무료 온라인 액세스 ISACA.CISA-KR.v2026-05-16.q709 모의 시험 (Page 5)

CISA-KR 문제 16

대규모 조직의 정보 시스템 거버넌스를 평가할 때 정보 시스템 감사자는 다음 중 무엇을 검토해야 합니까?

A. 신규 시스템 구현에 대한 승인 절차

B. 송장 처리 시스템에 새 사용자를 추가하는 절차

C. 회사 웹사이트 업데이트 승인 절차

D. 시스템 변경 사항에 대한 회귀 테스트 절차

정답: A

Information systems governance is the set of policies, processes, structures, and practices that ensure the alignment of IT with business objectives, the delivery of value from IT investments, the management of IT risks, and the optimization of IT resources1. Information systems governance is a strategic and high-level function that covers the entire organization and its IT portfolio. Therefore, an IS auditor should review the aspects of information systems governance that are relevant to the organization's vision, mission, goals, and strategies.
One of the aspects that an IS auditor should review when evaluating information systems governance for a large organization is the approval processes for new system implementations. This is because new system implementations are significant IT investments that require careful planning, analysis, design,development, testing, deployment, and evaluation to ensure that they meet the business requirements, deliver the expected benefits, comply with the relevant standards and regulations, and minimize the potential risks2. The approval processes fornew system implementations should involve the appropriate stakeholders, such as senior management, business owners, IT managers,project managers, users, and auditors, who have the authority and responsibility to approve or reject the proposed system implementations based on predefined criteria and metrics3. The approval processes for new system implementations should also be documented, transparent, consisten t, and timely to ensure accountability and traceability4. Therefore, an IS auditor should review the approval processes for new system implementations to assess whether they are aligned with the information systems governance framework and objectives.
The other possible options are:
Procedures for adding a new user to the invoice processing system: This is an operational task that involves granting access rights and permissions to a specific user for a specific system based on the principle of least privilege. This is not a strategic or high-level function that falls under information systems governance.
Therefore, an IS auditor should not review this aspect when evaluating information systems governance for a large organization.
Approval processes for updating the corporate website: This is a tactical task that involves making changes or enhancements to the content or design of the corporate website based on the business needs and feedback.
This is not a strategic or high-level function that falls under information systems governance. Therefore, an IS auditor should not review this aspect when evaluating information systems governance for a large organization.
Procedures for regression testing system changes: This is a technical task that involves verifying that existing system functionalities are not adversely affected by new system changes or updates. This is not a strategic or high-level function that falls under information systems governance. Therefore, an IS auditor should not review this aspect when evaluating information systems governance for a large organization. References: 1:
What is IT Governance? - Definition from Techopedia 2: System Implementation - an overview | ScienceDirect Topics 3: Project Approval Process - Project Management Knowledge 4: 5 Best Practices For A Successful Project Approval Process | Kissflow Project : Principle of Least Privilege (POLP) | Imperva :
How to Update Your Website Content - 7 Step Guide | HostGator Blog : What Is Regression Testing?
Definition and Best Practices | BrowserStack

CISA-KR 문제 17

다음 기술 중 광범위한 네트워크 공격의 위험을 가장 효과적으로 완화하는 기술은 무엇입니까?

A. 구성 평가

B. 암호화

C. 분할

D. 비무장지대(DMZ)

CISA-KR 문제 18

용량 관리의 주요 목표는 다음과 같습니다.

A. 시스템 유휴 시간을 최소화하여 비용을 최적화합니다.

B. 조직 전체의 데이터 저장 요구 사항을 최소화합니다.

C. 비즈니스 요구사항을 충족하는 데 필요한 IT 리소스를 제공합니다.

D. IT 팀에 충분한 인력이 있는지 확인하십시오.

CISA-KR 문제 19

다음 중 악의적인 내부자에 의한 민감한 데이터 유출을 식별하는 가장 효과적인 방법은 무엇입니까?

A. 데이터 손실 방지(DLP) 소프트웨어를 구현합니다.

B. 경계 방화벽 로그를 검토하세요

C. 지속적인 정보 보안 인식 교육을 제공합니다.

D. 행동 분석 모니터링 구축

정답: D

The most effective way to identify exfiltration of sensitive data by a malicious insider is to establish behavioral analytics monitoring. Behavioral analytics is the process of analyzing the patterns and anomalies in user behavior to detect and prevent insider threats. Behavioral analytics can help identify unusual or suspicious activities, such as accessing sensitive data at odd hours, transferring large amounts of data to external devices or locations, or using unauthorized applications or protocols. Behavioral analytics can also help correlate data from multiple sources, such as network logs, user profiles, and access rights, to provide a holistic view of user activity and risk.
Data loss prevention (DLP) software is a tool that can help prevent exfiltration of sensitive data by a malicious insider, but it is not the most effective way to identify it. DLP software can block or alert on unauthorized data transfers based on predefined rules and policies, but it may not be able to detect sophisticated or stealthy exfiltration techniques, such as encryption, steganography, or data obfuscation.
Reviewing perimeter firewall logs is a way to identify exfiltration of sensitive data by a malicious insider, but it is not the most effective way. Perimeter firewall logs can show the traffic volume and destination of data transfers, but they may not be able to show the content or context of the data. Perimeter firewall logs may also be overwhelmed by the amount of normal traffic and miss the signals of malicious exfiltration.
Providing ongoing information security awareness training is a way to reduce the risk of exfiltration of sensitive data by a malicious insider, but it is not a way to identify it. Information security awareness training can help educate users on the importance of protecting sensitive data and the consequences of violating policies and regulations, but it may not deter or detect those who are intentionally or maliciously exfiltrating data.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 300
ISACA, CISA Review Questions, Answers and Explanations Database - 12 Month Subscription 1 Cybersecurity Engineering for Legacy Systems: 6 Recommendations - SEI Blog 2 How to Secure Your Company'sLegacy Applications - iCorps

CISA-KR 문제 20

다음 중 항공사의 IT 관리팀이 중요한 통합 항공편 스케줄 및 결제 애플리케이션의 제어 기능을 지속적으로 모니터링해야 하는 주된 이유는 무엇입니까?

A. 정책 및 절차가 준수되도록 보장하기 위해

B. 잠재적인 공격을 감지하고 대응하기 위해

C. 항공편 예약 결제가 처리되도록 하기 위해

D. 위험을 효과적으로 식별하고 완화하기 위해

다른 버전: 1795ISACA.CISA-KR.v2026-05-06.q261; 3117ISACA.CISA-KR.v2026-03-16.q665; 4484ISACA.CISA-KR.v2026-03-07.q651; 9204ISACA.CISA-KR.v2025-04-07.q633; 4445ISACA.CISA-KR.v2025-04-03.q628; 3659ISACA.CISA-KR.v2025-04-02.q544; 4216ISACA.CISA-KR.v2025-03-31.q534; 5320ISACA.CISA-KR.v2025-03-28.q617; 3148ISACA.CISA-KR.v2025-03-19.q581; 3970ISACA.CISA-KR.v2025-03-03.q807; 5133ISACA.CISA-KR.v2024-02-07.q421; 2797ISACA.CISA-KR.v2024-01-31.q392; 5263ISACA.CISA-KR.v2023-10-24.q329; 5212ISACA.CISA-KR.v2023-07-31.q266; 3100ISACA.CISA-KR.v2023-06-23.q324

최근 업로드: 152Microsoft.DP-900-KR.v2026-08-13.q130; 244Microsoft.PL-600.v2026-08-11.q206; 183Microsoft.DP-100.v2026-08-11.q160; 177Oracle.1Z0-1048-25.v2026-08-11.q68; 145ISQI.CTAL-TAE.v2026-08-11.q37; 195ServiceNow.CIS-HR.v2026-08-11.q84; 258Salesforce.Plat-Arch-201.v2026-08-10.q101; 244Databricks.Databricks-Machine-Learning-Professional.v2026-08-10.q76; 192F5.F5CAB2.v2026-08-10.q41; 299APA.CPP-Remote.v2026-08-08.q109