다음 중 보안 인식 교육에 가장 중요하게 포함해야 할 것은 무엇입니까?
정답: A
The most important thing to include in security awareness training is how to respond to various types of suspicious activity. Security awareness training is a program that educates employees about the importance of security and how to avoid common threats and risks. One of the main objectives of security awareness training is to enable employees to recognize and report any signs of malicious or unauthorized activity, such as phishing emails, malware infections, data breaches, or social engineering attempts. By teaching employees how to respond to various types of suspicious activity, security awareness training can help to prevent or mitigate the impact of security incidents, protect the organization's assets and reputation, and comply with legal and regulatory requirements.
The other options are not as important as option A. The importance of complex passwords is a useful topic, but not the most important thing to include in security awareness training. Complex passwords are passwords that are hard to guess or crack by using a combination of letters, numbers, symbols, and cases. Complex passwords can help to protect user accounts and data from unauthorized access, but they are not sufficient to prevent all types of security incidents. Moreover, complex passwords may be difficult to remember or manage by users, and may require additional measures such as password managers or multi-factor authentication.
Descriptions of the organization's security infrastructure is a technical topic, but not the most important thing to include in security awareness training. Security infrastructure is the set of hardware, software, policies, and procedures that provide the foundation for the organization's security posture and capabilities. Security infrastructure may include firewalls, antivirus software, encryption tools, access control systems, backup systems, etc. Descriptions of the organization's security infrastructure may be relevant for some employees who are involved in security operations or administration, but they may not be necessary or understandable for all employees who need security awareness training. Contact information for the organization's security team is a practical detail, but not the most important thing to include in security awareness training. Security team is the group of people who are responsible for planning, implementing, monitoring, and improving the organization's security strategy and activities. Contact information for the organization's security team may be useful for employees who need to report or escalate a security issue or request a securityservice or support.
However, contact information for the organization's security team is not enough to ensure that employees know how to respond to various types of suspicious activity. References: Security Awareness Training | SANS Security Awareness, Security AwarenessTraining | KnowBe4, SecurityAwareness Training Course (ISC)² | Coursera
The other options are not as important as option A. The importance of complex passwords is a useful topic, but not the most important thing to include in security awareness training. Complex passwords are passwords that are hard to guess or crack by using a combination of letters, numbers, symbols, and cases. Complex passwords can help to protect user accounts and data from unauthorized access, but they are not sufficient to prevent all types of security incidents. Moreover, complex passwords may be difficult to remember or manage by users, and may require additional measures such as password managers or multi-factor authentication.
Descriptions of the organization's security infrastructure is a technical topic, but not the most important thing to include in security awareness training. Security infrastructure is the set of hardware, software, policies, and procedures that provide the foundation for the organization's security posture and capabilities. Security infrastructure may include firewalls, antivirus software, encryption tools, access control systems, backup systems, etc. Descriptions of the organization's security infrastructure may be relevant for some employees who are involved in security operations or administration, but they may not be necessary or understandable for all employees who need security awareness training. Contact information for the organization's security team is a practical detail, but not the most important thing to include in security awareness training. Security team is the group of people who are responsible for planning, implementing, monitoring, and improving the organization's security strategy and activities. Contact information for the organization's security team may be useful for employees who need to report or escalate a security issue or request a securityservice or support.
However, contact information for the organization's security team is not enough to ensure that employees know how to respond to various types of suspicious activity. References: Security Awareness Training | SANS Security Awareness, Security AwarenessTraining | KnowBe4, SecurityAwareness Training Course (ISC)² | Coursera
CISA-KR 문제 270
BYOD(Bring Your Own Device) 프로그램 구현에 대한 감사를 위한 계획 단계에서 가장 중요한 입력을 제공할 수 있는 것은 다음 중 어느 것입니까?
정답: D
The most important input during the planning phase for an audit on the implementation of a bring your own device (BYOD) program is policies including BYOD acceptable user statements. Policies are documents that define the organization's objectives, requirements, expectations, and responsibilities regarding a specific topic or area. BYOD policies should include acceptable user statements that specify what types of personal devices are allowed to connect to the corporate network, what security measures must be implemented on those devices, what data can be accessed or stored on those devices, what actions must be taken in case of device loss or theft, and what consequences will apply for non-compliance. Policies including BYOD acceptable user statements can provide an IS auditor with a clear understanding of the scope, criteria, and objectives of the BYOD program audit. Findings from prior audits, results of a risk assessment, and an inventory of personal devices to be connected to the corporate network are also useful inputs for planning a BYOD program audit, but they are not as important as policies including BYOD acceptable user statements. References: ISACA CISA Review Manual 27th Edition, page 381.
- 다른 버전
- 286ISACA.CISA-KR.v2026-08-15.q712
- 4300ISACA.CISA-KR.v2026-05-16.q709
- 1857ISACA.CISA-KR.v2026-05-06.q261
- 4726ISACA.CISA-KR.v2026-03-07.q651
- 9432ISACA.CISA-KR.v2025-04-07.q633
- 4541ISACA.CISA-KR.v2025-04-03.q628
- 3804ISACA.CISA-KR.v2025-04-02.q544
- 4310ISACA.CISA-KR.v2025-03-31.q534
- 5507ISACA.CISA-KR.v2025-03-28.q617
- 3304ISACA.CISA-KR.v2025-03-19.q581
- 4188ISACA.CISA-KR.v2025-03-03.q807
- 5242ISACA.CISA-KR.v2024-02-07.q421
- 2918ISACA.CISA-KR.v2024-01-31.q392
- 5427ISACA.CISA-KR.v2023-10-24.q329
- 5255ISACA.CISA-KR.v2023-07-31.q266
- 3254ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 286ISACA.CISA-KR.v2026-08-15.q712
- 234Microsoft.MS-700-KR.v2026-08-15.q203
- 163Microsoft.AZ-305-KR.v2026-08-14.q177
- 230Microsoft.DP-900-KR.v2026-08-13.q130
- 303Microsoft.PL-600.v2026-08-11.q206
- 239Microsoft.DP-100.v2026-08-11.q160
- 200Oracle.1Z0-1048-25.v2026-08-11.q68
- 167ISQI.CTAL-TAE.v2026-08-11.q37
- 206ServiceNow.CIS-HR.v2026-08-11.q84
- 286Salesforce.Plat-Arch-201.v2026-08-10.q101
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-16.q665 모의시험 시험자료를 다운 받으세요.