CISA-KR 문제 356
프로젝트 평가 중에 IS 감사원은 사업주가 프로젝트 시작 단계에서 제외되었음을 발견했습니다. 이 상황에서 감사원이 가장 우려해야 할 사항은 다음 중 어느 것입니까?
정답: D
The answer D is correct because the greatest concern for an IS auditor with the situation of business owners being removed from the project initiation phase is that the requirements may be incomplete. The project initiation phase is the first step in starting a new project, where the project's purpose, scope, objectives, and deliverables are defined and documented. The project initiation phase also involves identifying and engaging the key stakeholders who have an interest or influence in the project, such as sponsors, customers, users, or business owners.
Business owners are the individuals or entities who have the authority and responsibility to define the business needs and expectations for the project. They are also the primary beneficiaries of the project outcomes and benefits. Business owners play a crucial role in the project initiation phase, as they provide valuable input and feedback on the requirements and specifications of the project. Requirements are the statements that describe what the project should accomplish or deliver to meet the business needs and expectations. Requirements are essential for guiding the project planning, execution, monitoring, and closure phases.
If business owners are removed from the project initiation phase, it can result in incomplete or inaccurate requirements, which can have negative impacts on the project's quality, scope, time, cost, and risk. Some of the possible consequences of incomplete requirements are:
Misalignment: The project may not align with the business strategy, vision, or goals, which can reduce its value or relevance.
Confusion: The project team may not have a clear understanding of what the project should achieve or deliver, which can affect their performance or productivity.
Rework: The project may need to undergo frequent changes or revisions to accommodate new or modified requirements, which can increase the time and cost of the project.
Dissatisfaction: The project may not meet the expectations or satisfaction of the business owners or other stakeholders, which can affect their acceptance or support of the project.
Failure: The project may not deliver the expected outcomes or benefits, which can affect its success or viability.
Therefore, an IS auditor should be concerned about the involvement and participation of business owners in the project initiation phase, as it affects the completeness and quality of requirements. An IS auditor should review the policies and procedures for stakeholder identification and engagement, verify that the business owners have adequate knowledge and skills to define their requirements, and test that the requirements are well-defined, documented, approved, and communicated.
References:
Project Initiation: The First Step to Project Management [2023] * Asana Everything you need to know about the project initiation phase Project Initiation Phase - The Business Professor Project Initiation: A Guide to Starting a Project Right Way - Kissflow
Business owners are the individuals or entities who have the authority and responsibility to define the business needs and expectations for the project. They are also the primary beneficiaries of the project outcomes and benefits. Business owners play a crucial role in the project initiation phase, as they provide valuable input and feedback on the requirements and specifications of the project. Requirements are the statements that describe what the project should accomplish or deliver to meet the business needs and expectations. Requirements are essential for guiding the project planning, execution, monitoring, and closure phases.
If business owners are removed from the project initiation phase, it can result in incomplete or inaccurate requirements, which can have negative impacts on the project's quality, scope, time, cost, and risk. Some of the possible consequences of incomplete requirements are:
Misalignment: The project may not align with the business strategy, vision, or goals, which can reduce its value or relevance.
Confusion: The project team may not have a clear understanding of what the project should achieve or deliver, which can affect their performance or productivity.
Rework: The project may need to undergo frequent changes or revisions to accommodate new or modified requirements, which can increase the time and cost of the project.
Dissatisfaction: The project may not meet the expectations or satisfaction of the business owners or other stakeholders, which can affect their acceptance or support of the project.
Failure: The project may not deliver the expected outcomes or benefits, which can affect its success or viability.
Therefore, an IS auditor should be concerned about the involvement and participation of business owners in the project initiation phase, as it affects the completeness and quality of requirements. An IS auditor should review the policies and procedures for stakeholder identification and engagement, verify that the business owners have adequate knowledge and skills to define their requirements, and test that the requirements are well-defined, documented, approved, and communicated.
References:
Project Initiation: The First Step to Project Management [2023] * Asana Everything you need to know about the project initiation phase Project Initiation Phase - The Business Professor Project Initiation: A Guide to Starting a Project Right Way - Kissflow
CISA-KR 문제 357
조직의 재해 복구 계획(DRP)을 검토하는 IS 감사원이 가장 우려해야 할 사항은 다음 중 무엇입니까?
정답: C
The greatest concern for an IS auditor reviewing an organization's disaster recovery plan (DRP) is that the DRP has not been updated since an IT infrastructure upgrade. This could render the DRP obsolete or ineffective, as it may not reflect the current configuration, dependencies or recovery requirements of the IT systems. The IS auditor should ensure that the DRP is reviewed and updated regularly to align with any changes in the IT environment. The DRP has not been formally approved by senior management is a concern for an IS auditor reviewing an organization's DRP, but it is not as critical as ensuring that the DRP is up to date and valid. The DRP has not been distributed to end users or the DRP contains recovery procedures for critical servers only are issues that relate to the communication or scope of the DRP, but not to its validity or effectiveness. References: ISACA, CISA Review Manual, 27th Edition, 2018, page 389
CISA-KR 문제 358
IT 시스템 복구 중 비즈니스 기능을 운영 상태로 유지하기 위한 해결 방법 프로세스 문서화는 다음의 핵심 부분입니다.
정답: C
A business continuity plan (BCP) is a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster1. A core part of a BCP is the documentation of workaround processes to keep a business function operational during recovery of IT systems. Workaround processes are alternative methods or procedures that can be used to perform a business function when the normal IT systems are unavailable or disrupted2. For example, if an online payment system is down, a workaround process could be to accept manual payments or use a backup system. Workaround processes help to minimize the impact of IT disruptions on the business operations and ensure continuity of service to customers and stakeholders3.
References:
* 1 explains what is a business continuity plan and why it is important.
* 2 defines what is a workaround process and how it can be used in a BCP.
* 3 provides examples of workaround processes for different business functions.
References:
* 1 explains what is a business continuity plan and why it is important.
* 2 defines what is a workaround process and how it can be used in a BCP.
* 3 provides examples of workaround processes for different business functions.
CISA-KR 문제 359
IS 감사원이 다가올 감사 범위에서 지원되지 않는 오래된 기술을 사용하는 산업 제어 시스템(ICS)을 검토하고 있습니다. 감사원은 무엇을 가장 중요한 우려 사항으로 간주해야 합니까?
정답: B
The most significant concern for an IS auditor when reviewing an industrial control system (ICS) that uses older unsupported technology in the scope of an upcoming audit is that there is a greater risk of system exploitation. System exploitation is an attack that occurs when an unauthorized entity or individual takes advantage of a vulnerability or weakness in a system to compromise its security or functionality. System exploitation can cause harm or damage to the system or its users, such as data loss, corruption, theft, manipulation, denial of service (DoS), etc. An ICS that uses older unsupported technology poses a high risk of system exploitation, as older technology may have known or unknown vulnerabilities or defects that have not been patched or fixed by the vendor or manufacturer, and unsupported technology may not receive any updates or support from the vendor or manufacturer in case of issues or incidents. Attack vectors are evolving for industrial control systems is a possible concern for an IS auditor when reviewing an ICS that uses older unsupported technology in the scope of an upcoming audit, but it is not the most significant one. Attack vectors are methods or pathways that attackers use to gain access to or attack a system. Attack vectors are evolving for industrial control systems, as attackers are developing new techniques or tools to target ICSs that are increasingly connected and complex. However, this concern may not be specific to older unsupported technology, as it may affect any ICS regardless of its technology level. Disaster recovery plans (DRPs) are not in place is a possible concern for an IS auditor when reviewing an ICS that uses older unsupported technology in the scope of an upcoming audit, but it is not the most significant one. DRPs are documents that outline the technical and operational steps for restoring the IT systems and infrastructure that support critical functions or processes in the event of a disruption or disaster. DRPs are not in place, as they may affect the availability and continuity of the ICS and its functions or processes in case of a failure or incident. However, this concern may not be related to older unsupported technology, as it may apply to any ICS regardless of its technology level.
Technical specifications are not documented is a possible concern for an IS auditor when reviewing an ICS that uses older unsupported technology in the scope of an upcoming audit, but it is not the most significant one. Technical specifications are documents that describe the technical characteristics or requirements of a system or component, such as functionality, performance, design, etc. Technical specifications are not documented, as they may affect the understanding, maintenance, and improvement of the ICS and its components. However, this concern may not beassociated with older unsupported technology, as it may affect any ICS regardless of its technology level.
Technical specifications are not documented is a possible concern for an IS auditor when reviewing an ICS that uses older unsupported technology in the scope of an upcoming audit, but it is not the most significant one. Technical specifications are documents that describe the technical characteristics or requirements of a system or component, such as functionality, performance, design, etc. Technical specifications are not documented, as they may affect the understanding, maintenance, and improvement of the ICS and its components. However, this concern may not beassociated with older unsupported technology, as it may affect any ICS regardless of its technology level.
CISA-KR 문제 360
미션 크리티컬 애플리케이션은 1노드 데이터베이스 서버를 활용합니다. 여러 차례에 걸쳐 데이터베이스 서비스가 일상적인 패치를 수행하기 위해 중단되어 애플리케이션 중단이 발생했습니다. 다음 중 IS 감사자가 가장 우려해야 할 사항은 무엇입니까?
정답: C
- 다른 버전
- 266ISACA.CISA-KR.v2026-08-15.q712
- 4295ISACA.CISA-KR.v2026-05-16.q709
- 1855ISACA.CISA-KR.v2026-05-06.q261
- 4721ISACA.CISA-KR.v2026-03-07.q651
- 9431ISACA.CISA-KR.v2025-04-07.q633
- 4539ISACA.CISA-KR.v2025-04-03.q628
- 3803ISACA.CISA-KR.v2025-04-02.q544
- 4308ISACA.CISA-KR.v2025-03-31.q534
- 5504ISACA.CISA-KR.v2025-03-28.q617
- 3303ISACA.CISA-KR.v2025-03-19.q581
- 4185ISACA.CISA-KR.v2025-03-03.q807
- 5242ISACA.CISA-KR.v2024-02-07.q421
- 2918ISACA.CISA-KR.v2024-01-31.q392
- 5427ISACA.CISA-KR.v2023-10-24.q329
- 5253ISACA.CISA-KR.v2023-07-31.q266
- 3254ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 266ISACA.CISA-KR.v2026-08-15.q712
- 229Microsoft.MS-700-KR.v2026-08-15.q203
- 158Microsoft.AZ-305-KR.v2026-08-14.q177
- 228Microsoft.DP-900-KR.v2026-08-13.q130
- 295Microsoft.PL-600.v2026-08-11.q206
- 237Microsoft.DP-100.v2026-08-11.q160
- 196Oracle.1Z0-1048-25.v2026-08-11.q68
- 164ISQI.CTAL-TAE.v2026-08-11.q37
- 206ServiceNow.CIS-HR.v2026-08-11.q84
- 285Salesforce.Plat-Arch-201.v2026-08-10.q101
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-16.q665 모의시험 시험자료를 다운 받으세요.