CISA-KR 문제 426
MDM can help protect corporate applications on employee-owned devices by:
Enforcing security policies and settings, such as encryption, password, firewall, antivirus, and VPN.
Controlling the installation, update, and removal of corporate applications and data.
Separating corporate and personal data and applications on the device using containers or profiles.
Monitoring and auditing the device's compliance status, activity, and location.
Performing remote actions, such as lock, wipe, backup, or restore, in case of loss, theft, or compromise.
MDM can provide a comprehensive and centralized approach to maintain the security of corporate applications on employee-owned devices, regardless of the device type, platform, or ownership. MDM can also help the organization comply with regulatory and industry standards for data protection and privacy.
Enabling remote data destruction capabilities is a useful feature for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Remote data destruction allows the organization to erase the corporate data and applications from the device in case of loss, theft, or compromise. However, this feature does not prevent unauthorized access or misuse of the corporate data and applications before they are destroyed. Remote data destruction is usually part of an MDM solution.
Disabling unnecessary network connectivity options is a good practice for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Network connectivity options, such as Wi-Fi, Bluetooth, NFC, or USB, can expose the device to potential attacks or data leakage. Disabling these options when they are not needed can reduce the attack surface and improve battery life. However, this practice does not address other security risks or requirements for the corporate applications on the device. Disabling network connectivity options can also be part of an MDM solution.
Requiring security awareness training for mobile users is an important measure for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Security awareness training can educate the users about the potential threats and best practices for using their devices securely. It can also help foster a culture of security and responsibility among the users. However, security awareness training cannot guarantee that the users will follow the security policies and guidelines consistently and correctly. Security awareness training should be complemented by technical controls, such as MDM.
References:
Protecting Corporate Data on Mobile Devices for All Companies1
Mobile Device Security: Corporate-Owned Personally-Enabled (COPE)23
CISA-KR 문제 427
Theaudit charteris a formal document that definesthe purpose, authority, and responsibilitiesof the internal audit function.
* Audit Charter (Correct Answer - A)
* Establishesroles, reporting structure, and independenceof the audit team.
* Example:TheIS audit team's roleinrisk assessmentsis outlined in the charter.
* Annual Audit Plan (Incorrect - B)
* Outlinesaudit activitiesbutdoes not define roles and responsibilities.
* Engagement Letter (Incorrect - C)
* Used forspecific audits, not theentire audit function.
* Audit Scope Letter (Incorrect - D)
* Detailswhat is coveredin an audit but doesnot define responsibilities.
References:
* ISACA CISA Review Manual
* COBIT 2019 (Audit Governance)
CISA-KR 문제 428
CISA-KR 문제 429
References:
* Control Objectives & Activities: Examples, Appropriateness
* Levels and Types of Control | Principles of Management
* CISA Review Manual 27th Edition, page 337
CISA-KR 문제 430
Unauthorized access is not a threat actor, but rather a result of a threat actor's activity. Deleted log data is a threat consequence or impact that occurs when log data, which are records of events or activities that occur on an information system or network, are erased or corrupted by a threat actor. Deleted log data can affect the auditability, accountability, and visibility of the information system or network, and prevent detection or investigation of security incidents. Deleted log data is not a threat actor, but rather a result of a threat actor's activity. Hacktivists are threat actors who use hacking techniques to promote a political or social cause or agenda. Hacktivists are not the threat actors in this scenario, as there is no indication that they are involved in this case.
- 다른 버전
- 263ISACA.CISA-KR.v2026-08-15.q712
- 4292ISACA.CISA-KR.v2026-05-16.q709
- 1850ISACA.CISA-KR.v2026-05-06.q261
- 4721ISACA.CISA-KR.v2026-03-07.q651
- 9429ISACA.CISA-KR.v2025-04-07.q633
- 4538ISACA.CISA-KR.v2025-04-03.q628
- 3803ISACA.CISA-KR.v2025-04-02.q544
- 4307ISACA.CISA-KR.v2025-03-31.q534
- 5501ISACA.CISA-KR.v2025-03-28.q617
- 3303ISACA.CISA-KR.v2025-03-19.q581
- 4183ISACA.CISA-KR.v2025-03-03.q807
- 5242ISACA.CISA-KR.v2024-02-07.q421
- 2918ISACA.CISA-KR.v2024-01-31.q392
- 5426ISACA.CISA-KR.v2023-10-24.q329
- 5252ISACA.CISA-KR.v2023-07-31.q266
- 3250ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 263ISACA.CISA-KR.v2026-08-15.q712
- 227Microsoft.MS-700-KR.v2026-08-15.q203
- 156Microsoft.AZ-305-KR.v2026-08-14.q177
- 226Microsoft.DP-900-KR.v2026-08-13.q130
- 293Microsoft.PL-600.v2026-08-11.q206
- 234Microsoft.DP-100.v2026-08-11.q160
- 196Oracle.1Z0-1048-25.v2026-08-11.q68
- 163ISQI.CTAL-TAE.v2026-08-11.q37
- 204ServiceNow.CIS-HR.v2026-08-11.q84
- 284Salesforce.Plat-Arch-201.v2026-08-10.q101
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-03-16.q665 모의시험 시험자료를 다운 받으세요.