무료 온라인 액세스 ISACA.CISM.v2026-01-12.q388 모의 시험 (Page 43)

CISM 문제 206

조직에 고도로 기술적인 포렌식 조사를 수행할 내부 전문성이 부족한 경우, 정보 보안 사고 발생 후 효과적이고 시기적절한 조사를 보장하는 가장 좋은 방법은 무엇입니까?

A. 법의학적 표준 운영 절차를 구매하세요.

B. 사고 대응 정책에서 법의학 회사 고용을 허용하는지 확인하세요.

C. 정보 보안 팀에 법의학 교육을 제공합니다.

D. 사고가 발생하기 전에 법의학 회사에 의뢰하세요.

CISM 문제 207

A balanced scorecard MOST effectively enables information security:

A. project management

B. governance.

C. performance.

D. risk management.

정답: B

A balanced scorecard most effectively enables information security govern-ance. Information security governance is the process of establishing and maintaining a framework to provide assurance that information security strategies are aligned with and support business objectives, are consistent with applicable laws and regulations, and are managed effectively and efficiently1. A balanced scorecard is a tool for meas-uring and communicating the performance and progress of an organization toward its strategic goals. It typically includes four perspectives: financial, customer, internal pro-cess, and learning and growth2. A balanced scorecard can help information security managers to:
* Align information security objectives with business objectives and communicate them to senior management and other stakeholders
* Monitor and report on the effectiveness and efficiency of information security processes and controls
* Identify and prioritize improvement opportunities and corrective actions
* Demonstrate the value and benefits of information security investments
* Foster a culture of security awareness and continuous learning
Several sources have proposed models or frameworks for applying the balanced scorecard approach to information security governance34 . The other options are not the most effective applications of a balanced scorecard for information security. Pro-ject management is the process of planning, executing, monitoring, and closing pro-jects to achieve specific objectives within constraints such as time, budget, scope, and quality. A balanced scorecard can be used to measure the performance of individual projects or project portfolios, but it is not specific to information security projects. Per-formance is the degree to which an organization or a process achieves its objectives or meets its standards. A balanced scorecard can be used to measure the performance of information security processes or functions, but it is not limited to performance measurement. Risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that affect an organization's objec-tives. A balanced scorecard can be used to measure the risk exposure and risk appetite of an organization, but it is not a tool for risk assessment or treatment. Reference: 1: Information Security Governance - ISACA 2: Balanced scorecard - Wikipedia 3: Key Per-formance Indicators for Security Governance Part 1 - ISACA 4: A Strategy Map for Se-curity Leaders: Applying the Balanced Scorecard Framework to Information Security - Security Intelligence : How to Measure Security From a Governance Perspective - ISA-CA : Project management - Wikipedia : Performance measurement - Wikipedia : Risk management - Wikipedia

CISM 문제 208

다음 중 보안 인식 교육이 효과적이었다는 것을 나타내는 가장 좋은 지표는 무엇입니까?

A. 직원들이 보안 정책을 인정하기 위해 서명합니다.

B. 더 많은 사건이 보고되고 있습니다.

C. 대부분의 직원이 교육을 완료했습니다.

D. 3개월 동안 사고가 보고되지 않았습니다.

CISM 문제 209

보안 관리자가 잔여 위험을 수용할지 여부를 결정할 때 가장 중요한 것은 무엇입니까?

A. 자산의 과거 비용

B. 잠재적 비즈니스 영향의 허용 가능한 수준

C. 추가 완화 통제의 비용 대비 이점

D. 연간 손실 예상(ALE)

CISM 문제 210

보안 제어를 지속적으로 모니터링하는 주요 목적은 다음을 보장하는 것입니다.

A. 시스템 가용성.

B. 제어 격차가 최소화됩니다.

C. 통제의 효과성.

D. 규정 준수 요구 사항과의 일치.

다른 버전: 6797ISACA.CISM.v2025-10-28.q838; 2173ISACA.CISM.v2024-10-23.q376; 2166ISACA.CISM.v2024-08-17.q456; 1699ISACA.CISM.v2024-06-21.q336; 1739ISACA.CISM.v2023-05-09.q175; 3723ISACA.CISM.v2023-02-18.q334; 2519ISACA.CISM.v2022-10-08.q177; 11977ISACA.CISM.v2022-02-09.q999

최근 업로드: 126Microsoft.AZ-305-KR.v2026-08-17.q162; 140IIA.IAA-IAP-KR.v2026-08-17.q41; 303ISACA.CISA-KR.v2026-08-15.q712; 238Microsoft.MS-700-KR.v2026-08-15.q203; 173Microsoft.AZ-305-KR.v2026-08-14.q177; 237Microsoft.DP-900-KR.v2026-08-13.q130; 315Microsoft.PL-600.v2026-08-11.q206; 267Microsoft.DP-100.v2026-08-11.q160; 209Oracle.1Z0-1048-25.v2026-08-11.q68; 177ISQI.CTAL-TAE.v2026-08-11.q37