무료 온라인 액세스 ISACA.CISA-KR.v2026-05-16.q709 모의 시험 (Page 44)

CISA-KR 문제 211

다음 중 이메일 메시지에 포함된 정보의 기밀성을 보호하는 방법은 무엇입니까?

A. 보안 해시 알고리즘 1(SHA-1)

B. 디지털 서명

C. 암호화

D. 디지털 인증서

CISA-KR 문제 212

다음 중 기업 애플리케이션에 가상화 기술을 사용하는 가장 큰 장점은 무엇입니까?

A. 더욱 강화된 데이터 보안

B. 자원의 더 나은 활용

C. 애플리케이션 성능 향상

D. 향상된 재해 복구

CISA-KR 문제 213

조직의 정보 보안 정책은 주로 다음 사항을 기반으로 개발되어야 합니다.

A. 업계 모범 사례.

B. 과거 정보 보안 사고.

C. 위험 관리 프로세스.

D. 엔터프라이즈 아키텍처(EA).

CISA-KR 문제 214

한 회사가 IT 직무 분리 정책을 시행했습니다. 역할 기반 환경에서 애플리케이션 개발자에게 할당될 수 있는 역할은 다음 중 무엇입니까?

A. IT 운영자

B. 시스템 관리

C. 긴급 지원

D. 데이터베이스 관리

정답: C

Segregation of duties (SOD) is a core internal control and an essential component of an effective risk management strategy. SOD emphasizes sharing the responsibilities of key business processesby distributing the discrete functions of these processes to multiple people and departments, helping to reduce the risk of possible errors and fraud1.
SOD is especially important in IT security, where granting excessive system access to one person or group can lead to harmful consequences, such as data breaches, identity theft, or bypassing security controls2. SOD breaks IT-related tasks into four separate function categories: authorization, custody, recordkeeping, and reconciliation1. Ideally, no one person or department holds responsibility in multiple categories.
In a role-based environment, where access privileges are granted based on predefined roles, it is important to ensure that the roles are designed and assigned in a way that supports SOD. For example, the person who develops an application should not also be the one who tests it, deploys it, or maintains it.
Therefore, an application developer should not be assigned the roles of IT operator, system administration, or database administration, as these roles may conflict with their development role and create opportunities for misuse or abuse of the system. The only role that may be assigned to an application developer without violating SOD is emergency support, which is a temporary role that allows the developer to access the system in case of a critical issue that requires immediate resolution3. However, even this role should be granted with caution and monitored closely to ensure compliance with SOD policies.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, page 2824
ISACA, CISA Review Questions, Answers and Explanations Database - 12 Month Subscription, QID
1066692
Hyperproof Blog, Segregation of Duties: What it is and Why it's Important1 Advisera Blog, Segregation of duties in your ISMS according to ISO 27001 A.6.1.23

CISA-KR 문제 215

다음 중 정보 보안 프로그램의 가장 중요한 결과는 무엇입니까?

A. 운영체제의 취약점을 더 쉽게 파악할 수 있습니다.

B. 새로운 보안 기술에 대한 이해와 수용도가 높아지고 있습니다.

C. 정보 보안 위험을 완화하는 비용이 절감됩니다.

D. 조직의 보안 책임에 대한 인식이 향상됩니다.

정답: D

The most importantoutcome of an information security program is to improve the organizational awareness of security responsibilities, as this will foster a culture of security and ensure that all stakeholders are aware of their roles and obligations in protecting the information assets of the organization. An information security program should also aimto achieve other outcomes, such as identifying operating system weaknesses, understanding and accepting emerging security technologies, and reducing the cost to mitigate information security risk, but these are not as important as improving the awareness of security responsibilities, which is the foundation of any effective information security program. *References: According to the ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques for IS Audit and Assurance Professionals, section 2402 Planning, "The IS audit and assurance professional should identify and assess risk relevant to the area under review." 1 One of the risk factors to consider is "the level of awareness of management and staff regarding IT risk management" 1. According to the ISACAIT Audit and Assurance Guideline G13 Information Security Management, "The objective of an information security management audit
/assurancereview is to provide management with an independent assessment relating to the effectiveness of information security management within the enterprise." The guideline also states that "the audit/assurance professional should evaluate whether there is an appropriate level of awareness throughout the enterprise regarding information security policies, standards, procedures and guidelines." According to a web search result from Microsoft Security, "Information security programs need to: ... Support the execution of decisions." 2 One of the ways to support the execution of decisions is to ensure that everyone in the organization understands their security responsibilities and follows the security policies and procedures.

다른 버전: 1742ISACA.CISA-KR.v2026-05-06.q261; 3090ISACA.CISA-KR.v2026-03-16.q665; 4440ISACA.CISA-KR.v2026-03-07.q651; 9176ISACA.CISA-KR.v2025-04-07.q633; 4431ISACA.CISA-KR.v2025-04-03.q628; 3633ISACA.CISA-KR.v2025-04-02.q544; 4189ISACA.CISA-KR.v2025-03-31.q534; 5297ISACA.CISA-KR.v2025-03-28.q617; 3067ISACA.CISA-KR.v2025-03-19.q581; 3953ISACA.CISA-KR.v2025-03-03.q807; 5040ISACA.CISA-KR.v2024-02-07.q421; 2789ISACA.CISA-KR.v2024-01-31.q392; 5259ISACA.CISA-KR.v2023-10-24.q329; 5158ISACA.CISA-KR.v2023-07-31.q266; 3089ISACA.CISA-KR.v2023-06-23.q324

최근 업로드: 216Microsoft.PL-600.v2026-08-11.q206; 153Microsoft.DP-100.v2026-08-11.q160; 155Oracle.1Z0-1048-25.v2026-08-11.q68; 130ISQI.CTAL-TAE.v2026-08-11.q37; 171ServiceNow.CIS-HR.v2026-08-11.q84; 254Salesforce.Plat-Arch-201.v2026-08-10.q101; 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76; 189F5.F5CAB2.v2026-08-10.q41; 284APA.CPP-Remote.v2026-08-08.q109; 149SAP.C_BCBAI_2601.v2026-08-08.q9