CISA-KR 문제 116
다음 중 정보 시스템 감사 전문가에게 감사 기능 수행에 대한 최상의 지침을 제공하는 것은 무엇입니까?
정답: A
The audit charter is the document that defines the purpose, authority and responsibility of the IS audit function. It provides IS audit professionals with the best source of direction for performing audit functions, as it establishes the scope, objectives, reporting lines, independence, accountability and resources of the IS audit function. The IT steering committee is a governance body that oversees the strategic alignment, prioritization and direction of IT initiatives, but it does not provide specific guidance for IS audit functions. The information security policy is a document that defines the rules and principles for protecting information assets in the organization, but it does not cover all aspects of IS audit functions. Audit best practices are general guidelines and recommendations for conducting effective and efficient audits, but they are not binding or authoritative sources of direction for IS audit functions. References: CISA Review Manual (Digital Version) 1, Chapter 1: Information Systems Auditing Process, Section 1.1: Audit Charter.
CISA-KR 문제 117
정보 시스템 감사 담당자는 보안 침해로 인해 노출된 개인 식별 정보(PII)의 수에 따라 벌금이 부과되는 새로운 규정을 알게 되었습니다. 고객 정보 데이터베이스 침해와 관련된 조직의 책임을 제한하는 데 가장 적합한 권장 사항은 무엇일까요?
정답: A
The best recommendation is database segmentation. If liability depends on the number of individuals whose PII is exposed, the organization should reduce the amount of data that could be compromised in any single breach event. Segmenting databases or separating sensitive data domains limits blast radius and can reduce the number of records exposed in a single incident. ISACA guidance supports isolating high-value assets and tightening internal controls as a way to reduce exposure and improve resilience.
Option A is correct because segmentation limits concentration risk. Instead of keeping all customer data in one broadly exposed logical store, segmentation helps confine access and reduce how many records a single compromise can reach. This directly supports limiting breach impact and, in this case, potential liability tied to the number of affected individuals. This conclusion is an inference from ISACA's risk-reduction principles around isolation, exposure control, and documenting exposure.
Option B is incorrect because database normalization improves data structure and reduces redundancy; it is not primarily a breach-liability reduction control.
Option C is incorrect because database harmonization is about consistency or integration across datasets, not limiting exposure in a breach.
Option D is incorrect because database optimization focuses on performance and efficiency, not on minimizing the number of PII records exposed in a security incident.
Therefore, A is the best answer because segmentation is the option that most directly reduces the scope of exposure in a breach and therefore helps limit liability based on affected individuals.
References (Official ISACA):
* ISACA, Best Practices for Setting Up a Cybersecurity Operations Center - recommends prioritizing assets and isolating high-value asset networks.
* ISACA Journal, Reporting on GDPR Compliance to the Board - emphasizes documenting exposure and relevant risk controls for privacy risk reporting.
* ISACA Journal, Practical Data Security and Privacy for GDPR and CCPA - supports governance approaches to limiting privacy exposure. (Referenced conceptually from prior ISACA privacy guidance.)
Option A is correct because segmentation limits concentration risk. Instead of keeping all customer data in one broadly exposed logical store, segmentation helps confine access and reduce how many records a single compromise can reach. This directly supports limiting breach impact and, in this case, potential liability tied to the number of affected individuals. This conclusion is an inference from ISACA's risk-reduction principles around isolation, exposure control, and documenting exposure.
Option B is incorrect because database normalization improves data structure and reduces redundancy; it is not primarily a breach-liability reduction control.
Option C is incorrect because database harmonization is about consistency or integration across datasets, not limiting exposure in a breach.
Option D is incorrect because database optimization focuses on performance and efficiency, not on minimizing the number of PII records exposed in a security incident.
Therefore, A is the best answer because segmentation is the option that most directly reduces the scope of exposure in a breach and therefore helps limit liability based on affected individuals.
References (Official ISACA):
* ISACA, Best Practices for Setting Up a Cybersecurity Operations Center - recommends prioritizing assets and isolating high-value asset networks.
* ISACA Journal, Reporting on GDPR Compliance to the Board - emphasizes documenting exposure and relevant risk controls for privacy risk reporting.
* ISACA Journal, Practical Data Security and Privacy for GDPR and CCPA - supports governance approaches to limiting privacy exposure. (Referenced conceptually from prior ISACA privacy guidance.)
CISA-KR 문제 118
기업 데이터 분류 프로그램을 성공적으로 구현하기 위한 첫 번째 단계는 다음 중 무엇이어야 할까요?
정답: A
The first step to successfully implement a corporate data classification program is to approve a data classification policy. A data classification policy is a document that defines the objectives, scope, principles, roles, responsibilities, and procedures for classifying data based on its sensitivity and value to the organization. A data classification policy is essential for establishing a common understanding and a consistent approach for data classification across the organization, as well as for ensuring compliance with relevant regulatory and contractual requirements.
Selecting a data loss prevention (DLP) product (option B) is not the first step to implement a data classification program, as it is a technical solution that supports the enforcement of the data classification policy, not the definition of it. A DLP product can help prevent unauthorized access, use, or disclosure of sensitive data by monitoring, detecting, and blocking data flows that violate the data classification policy.
However, before selecting a DLP product, the organization needs to have a clear and approved data classification policy that specifies the criteria and rules for data classification.
Confirming that adequate resources are available for the project (option C) is also not the first step to implement a data classification program, as it is a project management activity that ensures the feasibility and sustainability of the project, not the design of it. Confirming that adequate resources are available for the project involves estimating and securing the necessary budget, staff, time, and tools for implementing and maintaining the data classification program. However, before confirming that adequate resources are available for the project, the organization needs to have a clear and approved data classification policy that defines the scope and objectives of the project.
Checking for the required regulatory requirements (option D) is also not the first step to implement a data classification program, as it is an input to the development of the data classification policy, not an output of it.
Checking for the required regulatory requirements involves identifying and analyzing the applicable laws, regulations, standards, and contracts that govern the protection and handling of sensitive data. However, checking for the required regulatory requirements is not enough to implement a data classification program; the organization also needs to have a clear and approved data classification policy that incorporates and complies with those requirements.
Therefore, option A is the correct answer.
References:
Data Classification: What It Is and How to Implement It
Create a well-designed data classification framework
7 Steps to Effective Data Classification | CDW
Data Classification: The Basics and a 6-Step Checklist - NetApp
Private and confidential February 2021 - Deloitte US
Selecting a data loss prevention (DLP) product (option B) is not the first step to implement a data classification program, as it is a technical solution that supports the enforcement of the data classification policy, not the definition of it. A DLP product can help prevent unauthorized access, use, or disclosure of sensitive data by monitoring, detecting, and blocking data flows that violate the data classification policy.
However, before selecting a DLP product, the organization needs to have a clear and approved data classification policy that specifies the criteria and rules for data classification.
Confirming that adequate resources are available for the project (option C) is also not the first step to implement a data classification program, as it is a project management activity that ensures the feasibility and sustainability of the project, not the design of it. Confirming that adequate resources are available for the project involves estimating and securing the necessary budget, staff, time, and tools for implementing and maintaining the data classification program. However, before confirming that adequate resources are available for the project, the organization needs to have a clear and approved data classification policy that defines the scope and objectives of the project.
Checking for the required regulatory requirements (option D) is also not the first step to implement a data classification program, as it is an input to the development of the data classification policy, not an output of it.
Checking for the required regulatory requirements involves identifying and analyzing the applicable laws, regulations, standards, and contracts that govern the protection and handling of sensitive data. However, checking for the required regulatory requirements is not enough to implement a data classification program; the organization also needs to have a clear and approved data classification policy that incorporates and complies with those requirements.
Therefore, option A is the correct answer.
References:
Data Classification: What It Is and How to Implement It
Create a well-designed data classification framework
7 Steps to Effective Data Classification | CDW
Data Classification: The Basics and a 6-Step Checklist - NetApp
Private and confidential February 2021 - Deloitte US
CISA-KR 문제 119
한 조직에서 기존의 중앙 집중식 보안 관리 시스템을 분산형 보안 관리 시스템으로 교체했습니다. 다음 중 가장 큰 잠재적 문제점은 무엇입니까?
정답: A
A distributed security administration system is a system that allows different administrators to manage the security of different parts of the network or organization. This can provide more flexibility, scalability, and efficiency than a centralized system, where one administrator is responsible for the entire security. However, a distributed security administration system also presents some potential challenges and risks, such as:
Inconsistency and conflict among different security policies and standards Lack of coordination and communication among different administrators Difficulty in monitoring and auditing the overall security status and performance Increased complexity and cost of security management and maintenance Therefore, the greatest potential concern for implementing a distributed security administration system is that the security procedures may be inadequate to support the change. Security procedures are the rules and guidelines that define how security is implemented and enforced in an organization. They include policies, standards, processes, roles, responsibilities, controls, and metrics. Security procedures should be aligned with the business objectives, risks, and requirements of the organization, as well as the best practices and regulations in the industry. Security procedures should also be reviewed and updated regularly to reflect the changes in the environment, technology, and threats.
If the security procedures are not adequate to support the change from a centralized to a distributed security administration system, the organization may face increased security risks, such as unauthorized access, data breaches, compliance violations, reputation damage, and financial losses. Therefore, it is essential to ensure that the security procedures are revised and adapted to suit the new system, and that they are communicated and enforced effectively across the organization.
References:
1: Security in Distributed System - GeeksforGeeks
2: Distributed System Security Architecture - Wikipedia
3: Distributed Systems Security: Issues, Processes and Solutions
Inconsistency and conflict among different security policies and standards Lack of coordination and communication among different administrators Difficulty in monitoring and auditing the overall security status and performance Increased complexity and cost of security management and maintenance Therefore, the greatest potential concern for implementing a distributed security administration system is that the security procedures may be inadequate to support the change. Security procedures are the rules and guidelines that define how security is implemented and enforced in an organization. They include policies, standards, processes, roles, responsibilities, controls, and metrics. Security procedures should be aligned with the business objectives, risks, and requirements of the organization, as well as the best practices and regulations in the industry. Security procedures should also be reviewed and updated regularly to reflect the changes in the environment, technology, and threats.
If the security procedures are not adequate to support the change from a centralized to a distributed security administration system, the organization may face increased security risks, such as unauthorized access, data breaches, compliance violations, reputation damage, and financial losses. Therefore, it is essential to ensure that the security procedures are revised and adapted to suit the new system, and that they are communicated and enforced effectively across the organization.
References:
1: Security in Distributed System - GeeksforGeeks
2: Distributed System Security Architecture - Wikipedia
3: Distributed Systems Security: Issues, Processes and Solutions
CISA-KR 문제 120
다음 중 재난 대응 계획에서 가장 중요한 고려 사항은 무엇입니까?
정답: B
- 다른 버전
- 1797ISACA.CISA-KR.v2026-05-06.q261
- 3118ISACA.CISA-KR.v2026-03-16.q665
- 4484ISACA.CISA-KR.v2026-03-07.q651
- 9209ISACA.CISA-KR.v2025-04-07.q633
- 4451ISACA.CISA-KR.v2025-04-03.q628
- 3672ISACA.CISA-KR.v2025-04-02.q544
- 4221ISACA.CISA-KR.v2025-03-31.q534
- 5320ISACA.CISA-KR.v2025-03-28.q617
- 3151ISACA.CISA-KR.v2025-03-19.q581
- 3975ISACA.CISA-KR.v2025-03-03.q807
- 5133ISACA.CISA-KR.v2024-02-07.q421
- 2805ISACA.CISA-KR.v2024-01-31.q392
- 5268ISACA.CISA-KR.v2023-10-24.q329
- 5215ISACA.CISA-KR.v2023-07-31.q266
- 3111ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 114Microsoft.AZ-305-KR.v2026-08-14.q177
- 154Microsoft.DP-900-KR.v2026-08-13.q130
- 244Microsoft.PL-600.v2026-08-11.q206
- 183Microsoft.DP-100.v2026-08-11.q160
- 177Oracle.1Z0-1048-25.v2026-08-11.q68
- 145ISQI.CTAL-TAE.v2026-08-11.q37
- 195ServiceNow.CIS-HR.v2026-08-11.q84
- 259Salesforce.Plat-Arch-201.v2026-08-10.q101
- 245Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 192F5.F5CAB2.v2026-08-10.q41
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-05-16.q709 모의시험 시험자료를 다운 받으세요.