CISA-KR 문제 21
CISA-KR 문제 22
Option A is correct because segmentation limits concentration risk. Instead of keeping all customer data in one broadly exposed logical store, segmentation helps confine access and reduce how many records a single compromise can reach. This directly supports limiting breach impact and, in this case, potential liability tied to the number of affected individuals. This conclusion is an inference from ISACA's risk-reduction principles around isolation, exposure control, and documenting exposure.
Option B is incorrect because database normalization improves data structure and reduces redundancy; it is not primarily a breach-liability reduction control.
Option C is incorrect because database harmonization is about consistency or integration across datasets, not limiting exposure in a breach.
Option D is incorrect because database optimization focuses on performance and efficiency, not on minimizing the number of PII records exposed in a security incident.
Therefore, A is the best answer because segmentation is the option that most directly reduces the scope of exposure in a breach and therefore helps limit liability based on affected individuals.
References (Official ISACA):
* ISACA, Best Practices for Setting Up a Cybersecurity Operations Center - recommends prioritizing assets and isolating high-value asset networks.
* ISACA Journal, Reporting on GDPR Compliance to the Board - emphasizes documenting exposure and relevant risk controls for privacy risk reporting.
* ISACA Journal, Practical Data Security and Privacy for GDPR and CCPA - supports governance approaches to limiting privacy exposure. (Referenced conceptually from prior ISACA privacy guidance.)
CISA-KR 문제 23
An emergency power-off switch is a critical safety mechanism, but it also creates operational risk if it can be triggered accidentally or without proper safeguards. ISACA's official CISA practice material specifically treats a missing cover on an emergency power-off button as a significant concern, which supports the conclusion that the switch should be protected against accidental activation.
Option A is incorrect because remote accessibility could increase the risk of misuse or accidental shutdown.
Option B is incorrect because the switch should be identifiable in an emergency; hiding it would conflict with emergency response needs.
Option D is incorrect because dual control is not the primary requirement for an emergency switch intended for urgent use.
Therefore, the correct answer is C, because the switch should be protected, typically by a cover or similar safeguard, while still remaining available for emergency use.
References (Official ISACA):
ISACA, CISA Practice Quiz - identifies a missing emergency power-off button cover as a significant concern.
CISA-KR 문제 24
References:
Segregation of Duties: Examples of Roles, Duties and Violations - Pathlock Functions in the Purchasing Process and how to Segregate Purchasing Duties
CISA-KR 문제 25
The other options are not as important as reducing the risk of data leakage that could lead to an attack:
Ensuring compliance with the data classification policy is a good practice, but it is not a sufficient reason to classify a DRP as confidential. The data classification policy should reflect the level of risk and impact associated with each type of data, and a DRP should be classified as confidential based on its potential harm if compromised.
Protecting the plan from unauthorized alteration is a valid concern, but it is not a primary reason to classify a DRP as confidential. A DRP should be protected from unauthorized alteration by implementing access controls, audit trails, version control, and change management processes. Classifying a DRP as confidential may deter some unauthorized alterations, but it does not prevent them.
Complying with business continuity best practice is a desirable goal, but it is not a compelling reason to classify a DRP as confidential. Business continuity best practice may recommend classifying a DRP as confidential, but it does not mandate it. The decision to classify a DRP as confidential should be based on a risk assessment and a cost-benefit analysis.
- 다른 버전
- 4149ISACA.CISA-KR.v2026-05-16.q709
- 1823ISACA.CISA-KR.v2026-05-06.q261
- 3164ISACA.CISA-KR.v2026-03-16.q665
- 4555ISACA.CISA-KR.v2026-03-07.q651
- 9324ISACA.CISA-KR.v2025-04-07.q633
- 4478ISACA.CISA-KR.v2025-04-03.q628
- 3720ISACA.CISA-KR.v2025-04-02.q544
- 4251ISACA.CISA-KR.v2025-03-31.q534
- 5386ISACA.CISA-KR.v2025-03-28.q617
- 3250ISACA.CISA-KR.v2025-03-19.q581
- 4053ISACA.CISA-KR.v2025-03-03.q807
- 5218ISACA.CISA-KR.v2024-02-07.q421
- 2871ISACA.CISA-KR.v2024-01-31.q392
- 5388ISACA.CISA-KR.v2023-10-24.q329
- 5229ISACA.CISA-KR.v2023-07-31.q266
- 3228ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 203ISACA.CISA-KR.v2026-08-15.q712
- 152Microsoft.MS-700-KR.v2026-08-15.q203
- 126Microsoft.AZ-305-KR.v2026-08-14.q177
- 185Microsoft.DP-900-KR.v2026-08-13.q130
- 279Microsoft.PL-600.v2026-08-11.q206
- 218Microsoft.DP-100.v2026-08-11.q160
- 187Oracle.1Z0-1048-25.v2026-08-11.q68
- 159ISQI.CTAL-TAE.v2026-08-11.q37
- 200ServiceNow.CIS-HR.v2026-08-11.q84
- 274Salesforce.Plat-Arch-201.v2026-08-10.q101
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2026-08-15.q712 모의시험 시험자료를 다운 받으세요.