ISACA certification practice
Practise Certified Information Systems Auditor CISA practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 5 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified Information Systems Auditor CISA exam.
Exam cost
$575 USD (ISACA member) / $760 USD (non-member) / ~£460 / ~£610
Duration
240 minutes (4 hours)
Question count
150 questions
Passing score
450 / 800
Validity
3 years (with annual CPE requirements)
Delivered by
PSI
Online proctored
Yes — available
100% free — no account required
Everything on Courseiva for CISA is free — no subscription, no trial, no email wall.
Courseiva provides free Certified Information Systems Auditor CISA (CISA) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with ISACA.
Retake policy
Candidates may attempt CISA up to four times per 12-month period
Question formats
The ISACA Certified Information Systems Auditor (CISA) is one of the most respected and longest-standing certifications in IT auditing, control, and assurance, having been established in 1978. The exam validates skills across five domains: information systems auditing process, governance and management of IT, information systems acquisition, development and implementation, information systems operations and business resilience, and protection of information assets. CISA holders are trusted to audit, monitor, assess, and evaluate an organisation's information technology and business systems. The credential is widely required for internal audit, IT audit, and compliance roles across financial services, government, and large enterprises.
Official prerequisite
Five years of professional work experience in information systems auditing, control, or security. Substitutions allowed: a two-year or four-year degree can substitute for one or two years of experience respectively.
Recommended experience
Hands-on experience in IT audit, risk assessment, or compliance; familiarity with control frameworks such as COBIT, ISO 27001, and ITIL; understanding of financial audit concepts is helpful
5+ years in IS auditing, control, or security; common among audit professionals in financial services and government
Should you skip this exam?
Skip if you have no audit or compliance background — the CISA is deeply audit-focused and requires real-world audit experience to pass and maintain
Courseiva study tip
Use the official ISACA CISA Review Manual and QAE database — practice questions from ISACA are the closest match to real exam style; focus heavily on the IT audit process domain as it carries the most weight
UK salary range
£55,000–£85,000
US salary range
$90,000–$130,000
Job roles that cite CISA
What certification to take next
The CISA exam costs $575 USD for ISACA members and $760 USD for non-members. Becoming an ISACA member costs $135/year, which also provides access to study materials and resources, often making membership worthwhile for candidates.
The passing score is 450 out of 800 on a scaled basis. The exam uses 150 multiple-choice questions, and scores are scaled to account for differences in difficulty across exam forms.
ISACA requires five years of professional work experience in IS auditing, control, or security. However, a two-year degree substitutes for one year of experience, and a four-year degree substitutes for two years, meaning candidates with a degree need as little as three years of qualifying experience.
The CISA covers five domains: (1) Information Systems Auditing Process, (2) Governance and Management of IT, (3) Information Systems Acquisition, Development and Implementation, (4) Information Systems Operations and Business Resilience, and (5) Protection of Information Assets.
The CISA is considered a challenging professional-level exam. ISACA reports pass rates that vary, but many candidates need two or more attempts. The questions are scenario-based and require applying audit and control judgement rather than recalling facts, which makes thorough practice essential.
The CISA requires ongoing maintenance: 20 CPE hours annually (120 hours over three years) and payment of an annual maintenance fee. The certification remains active as long as these requirements are met — there is no formal expiry date if maintenance is kept current.
The CISA is essential for IT auditors, internal auditors with IT focus, compliance professionals, and IS risk managers. It is most valuable in financial services, government, healthcare, and consulting, where IT audit credentials are frequently required for senior roles.
See how CISA stacks up against related certifications.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CISA Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified Information Systems Auditor CISA questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CISA questions linked to Governance and Management of IT.
Practise CISA questions linked to Information Systems Acquisition, Development and Implementation.
Practise CISA questions linked to Information Systems Operations and Business Resilience.
Practise CISA questions linked to Protection of Information Assets.
Practise CISA questions linked to Information System Auditing Process.
Practise CISA questions linked to CISA fundamentals.
Practise CISA questions linked to CISA scenario.
Practise CISA questions linked to CISA troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 37 tests. See all 37 CISA practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CISA questions in this domain →
Practise CISA questions in this domain →
Practise CISA questions in this domain →
Practise CISA questions in this domain →
Practise CISA questions in this domain →
Free study guide
The Courseiva CISA study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: Re-run all UAT test cases to ensure no regression occurs
Too broad; not necessary for low-severity issues.
Trap 2: Delay go-live until all defects are resolved
Unnecessary delay for low-severity issues.
Trap 3: Obtain sign-off from business stakeholders acknowledging the risks…
Lacks formal documentation of the known issues.
Document the unresolved defects as known issues in a risk acceptance form with a remediation plan, then proceed with go-live
Best practice: formally track and accept residual risk.
Re-run all UAT test cases to ensure no regression occurs
Why wrong: Too broad; not necessary for low-severity issues.
Delay go-live until all defects are resolved
Why wrong: Unnecessary delay for low-severity issues.
Obtain sign-off from business stakeholders acknowledging the risks and proceed with go-live
Why wrong: Lacks formal documentation of the known issues.
Trap 1: Deploying DLP agents on all endpoints before defining policies
Policies should be defined before deployment to avoid disruption.
Trap 2: Encrypting all data at rest and in transit as a prerequisite
Encryption is a separate control; DLP can work with or without it.
Trap 3: Replacing user security awareness training with automated DLP
DLP complements but does not replace training.
Implementing DLP in monitoring mode initially to baseline traffic
Monitoring first helps tune policies and reduce false positives.
Deploying DLP agents on all endpoints before defining policies
Why wrong: Policies should be defined before deployment to avoid disruption.
Encrypting all data at rest and in transit as a prerequisite
Why wrong: Encryption is a separate control; DLP can work with or without it.
Classifying data based on sensitivity and criticality
Data classification is essential to define DLP policies.
Replacing user security awareness training with automated DLP
Why wrong: DLP complements but does not replace training.
Refer to the exhibit. syslog output: Mar 15 10:23:45 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:46 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:47 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:48 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:49 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Trap 1: Applying the latest security patches to the SSH service
Patching addresses vulnerabilities, not brute-force attacks.
Trap 2: Disabling direct root login via SSH
Even if root login is disabled, attackers could still brute-force other user accounts.
Trap 3: Enforcing strong password complexity
Strong passwords make brute force harder but do not prevent repeated attempts.
Applying the latest security patches to the SSH service
Why wrong: Patching addresses vulnerabilities, not brute-force attacks.
Implementing account lockout after three failed attempts
Account lockout directly mitigates brute-force attacks by blocking further attempts.
Disabling direct root login via SSH
Why wrong: Even if root login is disabled, attackers could still brute-force other user accounts.
Enforcing strong password complexity
Why wrong: Strong passwords make brute force harder but do not prevent repeated attempts.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.