CISA-KR 문제 226
다음 중 정보 보안 프로그램의 성공에 가장 중요한 요소는 무엇입니까?
정답: A
The most critical factor for the success of an information security program is management's commitment to information security. Management's commitment to information security means that the senior management supports, sponsors, funds, monitors and enforces the information security program within the organization.
Management's commitment to information security also demonstrates leadership, sets the tone and culture, and establishes the strategic direction and objectives for information security. User accountability for information security, alignment of information security with IT objectives, and integration of business and information security are also important factors for the success of an information security program, but they are not as critical as management's commitment to information security, as they depend on or derive from it. References: Info Technology and Systems Resources | COBIT, Risk, Governance ... - ISACA, IT Governance and Process Maturity
Management's commitment to information security also demonstrates leadership, sets the tone and culture, and establishes the strategic direction and objectives for information security. User accountability for information security, alignment of information security with IT objectives, and integration of business and information security are also important factors for the success of an information security program, but they are not as critical as management's commitment to information security, as they depend on or derive from it. References: Info Technology and Systems Resources | COBIT, Risk, Governance ... - ISACA, IT Governance and Process Maturity
CISA-KR 문제 227
IS 감사자가 사내 소프트웨어 개발 솔루션의 릴리스 관리 프로세스를 검토하고 있습니다. 어떤 환경에서 소프트웨어 버전이 운영 환경과 동일할 가능성이 가장 높습니까?
정답: A
A staging environment is a replica of the production environment that is used to test and verify software before deploying it to production. A staging environment is most likely to have the same software version as production, as it mimics the real-world conditions and configurations that will be encountered in production.
A testing environment is a separate environment that is used to perform various types of testing on software, such as functional testing, performance testing, security testing, etc. A testing environment may not have the same software version as production, as it may undergo frequent changes or updates based on testing results or feedback. An integration environment is a separate environment that is used to combine and test software components or modules from different developers or sources, to ensure that they work together as expected.
An integration environment may not have the same software version as production, as it may involve different versions or branches of software from different sources. A development environment is a separate environment that is used by developers to create and modify software code. A development environment may not have the same software version as production, as it may contain unfinished or untested code that has not been released yet.
A testing environment is a separate environment that is used to perform various types of testing on software, such as functional testing, performance testing, security testing, etc. A testing environment may not have the same software version as production, as it may undergo frequent changes or updates based on testing results or feedback. An integration environment is a separate environment that is used to combine and test software components or modules from different developers or sources, to ensure that they work together as expected.
An integration environment may not have the same software version as production, as it may involve different versions or branches of software from different sources. A development environment is a separate environment that is used by developers to create and modify software code. A development environment may not have the same software version as production, as it may contain unfinished or untested code that has not been released yet.
CISA-KR 문제 228
조직이 외부 고객을 위한 기술 지원을 아웃소싱하기로 결정했을 때, IS 감사자는 다음 중 어떤 부분을 주요 중점 영역으로 권장해야 할까요?
정답: A
The primary area of focus when an organization decides to outsource technical support for its external customers is to align service level agreements (SLAs) with current needs. SLAs are contracts that define the scope, quality, and expectations of the services provided by the vendor, as well as the remedies or penalties for non-compliance. SLAs are essential for ensuring that the outsourced technical support meets the customer' s requirements and satisfaction, as well as the organization's objectives andstandards. By aligning SLAs with current needs, the organization can specify the key performance indicators (KPIs), metrics, and targets that reflect the desired outcomes and value of the technical support. This can also help to monitor and evaluate the vendor's performance, identify gaps or issues, and implement corrective actions or improvements.
References:
Service Level Agreement (SLA)Examples and Template
What is an SLA? Best practices for service-level agreements
References:
Service Level Agreement (SLA)Examples and Template
What is an SLA? Best practices for service-level agreements
CISA-KR 문제 229
다음 중 고도의 보안 구역에 대한 방문객 접근을 통제하는 가장 효과적인 방법은 무엇입니까?
정답: A
The most effective control over visitor access to highly secured areas is to require visitors to be escorted by authorized personnel. This control ensures that visitors are supervised at all times and do not enter any restricted or sensitive areas without permission. It also allows authorized personnel to verify the identity, purpose, and clearance of the visitors, and to monitor their behavior and activities. Escorting visitors also reduces the risk of tailgating, piggybacking, or unauthorized duplication of access credentials.
Requiring visitors to use biometric authentication, monitoring visitors online by security cameras, and requiring visitors to enter through dead-man doors are all examples of technical controls that can enhance visitor access control, but they are not as effective as escorting visitors. Biometric authentication can provide a high level of identity verification, but it does not prevent visitors from accessing unauthorized areas or compromising security in other ways. Security cameras can provide a record of visitor movements and actions, but they may not deter or detect security breaches in real time. Dead-man doors can prevent unauthorized entry by requiring two-factor authentication, but they do not ensure that visitors are accompanied by authorized personnel.
References:
ISC Best Practices for Facility Access Control1
Visitor Management Best Practices From Top Organizations2
8 Best Practices for Setting Up a Visitor Management System3
Requiring visitors to use biometric authentication, monitoring visitors online by security cameras, and requiring visitors to enter through dead-man doors are all examples of technical controls that can enhance visitor access control, but they are not as effective as escorting visitors. Biometric authentication can provide a high level of identity verification, but it does not prevent visitors from accessing unauthorized areas or compromising security in other ways. Security cameras can provide a record of visitor movements and actions, but they may not deter or detect security breaches in real time. Dead-man doors can prevent unauthorized entry by requiring two-factor authentication, but they do not ensure that visitors are accompanied by authorized personnel.
References:
ISC Best Practices for Facility Access Control1
Visitor Management Best Practices From Top Organizations2
8 Best Practices for Setting Up a Visitor Management System3
CISA-KR 문제 230
조직의 사고 관리 프로세스에서 다음 활동 중 어떤 활동을 분리해야 합니까?
정답: A
The activities that should be separated are initiating and closing error logs. This is a segregation-of-duties issue. The same person who opens an error record should not also have sole authority to close it, because that creates an opportunity to suppress incidents, conceal inadequate investigation, or bypass proper resolution and review. ISACA guidance regularly stresses the importance of segregation of duties as a foundational control principle.
Option A is correct because separating initiation from closure helps ensure independent review, proper follow- up, and accountability in the incident process. This aligns with classic CISA logic: one role records or raises the issue, while another role validates resolution and closure.
Option B is less compelling because collecting and analyzing logs are closely related operational security activities and are often performed within the same monitoring function.
Option C is also less appropriate to separate in this context because identifying root causes and recommending workarounds are naturally linked problem-management activities. ISACA guidance on root cause analysis connects these activities to incident and problem handling.
Option D is not the best answer because recording and classifying incidents are typically performed together at intake or triage. Separating them would usually add process friction without the same control benefit as separating initiation from closure.
Therefore, A is the best answer because it best reflects appropriate segregation of duties in incident handling.
References (Official ISACA):
* ISACA Journal, IS Audit Basics: Trust but Verify - highlights the importance of segregation of duties.
* ISACA Journal, Trends, Challenges and Strategies for Effective Audit in a Rapidly Changing Landscape - reinforces segregation of duties as a continuing control requirement.
* ISACA Journal, Resilient GRC: Tackling Contemporary Challenges With a Robust Delivery Model - discusses bias and segregation-of-duties concerns.
* ISACA, Root Cause Analysis / ISACA Glossary - supports the linkage between root cause analysis and incident/problem processes.
Option A is correct because separating initiation from closure helps ensure independent review, proper follow- up, and accountability in the incident process. This aligns with classic CISA logic: one role records or raises the issue, while another role validates resolution and closure.
Option B is less compelling because collecting and analyzing logs are closely related operational security activities and are often performed within the same monitoring function.
Option C is also less appropriate to separate in this context because identifying root causes and recommending workarounds are naturally linked problem-management activities. ISACA guidance on root cause analysis connects these activities to incident and problem handling.
Option D is not the best answer because recording and classifying incidents are typically performed together at intake or triage. Separating them would usually add process friction without the same control benefit as separating initiation from closure.
Therefore, A is the best answer because it best reflects appropriate segregation of duties in incident handling.
References (Official ISACA):
* ISACA Journal, IS Audit Basics: Trust but Verify - highlights the importance of segregation of duties.
* ISACA Journal, Trends, Challenges and Strategies for Effective Audit in a Rapidly Changing Landscape - reinforces segregation of duties as a continuing control requirement.
* ISACA Journal, Resilient GRC: Tackling Contemporary Challenges With a Robust Delivery Model - discusses bias and segregation-of-duties concerns.
* ISACA, Root Cause Analysis / ISACA Glossary - supports the linkage between root cause analysis and incident/problem processes.
- 다른 버전
- 1743ISACA.CISA-KR.v2026-05-06.q261
- 3091ISACA.CISA-KR.v2026-03-16.q665
- 4441ISACA.CISA-KR.v2026-03-07.q651
- 9177ISACA.CISA-KR.v2025-04-07.q633
- 4433ISACA.CISA-KR.v2025-04-03.q628
- 3633ISACA.CISA-KR.v2025-04-02.q544
- 4190ISACA.CISA-KR.v2025-03-31.q534
- 5298ISACA.CISA-KR.v2025-03-28.q617
- 3068ISACA.CISA-KR.v2025-03-19.q581
- 3954ISACA.CISA-KR.v2025-03-03.q807
- 5041ISACA.CISA-KR.v2024-02-07.q421
- 2790ISACA.CISA-KR.v2024-01-31.q392
- 5260ISACA.CISA-KR.v2023-10-24.q329
- 5159ISACA.CISA-KR.v2023-07-31.q266
- 3091ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 216Microsoft.PL-600.v2026-08-11.q206
- 153Microsoft.DP-100.v2026-08-11.q160
- 155Oracle.1Z0-1048-25.v2026-08-11.q68
- 130ISQI.CTAL-TAE.v2026-08-11.q37
- 171ServiceNow.CIS-HR.v2026-08-11.q84
- 254Salesforce.Plat-Arch-201.v2026-08-10.q101
- 240Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76
- 189F5.F5CAB2.v2026-08-10.q41
- 285APA.CPP-Remote.v2026-08-08.q109
- 149SAP.C_BCBAI_2601.v2026-08-08.q9
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-05-16.q709 모의시험 시험자료를 다운 받으세요.