ワームは、ネットワークを介して 1 つのシステムから別のシステムに自分自身をコピーして複製し、コンピューターとネットワークのリソースを消費する独立したプログラムです。

* Understanding Labor Variances in Cost Accounting:
* Labor efficiency variance measures the difference between the actual hours worked and the standard hours allowed for actual production.
* Labor rate variance measures the difference between the actual labor cost per hour and the standard rate set for labor.
* Why Options 1 (Favorable Labor Efficiency Variance) and 2 (Adverse Labor Rate Variance) Are Correct?
* Favorable Labor Efficiency Variance (1):
* Hiring more experienced researchers should lead to higher productivity, meaning that the team completes tasks faster, reducing the total labor hours required.
* This results in a favorable labor efficiency variance because less time is spent on the project than initially expected.
* Adverse Labor Rate Variance (2):
* More experienced employees command higher salaries, leading to an increase in labor costs per hour compared to the budgeted rate.
* This results in an adverse labor rate variance because the actual wage rate exceeds the standard rate.
* Why Other Options Are Incorrect?
* Option 3 (Adverse Labor Efficiency Variance):
* This would occur if the new hires were less productive, which contradicts the scenario.
* Option 4 (Favorable Labor Rate Variance):
* A favorable variance in labor rate occurs when labor costs are lower than expected, which is unlikely when hiring more experienced (higher-paid) employees.
* Hiring more experienced employees improves efficiency (favorable efficiency variance) but increases wages (adverse rate variance).
* IIA Standard 1220 - Due Professional Care requires auditors to consider operational efficiency in decision-making evaluations.
Final Justification:IIA References:
* IPPF Standard 1220 - Due Professional Care
* IIA Practice Guide - Assessing Business Performance Metrics

* Understanding Spear Phishing Attacks:
* Spear phishing is a targeted cyberattack where attackers send personalized emails to trick individuals into providing sensitive data (e.g., passwords, financial information).
* Unlike regular phishing, which casts a wide net, spear phishing is highly customized and often appears to come from a trusted source.
* Why Option C Is Correct?
* The scenario describes a highly personalized email (related to a golf membership) that tricks the recipient into clicking a malicious hyperlink and entering sensitive data.
* This matches the definition of a spear phishing attack, where an attacker tailors a scam specifically for an individual.
* IIA GTAG 16 - Data Analytics and ISO 27001 emphasize the need for security awareness training to mitigate such threats.
* Why Other Options Are Incorrect?
* Option A (Website attack causing a server crash):
* This describes a Denial-of-Service (DoS) attack, not spear phishing.
* Option B (Generic recorded message requesting password data):
* これはスピアフィッシングではなく、ヴィッシング（音声フィッシング）です。スピアフィッシングは、個人化されたメールを悪用します。
* オプションD（偽のソーシャルメディア投資機会）：
* これは、ターゲットを絞ったスピアフィッシングとは異なり、複数のユーザーをターゲットとする大量フィッシングを指します。
* スピアフィッシングは、個人情報を利用して個人を騙す標的型攻撃であるため、オプション C が最適な選択肢となります。
* IIA GTAG 16 および ISO 27001 では、このような攻撃を防ぐためのサイバーセキュリティの意識を重視しています。
最終的な根拠:IIA 参照:
* IIA GTAG 16 - サイバーセキュリティ監査におけるデータ分析
* ISO 27001 - サイバーセキュリティのベストプラクティス
* NIST SP 800-61 - フィッシング攻撃に対するインシデント対応ガイドライン