Start Your Free Practice Test
Enter your details, then choose a 25-question Quick Test or the full 50-question, 80-minute practice test.
Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Check your readiness for the ISACA Certified Information Systems Auditor (CISA) exam with 50 exam-style questions across all five domains of the 2024 job practice, each with an instant explanation. Free to take, timed to the pace of the real exam, and retake it as often as you want.
New to CISA? Learn more about the certification →
Enter your details, then choose a 25-question Quick Test or the full 50-question, 80-minute practice test.
This free ISACA CISA practice test checks your readiness with 50 auditor-perspective questions across all five domains of the 2024 job practice, each with an explanation for every answer choice, under an 80-minute timer that matches the pace of the real exam. Built by Training Camp, an ISACA Accredited Training Partner. New to the certification? Learn what CISA is and who it is for, or see the CISA Certification Boot Camp.
The CISA exam is organized into five weighted domains under the job practice that took effect August 1, 2024: Information Systems Auditing Process (18%), Governance and Management of IT (18%), Information Systems Acquisition, Development and Implementation (12%), Information Systems Operations and Business Resilience (26%), and Protection of Information Assets (26%). This practice test draws its 50 questions from every domain in the same proportions: 9, 9, 6, 13, and 13.
The real exam has 150 multiple-choice questions and a 240-minute time limit, and it is scored on a scale of 200 to 800 with 450 required to pass. Questions are written from the IS auditor's point of view: what should the auditor recommend, what is the greatest concern, what should be done first. The distractors are often reasonable actions that are simply not the best one, which is why practicing the auditor's way of thinking matters more than memorizing definitions.
Take it once under the 80-minute timer without notes. That works out to 1.6 minutes per question, the same pace as 150 questions in 240 minutes on the real exam. Then read every explanation, including the ones for choices you did not pick. The wrong-answer explanations show you the reasoning patterns ISACA expects, such as choosing a preventive control over a detective one, or verifying evidence rather than accepting a management representation. Use the per-domain breakdown to decide where to study, then retake the test after a week to see whether your judgment has shifted.
Domains Covered · 2024 Job Practice
Risk-based audit planning, controls, evidence, sampling, analytics, reporting, follow-up.
IT strategy, policies, risk, privacy and data governance, vendors, and performance.
SDLC controls, testing, release management, data conversion, post-implementation review.
IT operations, assets, changes and patches, interfaces, backups, BCP and DR.
Identity and access, network security, encryption, physical controls, incident response.
Four questions from the bank, one per domain, with the reasoning behind every answer. The full test has 50.
An internal audit department has enough staff to complete roughly a third of the IS audits requested by business units this year. The chief audit executive asks an IS auditor to propose how the annual audit plan should be built. What should be the PRIMARY basis for selecting which audits to perform?
Correct. ISACA standards call for risk-based audit planning: the audit universe is assessed for business impact and control risk, and limited audit resources are directed to the areas of highest risk first.
An IS auditor reviewing IT governance finds that the IT steering committee approves projects based on the requesting department's seniority and available budget. The committee has never seen a document linking IT initiatives to enterprise goals. What should the auditor recommend FIRST?
Correct. The foundation of IT governance is strategic alignment: an IT strategic plan that flows from business objectives gives the steering committee the reference it needs to prioritize investments. Without it, every other governance mechanism lacks direction.
A fintech company's development teams use an agile methodology and deploy to production through a continuous integration and continuous delivery (CI/CD) pipeline up to twenty times a day. The change advisory board (CAB) meets weekly and cannot review each deployment, so the IT director asks an IS auditor whether change control can exist in this environment. What should the auditor evaluate?
Correct. In agile and DevOps environments change control is embedded in the toolchain: a pull request approved by someone other than the author, automated unit, integration, and security tests that must pass before promotion, no direct developer access to production, and a record of what was deployed, by whom, and when. The auditor tests that these pipeline controls are configured and cannot be bypassed.
An IS auditor finds that 22 percent of changes moved to production during the quarter were classified as emergency changes. Emergency changes are applied by the on-call engineer and are never entered into the change management system afterward. What should the auditor recommend?
Correct. Emergency change procedures should allow rapid implementation but require retrospective documentation, review, and approval so the change record stays complete. Tracking the emergency change rate also exposes whether the process is being used to bypass normal controls, which a 22 percent rate suggests.
Every one of the 50 questions works this way: an explanation for the right answer and for the one you picked, so a wrong answer teaches you something. Questions last reviewed against the current ISACA Certified Information Systems Auditor (CISA) objectives.
Quick answers about the test, the ISACA Certified Information Systems Auditor (CISA) exam, and how to prepare.
Yes. All 50 questions are free to take, with a written explanation for every answer choice across all five ISACA CISA domains. No account is required and you can retake it as often as you want.
50 auditor-perspective questions drawn from all five CISA domains, with an instant explanation after each answer and an 80-minute timer, which is timed to the pace of the real exam (150 questions in 240 minutes). Your results break down by domain. It is a readiness check, not a substitute for full preparation.
The ISACA CISA exam has 150 multiple-choice questions and a 240-minute (four-hour) time limit. This practice test uses 50 questions at the same pace, so the 80-minute timer gives you the same time per question.
CISA is scored on a scale of 200 to 800, and you need a scaled score of 450 or higher to pass. The scaled score is not a percentage of questions answered correctly.
The 2024 job practice has five domains: Information Systems Auditing Process (18%), Governance and Management of IT (18%), Information Systems Acquisition, Development and Implementation (12%), Information Systems Operations and Business Resilience (26%), and Protection of Information Assets (26%).
You can sit the exam at any time, but to certify ISACA requires five years of professional information systems audit, control, or security work experience. ISACA allows up to three years of that requirement to be substituted with university credit hours or a relevant degree, one year of related IS or non-IS audit experience, or two years as a full-time university instructor in a related field.
CISA tests judgment more than technical depth. Most questions describe a situation and ask what the auditor should recommend, conclude, or do first, and several of the wrong choices are usually reasonable. Candidates with hands-on audit or IT control experience tend to find the reasoning familiar; others need to practice thinking like an auditor.
Study ISACA's official CISA Review Manual and question database, practice reading questions from the auditor's perspective, and consider an accelerated CISA Certification Boot Camp that includes the exam voucher and a free retake if you need it.