CISA Dumps with Practice Exam Questions Answers

The best answer is C. Re-performance of controls.

Under ISACA audit principles, evidence obtained directly by the auditor is generally more reliable than evidence provided by management or gathered indirectly. Re-performance allows the auditor to independently execute the control or procedure and verify whether it works as intended, making it stronger than inquiry, observation, or management attestation.

Option A is the least reliable because inquiry depends on what people say. Option B is stronger than simple inquiry but still relies on management representation. Option D can be useful, but observation only shows what happened at a point in time and may not prove consistent operation. Re-performance gives the auditor the highest level of assurance because the evidence is generated through the auditor’s own independent work.

References (Official ISACA):

ISACA, Follow-Up Audits and Follow-Up Process: The Auditor’s Impact Litmus Tool

ISACA, The Top-Five Audit Essentials for Driving Efficiency and Value

A change log is a record of all changes made to a system or application, including the date, time, description, and approval of each change. A change log can help an IS auditor to trace the source and authorization of a modification to a system’s security settings. A system event correlation report is a tool that analyzes data from multiple sources to identify patterns and anomalies that indicate potential security incidents. A database log is a record of all transactions and activities performed on a database, such as queries, updates, and backups. A security incident and event management (SIEM) report is a tool that collects, analyzes, and reports on data from various sources to detect and respond to security incidents. 

An incident response team has been notified of a virus outbreak in a network subnet. The next step should be to focus on limiting the damage by containing the virus and preventing it from spreading further. This may involve isolating the affected systems, disconnecting them from the network, blocking malicious traffic or applying patches or antivirus updates. Verifying that the compromised systems are fully functional, documenting the incident and removing and restoring the affected systems are possible steps that could be taken after limiting the damage. References:

[Incident Response Definition]

[Incident Response Process | ISACA]

[Virus Definition]

The correct answer is C. Be protected.

An emergency power-off switch is a critical safety mechanism, but it also creates operational risk if it can be triggered accidentally or without proper safeguards. ISACA’s official CISA practice material specifically treats a missing cover on an emergency power-off button as a significant concern, which supports the conclusion that the switch should be protected against accidental activation.

Option A is incorrect because remote accessibility could increase the risk of misuse or accidental shutdown.

Option B is incorrect because the switch should be identifiable in an emergency; hiding it would conflict with emergency response needs.

Option D is incorrect because dual control is not the primary requirement for an emergency switch intended for urgent use.

Therefore, the correct answer is C, because the switch should be protected, typically by a cover or similar safeguard, while still remaining available for emergency use.

References (Official ISACA):

ISACA, CISA Practice Quiz — identifies a missing emergency power-off button cover as a significant concern.