CISA Practice Questions (Certified Information Systems Auditor)
CISA is the credential IT audit, assurance, and security-control roles screen for, and the exam is far more about audit judgment than technical recall. This is the biggest practice bank of its kind: 10 full-length timed forms, 1,500 original questions across all five domains at official weighting, with a clear rationale for every answer. Take a free timed practice test first, then unlock the full bank for $99 one time.
By PrepClubs Editorial Team, updated October 8, 2026
The Certified Information Systems Auditor (CISA) exam is a vendor-neutral certification for IT audit, assurance, and control professionals. The exam has 150 multiple-choice questions, a 4-hour (240-minute) time limit, and a scaled passing score of 450 on a 200 to 800 range. It covers five domains: Information Systems Auditing Process, Governance and Management of IT, Information Systems Acquisition Development and Implementation, Information Systems Operations and Business Resilience, and Protection of Information Assets. Scoring is on the total scaled score, so there is no per-domain minimum. It is widely recognized as a standard requirement for IT audit and assurance roles.
Source: ISACA CISA Exam Content Outline (job-practice update effective 1 August 2024). PrepClubs is not affiliated with ISACA.
The biggest CISA bank, with a rationale for every answer
Official facts checked 8 Oct 2026
How long is the CISA exam and how many questions does it have?
The CISA exam has 150 multiple-choice questions and a 4-hour (240-minute) time limit, according to ISACA. That is 96 seconds per question. The exam covers five domains, and the two largest carry 26% each: information systems operations and business resilience, and protection of information assets. Calculators are on the ISACA list of prohibited items.
“Candidates have 4 hours to complete the CISA/CRISC/CISM/CGEIT exams and 3.5 hours to complete the CDPSE exam.”
“Designed for IT/IS auditors and control, assurance, and information security professionals”
Which CISA practice tests are on PrepClubs, and how long is each one?
PrepClubs has 11 CISA practice tests: 1 diagnostic and 10 full-length forms, 1,525 questions in all. 10 run 150 questions in 240 minutes, 1 runs 25 questions in 25 minutes.
The question count, time limit and question mix in each row are read from the question bank that runs the live tests, last on 8 Oct 2026, so each row matches what the test shows when you open it.
Showing 11 of 11 CISA practice tests
- Information Systems Operations and Business Resilience
- Protection of Information Assets
- Information Systems Auditing Process
- Governance and Management of IT
- Information Systems Acquisition, Development and Implementation
| Question mix | Calculator | Guide | |||||
|---|---|---|---|---|---|---|---|
| CISA Diagnostic (Certified Information Systems Auditor) Diagnostic | 25 | 25 min | 60 s | Information Systems Operations and Business Resilience 7 · Protection of Information Assets 6 · Information Systems Auditing Process 5 2 more areasGovernance and Management of IT 4 · Information Systems Acquisition, Development and Implementation 3 | Not allowed | CISA domains | |
| CISA Practice Test 1 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 2 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 3 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 4 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 5 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 6 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 7 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 8 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 9 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains | |
| CISA Practice Test 10 (Certified Information Systems Auditor) Full-length | 150 | 240 min | 96 s | Information Systems Operations and Business Resilience 39 · Protection of Information Assets 39 · Governance and Management of IT 27 2 more areasInformation Systems Auditing Process 27 · Information Systems Acquisition, Development and Implementation 18 | Not allowed | CISA domains |
Sources
- ISACA: Exam Candidate Guide, 2026 (PDF) (isaca.org), checked 8 Oct 2026
- ISACA: CISA exam content outline (isaca.org), checked 8 Oct 2026
- PrepClubs question bank, the files behind the live CISA practice tests, read 8 Oct 2026
“Not published” means the publisher does not state that fact on any page we could find. We leave it blank instead of quoting a prep site.
What you get with the full bank
A large bank of original CISA practice questions written to the current ISACA CISA Exam Content Outline, effective 1 August 2024. Full coverage of all five domains, weighted to the official blueprint: Information Systems Auditing Process, Governance and Management of IT, Information Systems Acquisition Development and Implementation, Information Systems Operations and Business Resilience, and Protection of Information Assets.
A clear rationale for every question. We explain why the correct answer is correct and why each other option is wrong, so you build the audit reasoning the exam actually tests rather than memorizing answers. The bank is built around the CISA audit mindset: FIRST-step sequencing, BEST-evidence comparisons, and GREATEST-concern prioritization, where most or all options are true and a single qualifier decides the key.
Two ways to practice. Exam mode is a timed, full-length 150-question form that matches the real domain weighting, so you rehearse under exam conditions. Study mode lets you practice by domain, review rationales as you go, and retry the questions you missed.
The five CISA domains and their official weight
Every one of the 10 forms is built to the same domain weighting, so each is a true full-length rehearsal of the real exam.
Information Systems Auditing Process (18%)
Risk-based audit planning, IS audit standards and guidelines, the audit charter and independence, evidence collection and reliability, sampling, CAATs and data analytics, and communicating results. The process backbone of the exam.
Governance and Management of IT (18%)
IT governance frameworks, strategy alignment, policies and standards, enterprise and IT risk management, organizational structure and segregation of duties, performance measurement, and third-party governance. The management-side reasoning many candidates underestimate.
Information Systems Acquisition, Development and Implementation (12%)
The business case and feasibility, project governance, SDLC and Agile controls, testing strategies, data conversion and migration, go-live readiness, post-implementation review, and change and release management. The smallest domain by weight.
Information Systems Operations and Business Resilience (26%)
One of the two heaviest domains. IT service and operations management, incident and problem management, backup and restoration, business impact analysis, business continuity, and disaster recovery with RTO and RPO. Where many candidate points are won or lost.
Protection of Information Assets (26%)
The other heaviest domain. Information security governance, logical access and identity management, authentication and privileged access, encryption and key management, data classification and privacy, security monitoring, and emerging-tech risk across cloud, AI, and IoT.
Try five real CISA questions, one from each domain
One item from each of the five CISA domains, including both of the 26 percent domains that decide more than half your result. Taken from the final practice test, so buyers meet them last. Click a question to reveal the answer and the reasoning.
- A.Halt the engagement until contractual access to the system is obtained.
- B.Follow the guideline as written and treat the standard as optional.
- C.Issue a disclaimer of opinion without attempting any alternative procedures.
- D.Meet the mandatory standard and document the alternative procedure applied.
- A.Performed by the same staff member who processes the payments.
- B.Independent of the processing, performed timely, and documented.
- C.Performed annually, using a summarized total-only report.
- D.Limited to confirming that the report totals foot correctly.
- A.A fit-gap analysis.
- B.A feasibility study.
- C.A benchmarking exercise.
- D.A user acceptance test.
- A.A problem awaiting root cause analysis.
- B.A known error with a documented workaround.
- C.A standard change with a preapproved procedure.
- D.A major incident with an active recovery plan.
- A.Performing a quick format on each drive before disposal
- B.Overwriting only the master boot record on each drive
- C.Removing the drives from the asset inventory before disposal
- D.Degaussing or physically destroying the drives, or a verified wipe
CISSP vs CISA: which one you actually qualify for
These two get shortlisted together and they are not interchangeable. CISSP is a security practitioner and leadership credential from ISC2; CISA is an audit and assurance credential from ISACA. The deciding factor for most people is not the syllabus, it is the experience rule and what happens if you do not meet it yet.
| CISSP (ISC2) | CISA (ISACA) | |
|---|---|---|
| Exam format | Adaptive (CAT), 100 to 150 items | 150 multiple-choice |
| Time limit | 3 hours | 4 hours |
| Pass mark | 700 of 1000 | 450 on a 200 to 800 scale |
| Exam price (USD) | $749 | $575 member, $760 non-member |
| Experience required | 5 years across 2 or more of the 8 domains | 5 years within the past 10 years |
| Minimum you cannot waive | 4 years | 2 years |
| Waiver available | Up to 1 year: a degree OR an approved credential, not both | Up to 3 years: degree, CIMA or ACCA |
| If you lack the experience | Pass anyway and become an Associate of ISC2, then 6 years to earn it | Pass anyway, then 5 years to apply |
| After you pass | Endorsement by a certified professional within 9 months | Supervisor-verified application plus a $50 fee |
| Annual fee | $135 | $45 member, $85 non-member |
| Continuing education | 120 CPEs per 3 years, 90 of them Group A | 120 CPEs per 3 years, minimum 20 a year |
| Retake waits | 30, then 60, then 90 days | 30, then 90, then 90 days |
| Attempts per 12 months | 4 | 4 |
| Languages | 5 | 7 |
Sources: the ISC2 CISSP Exam Outline effective 15 April 2024, ISC2 exam pricing and member policies, the ISACA CISA Exam Content Outline, and the ISACA Certification Exams Candidate Guide. Note that ISC2 has a stale notice page still quoting 125 to 175 items over 4 hours; the current outline supersedes it. PrepClubs is not affiliated with ISC2 or ISACA.
The CISA rules that decide whether you can certify, not just pass
Five years, but only two of them are non-negotiable
CISA asks for five years of information systems auditing, control, assurance or security work within the ten years before you apply, and at least one year of it has to sit in a CISA job practice domain. What most summaries leave out is the structure underneath that number.
Two years of actual IS audit, control, assurance or security experience cannot be substituted by anything. Everything above that can. One year comes off for general audit or general information systems experience. Education takes off more: one year for an associate degree, two for a bachelor's, master's or doctorate in any field, and three for a master's in information systems or a related field. Full CIMA certification or ACCA membership is worth two years each.
Substitutions cap at three years in total, which is how the five-year requirement bottoms out at two years of real audit work plus a relevant master's. That is a materially easier path than CISSP, where only one year can ever be waived.
You have five years from passing the exam to submit the application, and the experience is verified by your supervisor or manager rather than endorsed by another certified professional. There is a $50 one-time application processing fee on top of the exam.
The full cost, including the fees that recur
The exam is $575 for ISACA members and $760 for non-members. ISACA publishes one global USD price with no regional variation. The $185 gap is large enough that membership is worth pricing out before you register rather than after.
Beyond the exam: $50 to process your application, $75 to extend your exam eligibility if the six-month window runs out, and $75 per rescore request, which has to be filed within 30 days of your result. Rescheduling is free if you do it at least 48 hours before your appointment.
Maintenance is $45 a year for members and $85 for non-members, due by 1 January. Continuing education is 120 CPE hours across a three-year cycle with a minimum of 20 in any single year, so you cannot bank nothing for two years and cram. ISACA audits CPE records at random and expects you to keep documentation for twelve months past the end of the cycle.
Where the exam actually weights its questions
Two domains carry more than half the exam between them. Operations and Business Resilience is 26 percent and Protection of Information Assets is another 26 percent. Auditing Process and Governance sit at 18 percent each, and Acquisition, Development and Implementation is the lightest at 12 percent.
The practical read is that CISA is more an operations and security-controls exam than the audit-methodology exam its name suggests. Methodology matters, but if you allocate study time evenly across five domains you will under-prepare the two that decide the result.
Scoring is a scaled 200 to 800 with 450 to pass, and it is your total score that counts. Domain-level results are reported to you as information only, with no minimum in any single domain. The exam also contains unscored pretest items mixed in, which you cannot identify while sitting it.
On the salary figure ISACA puts on its own page
ISACA advertises "US$149K+ average annual salary" on the CISA credential page, alongside claims that 70 percent saw on-the-job improvement and 22 percent received a pay boost.
We will be straight about this: none of those three numbers carries a source, a year, a sample size or a methodology anywhere on that page. That is issuer marketing, not survey data, and we are not going to repeat it as though it were evidence. ISACA does map CISA to the IT Auditor and IT Audit Manager roles in its Career Center, which is the more defensible statement about where the credential leads.
Build the rest of your prep stack
How CISA is scored
The CISA exam has 150 multiple-choice questions and a 4-hour (240-minute) time limit. The passing score is 450 on a scaled range of 200 to 800. This is a proficiency threshold set on the total scaled score, not a raw percentage and not a per-domain cutoff, so a strong domain can offset a weaker one.
Because the scale is not a raw percentage, there is no published question-to-score formula. Community consensus is that passers get roughly 70 percent or more of items right, but the exact raw cut varies by form and ISACA does not publish the conversion. Our exam-mode form mirrors the 150-question, domain-weighted structure so your practice percentage tracks close to real exam conditions.
Time is rarely the binding constraint at roughly 1 minute 36 seconds per item. The real difficulty comes from wording: most items make several options technically true, then use a single qualifier such as PRIMARY, BEST, FIRST, or GREATEST to decide the answer. Read the qualifier before the options.
Who uses the CISA?
CISA is a common requirement for IT auditor, IT assurance, and IT risk and control roles, and it is frequently listed as a preferred or required credential for internal audit and compliance positions. Organizations that hire heavily for these roles routinely list it as a requirement or a strong preference.
A CISA prep approach (about 30 days)
Days 1-3: Take the free diagnostic and read your domain breakdown
Start with the free 25-question timed diagnostic. It scores you domain by domain so you can see exactly where you stand before spending a cent. Your two weakest domains become the focus of the plan.
Days 4-14: Study mode by domain, weakest first
Work through study mode one domain at a time, reading the rationale on every question including the ones you get right. Operations and Business Resilience and Protection of Information Assets carry the most weight, so do not leave them for last.
Days 15-24: Drill the audit-judgment patterns
The exam turns on qualifiers. Work the FIRST-step sequencing, BEST-evidence comparison, and GREATEST-concern items until you instinctively rank options on the axis the qualifier names, and never pick the option where the auditor fixes the control.
Days 25-29: Full-length timed forms
Sit exam-mode forms under a strict 240-minute clock. Aim to consistently clear the pass approximation with time to spare, and review every miss by domain.
Day 30: Light review and rest
Review only your flagged and missed items from the last two forms. Do not cram new material the day before. Settled recall beats last-minute volume.
Common CISA mistakes
Answering as an operator, not an auditor
The single biggest trap. An option where the auditor personally patches, configures, or remediates a control is almost always wrong, even when it would solve the problem, because it destroys independence. Auditors assess and report, they do not fix.
Ignoring the qualifier
Most items make several options true. PRIMARY, BEST, FIRST, and GREATEST each select a different answer. Read the qualifier first, then rank the options on the axis it names.
Reporting before establishing extent and cause
On FIRST-step items, the earliest correct action is usually to understand, assess, or gather evidence. Report and remediate come later. Picking report too early is a classic miss.
Underweighting the heavy domains
Operations and Business Resilience and Protection of Information Assets are each 26 percent, 52 percent of the exam combined. Candidates who over-invest in the audit process domain and skip these lose the most points.
Related reading
CISA FAQs
A score tells you how you did. The coach tells you what to practice next.
After every test you get a short plan built from your own answers and seconds: which sections cost you points, which ones eat your clock, and the drill that fixes each.
Math: 11 of 12 right, at 31 s a question
Drill math against a 20 s clock. That frees about 2 minutes per test for the sections you miss more.
People who got the same questions right took 20 s.
Illustrative data
- Every section mapped on accuracy against speed, with one fix for each
- The questions that ate your time, and the clock checkpoints to hit next time
- Where rushing costs you, and the point to guess and move on
- A read that sharpens with every test you take
Your pacing report is free with your first test.
Prove you are ready before exam day.
The biggest CISA bank: 10 timed forms, 1,500 original questions, a rationale for every answer. Start free, then unlock it for a one-time $99 with 30-day access and a Money-back Guarantee*.
Start prepping