CISA-KR 문제 26
정보 시스템 감사 담당자가 최근 발생한 보안 사고를 조사한 결과, 사고 대응이 미흡했음을 발견했습니다.
다음 중 어떤 결과를 가장 중요하게 고려해야 할까요?
다음 중 어떤 결과를 가장 중요하게 고려해야 할까요?
정답: A
The most critical finding for an IS auditor following up on a recent security incident is that the security weakness facilitating the attack was not identified. This finding indicates that the root cause of the incident was not analyzed, and the vulnerability that allowed the attack to succeed was not remediated. This means that the organization is still exposed to the same or similar attacks in the future, and its security posture has not improved. Identifying and addressing the security weakness is a key step in the incident response process, as it helps to prevent recurrence, mitigate impact, and improve resilience.
The other findings are not as critical as the failure to identify the security weakness, but they are still important issues that should be addressed by the organization. The attack was not automatically blocked by the intrusion detection system (IDS) is a finding that suggests that the IDS was not configured properly, or that it did not have the latest signatures or rules to detect and prevent the attack. The attack could not be traced back to the originating person is a finding that implies that the organization did not have sufficient logging, monitoring, or forensic capabilities to identify and attribute the attacker. Appropriate response documentation was not maintained is a finding that indicates that the organization did not follow a consistent and formal incident response procedure, or that it did not document its actions, decisions, and lessons learned from the incident.
References:
ISACA CISA Review Manual 27th Edition (2019), page 254
Incident Response Process - ISACA1
Incident Response: How to Identify and Fix Security Weaknesses
The other findings are not as critical as the failure to identify the security weakness, but they are still important issues that should be addressed by the organization. The attack was not automatically blocked by the intrusion detection system (IDS) is a finding that suggests that the IDS was not configured properly, or that it did not have the latest signatures or rules to detect and prevent the attack. The attack could not be traced back to the originating person is a finding that implies that the organization did not have sufficient logging, monitoring, or forensic capabilities to identify and attribute the attacker. Appropriate response documentation was not maintained is a finding that indicates that the organization did not follow a consistent and formal incident response procedure, or that it did not document its actions, decisions, and lessons learned from the incident.
References:
ISACA CISA Review Manual 27th Edition (2019), page 254
Incident Response Process - ISACA1
Incident Response: How to Identify and Fix Security Weaknesses
CISA-KR 문제 27
다음 중 전자 매체에 저장된 민감한 데이터를 파기하는 가장 효과적인 방법은 무엇입니까?
정답: C
The most effective method of destroying sensitive data stored on electronic media is physical destruction, which involves breaking, shredding, melting, or incinerating the media to make it unreadable and unrecoverable. Degaussing, random character overwrite, and low-level formatting are methods of sanitizing or erasing data from electronic media, but they do not guarantee complete destruction of data and may leave some traces that can be recovered by advanced techniques. Therefore, physical destruction is the most secure and reliable method of data disposal for sensitive data. References: CISA Review Manual (Digital Version), Chapter 5: Protection of Information Assets, Section 5.4: Data Disposal
CISA-KR 문제 28
정보 시스템 감사자가 특정 업무를 수행하는 직원에 대한 감독 권한을 가진 사람이 누구인지 확인하기 위해 조직의 RACI 차트를 참조하고 있습니다. 차트 내에서 다음 중 어떤 역할이 이 정보를 제공할까요?
정답: D
The role within the RACI chart that would provide information on who has oversight of staff performing a specific task is accountable. A RACI chart is a matrix that defines and assigns the roles and responsibilities of different stakeholders for a project, process, or activity. RACI stands for responsible, accountable, consulted, and informed. Accountable is the role that has the authority and oversight to approve or reject the work done by the responsible role. The other options are not the roles that provide information on who has oversight of staff performing a specific task, as they have different meanings and functions. Consulted is the role that provides input or advice to the responsible or accountable roles. Informed is the role that receives updates or reports from the responsible or accountable roles. Responsible is the role that performs or executes the work or task. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.3
CISA-KR 문제 29
다음 중 IT와 비즈니스 목표 간의 일치를 위한 IT 프레임워크를 구현함으로써 가장 효과적으로 해결할 수 있는 문제는 무엇입니까?
정답: D
An IT framework for alignment between IT and business objectives is a set of principles, guidelines, and practices that help an organization to ensure that its IT investments support its strategic goals, deliver value, manage risks, and optimize resources. One of the benefits of implementing such a framework is that it enables an effective IT portfolio management, which is the process of selecting, prioritizing, monitoring, and evaluating the IT projects and services that comprise the IT portfolio. An IT portfolio is a collection of IT assets, such as applications, infrastructure, data, and capabilities, that are aligned with the business needs and objectives. An IT portfolio management helps an organization to achieve the following outcomes:
Align the IT portfolio with the business strategy and vision
Balance the IT portfolio among different types of investments, such as innovation, growth, maintenance, and compliance Optimize the IT portfolio performance, value, and risk Enhance the IT portfolio decision-making and governance Improve the IT portfolio communication and transparency Therefore, an inadequate IT portfolio management is a major concern that can be addressed by implementing an IT framework for alignment between IT and business objectives. An inadequate IT portfolio management can result in the following issues:
Misalignment of the IT portfolio with the business needs and expectations Imbalance of the IT portfolio among competing demands and priorities Suboptimal use of the IT resources and capabilities Lack of visibility and accountability of the IT portfolio outcomes and impacts Poor communication and collaboration among the IT portfolio stakeholders The other possible options are:
Inaccurate business impact analysis (BIA): A BIA is a process of identifying and assessing the potential effects of a disruption or disaster on the critical business functions and processes. A BIA helps an organization to determine the recovery priorities, objectives, and strategies for its business continuity plan. A BIA is not directly related to an IT framework for alignment between IT and business objectives, although it may use some inputs from the IT portfolio management. Therefore, an inaccurate BIA is not a concern that can be effectively addressed by implementing an IT framework for alignment between IT and business objectives.
Inadequate IT change management practices: IT change management is a process of controlling and managing the changes to the IT environment, such as hardware, software, configuration, or documentation. IT change management helps an organization to minimize the risks and disruptions caused by the changes, ensure the quality and consistency of the changes, and align the changes with the business requirements. IT change management is not directly related to an IT framework for alignment between IT and business objectives, although it may support some aspects of the IT portfolio management. Therefore, inadequate IT change management practices are not a concern that can be effectively addressed by implementing an IT framework for alignment between IT and business objectives.
Lack of a benchmark analysis: A benchmark analysis is a process of comparing an organization's performance, processes, or practices with those of other organizations or industry standards. A benchmark analysis helps an organization to identify its strengths and weaknesses, set realistic goals and targets, and implement best practices for improvement. A benchmark analysis is not directly related to an IT framework for alignment between IT and business objectives, although it may provide some insights for the IT portfolio management. Therefore, lack of a benchmark analysis is not a concern that can be effectively addressed by implementing an IT framework for alignment between IT and business objectives. References: 1: What is Portfolio Management? | Smartsheet 2: What Is Portfolio Management? - Definition from Techopedia 3:
What Is Project Portfolio Management (PPM)? |ProjectManager.com 4: What Is Business Impact Analysis? | Smartsheet 5: What Is Change Management? - Definition from Techopedia 6: Benchmarking - Wikipedia
Align the IT portfolio with the business strategy and vision
Balance the IT portfolio among different types of investments, such as innovation, growth, maintenance, and compliance Optimize the IT portfolio performance, value, and risk Enhance the IT portfolio decision-making and governance Improve the IT portfolio communication and transparency Therefore, an inadequate IT portfolio management is a major concern that can be addressed by implementing an IT framework for alignment between IT and business objectives. An inadequate IT portfolio management can result in the following issues:
Misalignment of the IT portfolio with the business needs and expectations Imbalance of the IT portfolio among competing demands and priorities Suboptimal use of the IT resources and capabilities Lack of visibility and accountability of the IT portfolio outcomes and impacts Poor communication and collaboration among the IT portfolio stakeholders The other possible options are:
Inaccurate business impact analysis (BIA): A BIA is a process of identifying and assessing the potential effects of a disruption or disaster on the critical business functions and processes. A BIA helps an organization to determine the recovery priorities, objectives, and strategies for its business continuity plan. A BIA is not directly related to an IT framework for alignment between IT and business objectives, although it may use some inputs from the IT portfolio management. Therefore, an inaccurate BIA is not a concern that can be effectively addressed by implementing an IT framework for alignment between IT and business objectives.
Inadequate IT change management practices: IT change management is a process of controlling and managing the changes to the IT environment, such as hardware, software, configuration, or documentation. IT change management helps an organization to minimize the risks and disruptions caused by the changes, ensure the quality and consistency of the changes, and align the changes with the business requirements. IT change management is not directly related to an IT framework for alignment between IT and business objectives, although it may support some aspects of the IT portfolio management. Therefore, inadequate IT change management practices are not a concern that can be effectively addressed by implementing an IT framework for alignment between IT and business objectives.
Lack of a benchmark analysis: A benchmark analysis is a process of comparing an organization's performance, processes, or practices with those of other organizations or industry standards. A benchmark analysis helps an organization to identify its strengths and weaknesses, set realistic goals and targets, and implement best practices for improvement. A benchmark analysis is not directly related to an IT framework for alignment between IT and business objectives, although it may provide some insights for the IT portfolio management. Therefore, lack of a benchmark analysis is not a concern that can be effectively addressed by implementing an IT framework for alignment between IT and business objectives. References: 1: What is Portfolio Management? | Smartsheet 2: What Is Portfolio Management? - Definition from Techopedia 3:
What Is Project Portfolio Management (PPM)? |ProjectManager.com 4: What Is Business Impact Analysis? | Smartsheet 5: What Is Change Management? - Definition from Techopedia 6: Benchmarking - Wikipedia
CISA-KR 문제 30
감사 결과를 관련 조치 계획, 담당자 및 목표 날짜와 함께 보고하도록 요구하는 감사 방식의 주요 이점은 무엇입니까?
정답: C
The primary benefit of an audit approach that requires reported findings to be issued together with related action plans, owners, and target dates is that it establishes accountability for the action plans. Accountability means that the individuals or groups who are responsible for implementing the action plans are clearly identified and held liable for their completion within the specified time frame. Accountability also implies that the action plans are monitored and evaluated to ensure that they are effective and efficient in addressing the audit findings and mitigating the associated risks1. Accountability helps to ensure that the audit recommendations are taken seriously and implemented properly, and that the audit value is realized by the organization2. The other options are less relevant or incorrect because:
A). It facilitates easier audit follow-up is not the primary benefit of an audit approach that requires reported findings to be issued together with related action plans, owners, and target dates, as it is more of a secondary or indirect benefit. Auditfollow-up is the process of verifying whether the action plans have been implemented and whether they have resolved the audit findings3. While having clear action plans, owners, and target dates may facilitate easier audit follow-up by providing a basis for tracking and reporting the progress and status of the action plans, it does not necessarily guarantee that the action plans will be implemented or effective.
B). It enforces action plan consensus between auditors and auditees is not the primary benefit of an audit approach that requires reported findings to be issued together with related action plans, owners, and target dates, as it is more of a prerequisite or condition for such an approach. Action plan consensus means that the auditors and auditees agree on the audit findings and recommendations, and on the action plans to address them4. While having action plan consensus may enhance the credibility and acceptance of the audit approach, it does not necessarily ensure that the action plans will be implemented or effective.
D). It helps to ensure factual accuracy of findings is not the primary benefit of an audit approach that requires reported findings to be issued together with related action plans, owners, and target dates, as it is more of an outcome or result of such an approach. Factual accuracy of findings means that theaudit findings are based on sufficient, reliable, relevant, and useful evidence5. While having factual accuracy of findings may increase the confidence and trust in the audit approach, it does not necessarily ensure that the action plans will be implemented or effective. References: Accountability - ISACA, Audit Value - ISACA, Audit Follow-up - ISACA, Action Plan Consensus - ISACA, Factual Accuracy of Findings - ISACA
A). It facilitates easier audit follow-up is not the primary benefit of an audit approach that requires reported findings to be issued together with related action plans, owners, and target dates, as it is more of a secondary or indirect benefit. Auditfollow-up is the process of verifying whether the action plans have been implemented and whether they have resolved the audit findings3. While having clear action plans, owners, and target dates may facilitate easier audit follow-up by providing a basis for tracking and reporting the progress and status of the action plans, it does not necessarily guarantee that the action plans will be implemented or effective.
B). It enforces action plan consensus between auditors and auditees is not the primary benefit of an audit approach that requires reported findings to be issued together with related action plans, owners, and target dates, as it is more of a prerequisite or condition for such an approach. Action plan consensus means that the auditors and auditees agree on the audit findings and recommendations, and on the action plans to address them4. While having action plan consensus may enhance the credibility and acceptance of the audit approach, it does not necessarily ensure that the action plans will be implemented or effective.
D). It helps to ensure factual accuracy of findings is not the primary benefit of an audit approach that requires reported findings to be issued together with related action plans, owners, and target dates, as it is more of an outcome or result of such an approach. Factual accuracy of findings means that theaudit findings are based on sufficient, reliable, relevant, and useful evidence5. While having factual accuracy of findings may increase the confidence and trust in the audit approach, it does not necessarily ensure that the action plans will be implemented or effective. References: Accountability - ISACA, Audit Value - ISACA, Audit Follow-up - ISACA, Action Plan Consensus - ISACA, Factual Accuracy of Findings - ISACA
- 다른 버전
- 2293ISACA.CISA-KR.v2026-08-27.q676
- 4331ISACA.CISA-KR.v2026-08-15.q712
- 2711ISACA.CISA-KR.v2026-05-06.q261
- 4580ISACA.CISA-KR.v2026-03-16.q665
- 6539ISACA.CISA-KR.v2026-03-07.q651
- 10975ISACA.CISA-KR.v2025-04-07.q633
- 5657ISACA.CISA-KR.v2025-04-03.q628
- 4717ISACA.CISA-KR.v2025-04-02.q544
- 5260ISACA.CISA-KR.v2025-03-31.q534
- 6641ISACA.CISA-KR.v2025-03-28.q617
- 4264ISACA.CISA-KR.v2025-03-19.q581
- 5394ISACA.CISA-KR.v2025-03-03.q807
- 5982ISACA.CISA-KR.v2024-02-07.q421
- 3601ISACA.CISA-KR.v2024-01-31.q392
- 5915ISACA.CISA-KR.v2023-10-24.q329
- 5707ISACA.CISA-KR.v2023-07-31.q266
- 3780ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 171PaloAltoNetworks.XSIAM-Analyst.v2026-10-15.q75
- 171Splunk.SPLK-1002.v2026-10-15.q187
- 130Workday.Workday-Adaptive-Planning.v2026-10-15.q23
- 139AIChE.CCPSC.v2026-10-15.q37
- 202API.API-571.v2026-10-15.q131
- 128Microsoft.AB-210.v2026-10-14.q58
- 127Huawei.H12-893_V1.0.v2026-10-14.q46
- 164UiPath.UiPath-ADPv1.v2026-10-14.q114
- 184Salesforce.MCE-Dev-201.v2026-10-14.q64
- 139PMI.PMI-RMP.v2026-10-14.q125
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-05-16.q709 모의시험 시험자료를 다운 받으세요.