CISA-KR 문제 451
재해 복구 전략을 검토하는 과정에서 IT 관리팀은 빠른 복구 시점 목표(RPO)가 필요한 애플리케이션을 확인했습니다. 다음 중 조직이 이 목표를 달성하는 데 가장 적합한 데이터 복구 전략은 무엇일까요?
정답: B
Mirroring (Option B) is the best choice for applications requiring a short Recovery Point Objective (RPO) because it provides real-time replication of data, ensuring minimal data loss.
ISACA CISA Reference: Data replication strategies in disaster recovery planning emphasize mirroring for high-availability systems.
Risk Implication: If mirroring is not implemented for critical systems, significant data loss may occur in the event of a failure.
Alternative Choices:
Option A: Snapshots capture data at specific points in time, leading to potential data loss.
Option C: Log shipping has delays due to batch processing.
Option D: Backups are periodic and not suitable for short RPO needs.
ISACA CISA Reference: Data replication strategies in disaster recovery planning emphasize mirroring for high-availability systems.
Risk Implication: If mirroring is not implemented for critical systems, significant data loss may occur in the event of a failure.
Alternative Choices:
Option A: Snapshots capture data at specific points in time, leading to potential data loss.
Option C: Log shipping has delays due to batch processing.
Option D: Backups are periodic and not suitable for short RPO needs.
CISA-KR 문제 452
한 조직의 고위 경영진은 현재의 보안 통제가 과도하다고 판단하여 정보 시스템(IS) 감사자에게 현행 조치의 적절성을 평가하는 방법에 대한 자문을 요청했습니다. 감사자가 경영진에게 제시할 수 있는 최선의 권고 사항은 무엇일까요?
정답: D
A risk and control framework is a set of principles, processes, and tools that guide an organization in identifying, assessing, managing, and monitoring the risks and controls that affect its objectives and performance. A risk and control framework helps an organization to align its risk appetite and tolerance with its strategy, culture, and values, and to ensure that its security controls are appropriate, effective, and efficient1.
Re-evaluating the organization's risk and control framework is the best recommendation to management because it can help them to:
Review the current risk environment and the sources, causes, and impacts of potential threats and vulnerabilities.
Update the risk assessment and analysis methods and criteria, such as likelihood, impact, severity, and priority.
Reconsider the risk response and treatment options, such as avoidance, reduction, transfer, or acceptance.
Realign the security controls with the risk profile and the business needs and expectations.
Evaluate the performance and effectiveness of the security controls using key indicators and metrics.
Identify the gaps, weaknesses, or inefficiencies in the security controls and implement corrective or improvement actions.
Communicate and report the risk and control status and results to relevant stakeholders.
Re-evaluating the organization's risk and control framework can help management to determine whether the current security controls are excessive or not, and to make informed and rational decisions on how to adjust them accordingly.
Re-evaluating the organization's risk and control framework is the best recommendation to management because it can help them to:
Review the current risk environment and the sources, causes, and impacts of potential threats and vulnerabilities.
Update the risk assessment and analysis methods and criteria, such as likelihood, impact, severity, and priority.
Reconsider the risk response and treatment options, such as avoidance, reduction, transfer, or acceptance.
Realign the security controls with the risk profile and the business needs and expectations.
Evaluate the performance and effectiveness of the security controls using key indicators and metrics.
Identify the gaps, weaknesses, or inefficiencies in the security controls and implement corrective or improvement actions.
Communicate and report the risk and control status and results to relevant stakeholders.
Re-evaluating the organization's risk and control framework can help management to determine whether the current security controls are excessive or not, and to make informed and rational decisions on how to adjust them accordingly.
CISA-KR 문제 453
다음 중 어떤 것을 사용하면 프로세스 개선 프로그램을 가장 효과적으로 향상시킬 수 있을까요?
정답: C
Capability maturity models (CMMs) are frameworks that help organizations assess and improve their processes in various domains, such as software development, project management, service delivery, and cybersecurity1. CMMs define different levels of process maturity, from initial to optimized, and describe the characteristics and best practices of each level. By using CMMs, organizations can benchmark their current processes against a common standard, identify gaps and weaknesses, and implement improvement actions to achieve higher levels of process maturity2. CMMs can also help organizations align their processes with their strategic goals, measure their performance, and increase their efficiency, quality, and customer satisfaction3.
Therefore, the use of CMMs would best enhance a process improvement program, as they provide a systematic and structured approach to evaluate and improve processes based on proven principles and practices. Option C is the correct answer.
Option A is not correct because model-based design notations are graphical or textual languages that help designers specify, visualize, and document the structure and behavior of systems4. While they can be useful for designing and communicating complex systems, they do not directly address the process improvement aspect of a program.
Option B is not correct because balanced scorecard is a strategic management tool that helps organizations translate their vision and mission into measurable objectives and indicators. While it can be useful for monitoring and evaluating the performance of a program, it does not provide specific guidance on how to improve processes.
Option D is not correct because project management methodologies are sets of principles and practices that help organizations plan, execute, and control projects. While they can be useful for managing the scope, schedule, cost, quality, and risk of a program, they do not focus on the process improvement aspect of a program.
References:
Guide to Process Maturity Models2
What is CMMI? A model for optimizing development processes1
Capability Maturity Model (CMM): A Definitive Guide3
Model-Based Design Notations4
Balanced Scorecard
Project Management Methodologies
Therefore, the use of CMMs would best enhance a process improvement program, as they provide a systematic and structured approach to evaluate and improve processes based on proven principles and practices. Option C is the correct answer.
Option A is not correct because model-based design notations are graphical or textual languages that help designers specify, visualize, and document the structure and behavior of systems4. While they can be useful for designing and communicating complex systems, they do not directly address the process improvement aspect of a program.
Option B is not correct because balanced scorecard is a strategic management tool that helps organizations translate their vision and mission into measurable objectives and indicators. While it can be useful for monitoring and evaluating the performance of a program, it does not provide specific guidance on how to improve processes.
Option D is not correct because project management methodologies are sets of principles and practices that help organizations plan, execute, and control projects. While they can be useful for managing the scope, schedule, cost, quality, and risk of a program, they do not focus on the process improvement aspect of a program.
References:
Guide to Process Maturity Models2
What is CMMI? A model for optimizing development processes1
Capability Maturity Model (CMM): A Definitive Guide3
Model-Based Design Notations4
Balanced Scorecard
Project Management Methodologies
CISA-KR 문제 454
소프트웨어의 숨겨진 오류를 찾아내고 소스 코드 최적화를 촉진하는 데 가장 효율적인 보안 테스트 유형은 무엇입니까?
정답: C
White box testingis the most effective foridentifying hidden errorsand optimizingsource code quality.
Option A (Incorrect):UAT focuses on functionalityfrom anend-user perspective, not source code errors.
Option B (Incorrect):Black box testingexamines software behaviorwithout reviewing code, making it less effective for code-level optimization.
Option C (Correct):White box testing(also known asclear box or structural testing)analyzes source codefor vulnerabilities, logic errors, and optimization opportunities.
Option D (Incorrect):Penetration testingidentifiessecurity weaknesses, but it does notfocus on code efficiency.
Reference:ISACA CISA Review Manual -Domain 3: Information Systems Acquisition, Development, and Implementation- Coverssoftware testing methodologies and secure coding practices.
Option A (Incorrect):UAT focuses on functionalityfrom anend-user perspective, not source code errors.
Option B (Incorrect):Black box testingexamines software behaviorwithout reviewing code, making it less effective for code-level optimization.
Option C (Correct):White box testing(also known asclear box or structural testing)analyzes source codefor vulnerabilities, logic errors, and optimization opportunities.
Option D (Incorrect):Penetration testingidentifiessecurity weaknesses, but it does notfocus on code efficiency.
Reference:ISACA CISA Review Manual -Domain 3: Information Systems Acquisition, Development, and Implementation- Coverssoftware testing methodologies and secure coding practices.
CISA-KR 문제 455
직원들의 출입 제한 구역 접근을 제한하기 위해 카드식 출입 시스템을 사용하는 경우, 어떤 추가적인 통제 조치를 시행해야 합니까?
정답: C
Periodic review of access profiles by management is an additional control that is required when using swipe cards to limit employee access to restricted areas. Swipe cards are a type of physical access control that use magnetic stripes or radio frequency identification (RFID) to store and transmit information about the cardholder's identity and access rights. Swipe cards can help to prevent unauthorized entry, protect sensitive assets and data, and monitor access activity. However, swipe cards alone are not enough to ensure effective access control. They need to be complemented by other controls, such as:
Periodic review of access profiles by management: This is a type of logical access control that involves verifying that the access rights assigned to each cardholder are appropriate, necessary, and consistent with the organization's policies and procedures. Periodic review of access profiles can help to detect and correct any errors, inconsistencies, or violations in the access control system, such as outdated, excessive, or redundant access rights, segregation of duties conflicts, or unauthorized changes. Periodic review of access profiles can also help to ensure compliance with internal and external audit requirements and regulations.
Implementation of additional PIN pads: This is a type of multi-factor authentication (MFA) that requires the cardholder to enter a personal identification number (PIN) in addition to swiping their card. MFA can enhance the security of the access control system by adding another layer of verificationand reducing the risk of lost, stolen, or cloned cards being used by unauthorized persons.
Installation of closed-circuit television (CCTV): This is a type of surveillance system that uses cameras and monitors to record and display the images of the people and activities in the restricted areas. CCTV can deter potential intruders, provide evidence of any security incidents or breaches, and enable real-time monitoring and response by security personnel.
The other options are not as effective or relevant as periodic review of access profiles by management for an additional control when using swipe cards. Physical sign-in of all employees for access to restricted areas is a redundant and inefficient control that can be easily bypassed or manipulated. It also does not provide any assurance or verification of the identity or access rights of the cardholders. Audit hooks are software routines embedded in an application that can trigger an alert or a report when certain conditions are met. Audit hooks can help to detect anomalies or exceptions in access control lists, but they do not provide a comprehensive or integrated view of them.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 236
ISACA, ITAF: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition, 2014, p. 88 Data Analytics for Auditing Access Control
Periodic review of access profiles by management: This is a type of logical access control that involves verifying that the access rights assigned to each cardholder are appropriate, necessary, and consistent with the organization's policies and procedures. Periodic review of access profiles can help to detect and correct any errors, inconsistencies, or violations in the access control system, such as outdated, excessive, or redundant access rights, segregation of duties conflicts, or unauthorized changes. Periodic review of access profiles can also help to ensure compliance with internal and external audit requirements and regulations.
Implementation of additional PIN pads: This is a type of multi-factor authentication (MFA) that requires the cardholder to enter a personal identification number (PIN) in addition to swiping their card. MFA can enhance the security of the access control system by adding another layer of verificationand reducing the risk of lost, stolen, or cloned cards being used by unauthorized persons.
Installation of closed-circuit television (CCTV): This is a type of surveillance system that uses cameras and monitors to record and display the images of the people and activities in the restricted areas. CCTV can deter potential intruders, provide evidence of any security incidents or breaches, and enable real-time monitoring and response by security personnel.
The other options are not as effective or relevant as periodic review of access profiles by management for an additional control when using swipe cards. Physical sign-in of all employees for access to restricted areas is a redundant and inefficient control that can be easily bypassed or manipulated. It also does not provide any assurance or verification of the identity or access rights of the cardholders. Audit hooks are software routines embedded in an application that can trigger an alert or a report when certain conditions are met. Audit hooks can help to detect anomalies or exceptions in access control lists, but they do not provide a comprehensive or integrated view of them.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 236
ISACA, ITAF: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition, 2014, p. 88 Data Analytics for Auditing Access Control
- 다른 버전
- 223ISACA.CISA-KR.v2026-08-15.q712
- 1825ISACA.CISA-KR.v2026-05-06.q261
- 3191ISACA.CISA-KR.v2026-03-16.q665
- 4628ISACA.CISA-KR.v2026-03-07.q651
- 9340ISACA.CISA-KR.v2025-04-07.q633
- 4491ISACA.CISA-KR.v2025-04-03.q628
- 3734ISACA.CISA-KR.v2025-04-02.q544
- 4276ISACA.CISA-KR.v2025-03-31.q534
- 5426ISACA.CISA-KR.v2025-03-28.q617
- 3254ISACA.CISA-KR.v2025-03-19.q581
- 4058ISACA.CISA-KR.v2025-03-03.q807
- 5218ISACA.CISA-KR.v2024-02-07.q421
- 2871ISACA.CISA-KR.v2024-01-31.q392
- 5389ISACA.CISA-KR.v2023-10-24.q329
- 5230ISACA.CISA-KR.v2023-07-31.q266
- 3229ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 223ISACA.CISA-KR.v2026-08-15.q712
- 165Microsoft.MS-700-KR.v2026-08-15.q203
- 130Microsoft.AZ-305-KR.v2026-08-14.q177
- 190Microsoft.DP-900-KR.v2026-08-13.q130
- 289Microsoft.PL-600.v2026-08-11.q206
- 219Microsoft.DP-100.v2026-08-11.q160
- 188Oracle.1Z0-1048-25.v2026-08-11.q68
- 159ISQI.CTAL-TAE.v2026-08-11.q37
- 200ServiceNow.CIS-HR.v2026-08-11.q84
- 281Salesforce.Plat-Arch-201.v2026-08-10.q101
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-05-16.q709 모의시험 시험자료를 다운 받으세요.