CISA-KR 문제 396
소규모 조직의 데이터 분류 프로세스 및 절차를 감사하던 중, 정보 시스템 감사 담당자는 데이터가 종종 잘못된 수준으로 분류되는 것을 발견했습니다. 조직이 이러한 상황을 개선할 수 있는 가장 효과적인 방법은 무엇일까요?
정답: B
This is the most effective way for the organization to improve its data classification processes and procedures, because data owners are the ones who are responsible for assigning the appropriate level of classification to the data they create, collect, or manage. Data owners should be aware of the data classification policy, the criteria for each level of classification, and the implications of misclassification. IT security staff can provide tailored training for data owners based on their roles, functions, and types of data they handle.
The other options are not as effective as having IT security staff conduct targeted training for data owners:
Use automatic document classification based on content. This is a possible option, but it may not be feasible or accurate for a small organization. Automatic document classification is a process that uses artificial intelligence or machine learning to analyze the content of a document and assign a class label based on predefined rules or models. However, this process may require a lot of resources, expertise, and maintenance, and it may not capture all the nuances and context of the data. The IS auditor should also verify the reliability and validity of the automatic document classification system.
Publish the data classification policy on the corporate web portal. This is a good practice, but it is not enough to improve the data classification situation. Publishing the data classification policy on the corporate web portal can increase the visibility and accessibility of the policy, but it does not ensure that data owners will read, understand, and follow it. The IS auditor should also monitor and enforce the compliance with the policy.
Conduct awareness presentations and seminars for information classification policies. This is a useful measure, but it is not the most effective one. Conducting awareness presentations and seminars can raise the general awareness and knowledge of information classification policies among all employees, but it may not address the specific needs and challenges of data owners. The IS auditor should also provide more in-depth and practical training for data owners.
The other options are not as effective as having IT security staff conduct targeted training for data owners:
Use automatic document classification based on content. This is a possible option, but it may not be feasible or accurate for a small organization. Automatic document classification is a process that uses artificial intelligence or machine learning to analyze the content of a document and assign a class label based on predefined rules or models. However, this process may require a lot of resources, expertise, and maintenance, and it may not capture all the nuances and context of the data. The IS auditor should also verify the reliability and validity of the automatic document classification system.
Publish the data classification policy on the corporate web portal. This is a good practice, but it is not enough to improve the data classification situation. Publishing the data classification policy on the corporate web portal can increase the visibility and accessibility of the policy, but it does not ensure that data owners will read, understand, and follow it. The IS auditor should also monitor and enforce the compliance with the policy.
Conduct awareness presentations and seminars for information classification policies. This is a useful measure, but it is not the most effective one. Conducting awareness presentations and seminars can raise the general awareness and knowledge of information classification policies among all employees, but it may not address the specific needs and challenges of data owners. The IS auditor should also provide more in-depth and practical training for data owners.
CISA-KR 문제 397
다음 클라우드 기능 중 조직이 예상치 못한 높은 서비스 수요에 대응할 수 있도록 가장 효과적으로 지원하는 기능은 무엇입니까?
정답: B
CISA-KR 문제 398
재무 시스템의 매입채무 모듈에 대한 접근 제어를 평가하는 정보 시스템 감사자가 가장 우려해야 할 사항은 다음 중 무엇입니까?
정답: C
CISA-KR 문제 399
SQL 인젝션 취약점을 해결하는 가장 효과적인 보안 제어 방법은 무엇일까요?
정답: C
Input validation is the best control to address SQL injection vulnerabilities, because it can prevent malicious users from entering SQL commands or statements into input fields that are intended for data entry, such as usernames or passwords. SQL injection is a technique that exploits a security vulnerability in an application's software by inserting SQL code into a query string that can execute commands on a database server. Unicode translation, SSL encryption, and digital signatures are not effectivecontrols against SQL injection, because they do not prevent or detect SQL code injection into input fields. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.2
CISA-KR 문제 400
다음 중 품질보증(QA) 팀의 주요 책임은 무엇입니까?
정답: D
A quality assurance (QA) team is a group of professionals who are responsible for ensuring that the products or services of an organization meet the quality standards and expectations of customers and stakeholders1. A QA team performs various activities, such as:
Planning, designing, and executing quality tests and audits to verify the quality of the products or services1 Identifying, analyzing, and reporting quality issues, defects, or non-conformities1 Recommending and implementing corrective and preventive actions to resolve quality problems and prevent recurrence1 Monitoring and measuring the effectiveness and efficiency of the quality processes and improvements1 Establishing and maintaining quality documentation, records, and reports1 Providing quality training, guidance, and support to the staff and management1 One of the primary responsibilities of a QA team is to implement procedures to facilitate adoption of quality management best practices. Quality management best practices are the methods, techniques, or tools that have been proven to be effective in achieving and maintaining high-quality standards in an organization2. Some examples of quality management best practices are:
Adopting a customer-focused approach that aims to meet or exceed customer requirements and satisfaction2 Implementing a process approach that manages the interrelated activities as a coherent system2 Applying continuous improvement methods that seek to enhance the performance and value of the products or services2 Using evidence-based decision making that relies on factual data and information2 Developing a culture of engagement and empowerment that involves and motivates the people in the organization2 By implementing procedures to facilitate adoption of quality management best practices, a QA team can help the organization achieve the following benefits:
Improve the quality and reliability of the products or services2
Reduce the costs and risks associated with poor quality or non-compliance2 Increase the customer loyalty and retention2 Enhance the reputation and competitiveness of the organization2 Foster a culture of excellence and innovation in the organization2 The other options are not primary responsibilities of a QA team. Creating test data to facilitate the user acceptance testing (UAT) process is a task that can be performed by a QA team, but it is not their main duty. UAT is a process in which the end users test the product or service to ensure that it meets their needs and expectations before it is released or deployed3. A QA team can create test data to simulate real-world scenarios and conditions for UAT, but they are not directly involved in conducting UAT. Managing employee onboarding processes and background checks is not a responsibility of a QA team. Employee onboarding is a process in which new hires are integrated into the organization, while background checks are screenings that verify the identity, credentials, and history of potential employees4. These processes are usually handled by the human resources department or an external agency, not by a QA team. Advising the steering committee on quality management issues and remediation efforts is not a primary responsibility of a QA team. A steering committee is a group of senior executives or managers who provide strategic direction, oversight, and support for a project or program5. A QA team can advise the steering committee on quality management issues and remediation efforts, but they are not accountable for making decisions or implementing actions. Therefore, option D is the correct answer.
References:
Quality Assurance Team: Roles and Responsibilities
What are the Best Practices in Quality Management?
User Acceptance Testing (UAT): A Complete Guide
Employee Onboarding Process: Definition and Best Practices
What Is A Steering Committee? - The Basics
Planning, designing, and executing quality tests and audits to verify the quality of the products or services1 Identifying, analyzing, and reporting quality issues, defects, or non-conformities1 Recommending and implementing corrective and preventive actions to resolve quality problems and prevent recurrence1 Monitoring and measuring the effectiveness and efficiency of the quality processes and improvements1 Establishing and maintaining quality documentation, records, and reports1 Providing quality training, guidance, and support to the staff and management1 One of the primary responsibilities of a QA team is to implement procedures to facilitate adoption of quality management best practices. Quality management best practices are the methods, techniques, or tools that have been proven to be effective in achieving and maintaining high-quality standards in an organization2. Some examples of quality management best practices are:
Adopting a customer-focused approach that aims to meet or exceed customer requirements and satisfaction2 Implementing a process approach that manages the interrelated activities as a coherent system2 Applying continuous improvement methods that seek to enhance the performance and value of the products or services2 Using evidence-based decision making that relies on factual data and information2 Developing a culture of engagement and empowerment that involves and motivates the people in the organization2 By implementing procedures to facilitate adoption of quality management best practices, a QA team can help the organization achieve the following benefits:
Improve the quality and reliability of the products or services2
Reduce the costs and risks associated with poor quality or non-compliance2 Increase the customer loyalty and retention2 Enhance the reputation and competitiveness of the organization2 Foster a culture of excellence and innovation in the organization2 The other options are not primary responsibilities of a QA team. Creating test data to facilitate the user acceptance testing (UAT) process is a task that can be performed by a QA team, but it is not their main duty. UAT is a process in which the end users test the product or service to ensure that it meets their needs and expectations before it is released or deployed3. A QA team can create test data to simulate real-world scenarios and conditions for UAT, but they are not directly involved in conducting UAT. Managing employee onboarding processes and background checks is not a responsibility of a QA team. Employee onboarding is a process in which new hires are integrated into the organization, while background checks are screenings that verify the identity, credentials, and history of potential employees4. These processes are usually handled by the human resources department or an external agency, not by a QA team. Advising the steering committee on quality management issues and remediation efforts is not a primary responsibility of a QA team. A steering committee is a group of senior executives or managers who provide strategic direction, oversight, and support for a project or program5. A QA team can advise the steering committee on quality management issues and remediation efforts, but they are not accountable for making decisions or implementing actions. Therefore, option D is the correct answer.
References:
Quality Assurance Team: Roles and Responsibilities
What are the Best Practices in Quality Management?
User Acceptance Testing (UAT): A Complete Guide
Employee Onboarding Process: Definition and Best Practices
What Is A Steering Committee? - The Basics
- 다른 버전
- 303ISACA.CISA-KR.v2026-08-15.q712
- 1866ISACA.CISA-KR.v2026-05-06.q261
- 3333ISACA.CISA-KR.v2026-03-16.q665
- 4742ISACA.CISA-KR.v2026-03-07.q651
- 9445ISACA.CISA-KR.v2025-04-07.q633
- 4554ISACA.CISA-KR.v2025-04-03.q628
- 3810ISACA.CISA-KR.v2025-04-02.q544
- 4315ISACA.CISA-KR.v2025-03-31.q534
- 5525ISACA.CISA-KR.v2025-03-28.q617
- 3313ISACA.CISA-KR.v2025-03-19.q581
- 4197ISACA.CISA-KR.v2025-03-03.q807
- 5245ISACA.CISA-KR.v2024-02-07.q421
- 2921ISACA.CISA-KR.v2024-01-31.q392
- 5430ISACA.CISA-KR.v2023-10-24.q329
- 5260ISACA.CISA-KR.v2023-07-31.q266
- 3259ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 126Microsoft.AZ-305-KR.v2026-08-17.q162
- 140IIA.IAA-IAP-KR.v2026-08-17.q41
- 303ISACA.CISA-KR.v2026-08-15.q712
- 238Microsoft.MS-700-KR.v2026-08-15.q203
- 173Microsoft.AZ-305-KR.v2026-08-14.q177
- 238Microsoft.DP-900-KR.v2026-08-13.q130
- 315Microsoft.PL-600.v2026-08-11.q206
- 267Microsoft.DP-100.v2026-08-11.q160
- 209Oracle.1Z0-1048-25.v2026-08-11.q68
- 177ISQI.CTAL-TAE.v2026-08-11.q37
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-05-16.q709 모의시험 시험자료를 다운 받으세요.