ISACA certification practice
Practise Certified Information Security Manager CISM practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 4 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified Information Security Manager CISM exam.
Exam cost
$575 USD (ISACA member) / $760 USD (non-member) / ~£460 / ~£610
Duration
240 minutes (4 hours)
Question count
150 questions
Passing score
450 / 800
Validity
Ongoing (annual CPE maintenance required)
Delivered by
PSI
Online proctored
Yes — available
100% free — no account required
Everything on Courseiva for CISM is free — no subscription, no trial, no email wall.
Courseiva provides free Certified Information Security Manager CISM (CISM) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with ISACA.
Retake policy
Up to four attempts per 12-month period
Question formats
The ISACA Certified Information Security Manager (CISM) is a premier management-level certification that validates expertise in designing, overseeing, and assessing an enterprise's information security programme. Unlike technical certifications, CISM focuses on the business alignment and governance aspects of information security across four domains: information security governance, information security risk management, information security programme development and management, and incident management. The CISM is widely recognised as one of the top credentials for aspiring and current CISOs, security directors, and senior security managers. It complements technical certifications by emphasising leadership, strategy, and risk-based decision making.
Official prerequisite
Five years of work experience in information security management, with a minimum of three years in information security management across the four CISM domains. Substitutions available: general IS experience, education, or other certifications may waive up to two years.
Recommended experience
Broad security management experience; familiarity with risk frameworks (NIST, ISO 27001); experience in security programme governance and incident response leadership
5+ years in information security with at least 3 years in security management roles
Should you skip this exam?
Skip if you are primarily a hands-on technical practitioner — CISM tests management, governance, and strategy, not technical implementation. Consider SSCP, Security+, or CISSP instead.
Courseiva study tip
CISM questions favour the answer that best serves the organisation's business objectives and governance framework — eliminate technically focused options in favour of risk management and strategic thinking
UK salary range
£75,000–£110,000
US salary range
$120,000–$165,000
Job roles that cite CISM
What certification to take next
The CISM exam costs $575 USD for ISACA members and $760 USD for non-members. An annual ISACA membership costs $135, and the access to resources and discounted exam pricing often makes it cost-effective for candidates to join before registering.
The passing score is 450 out of 800. Like other ISACA exams, scores are scaled to account for variation in difficulty between exam forms.
CISM is management-focused and issued by ISACA, emphasising governance, risk management, and programme development. The CISSP from ISC2 is broader, covering eight technical and managerial domains. CISM is often preferred for CISO and security management career paths, while CISSP is stronger for security architect and broad security leadership roles. Many senior professionals hold both.
You need five years of information security work experience, with at least three years in information security management specifically. Up to two years can be substituted by education, general IS experience, or other certifications. Experience must be verified after passing the exam.
The CISM exam contains 150 multiple-choice questions to be answered in 240 minutes (four hours).
CISM requires ongoing annual maintenance: 20 CPE hours per year (120 hours over three years) and an annual maintenance fee. There is no formal expiry date as long as CPE and fee requirements are kept current.
CISM is ideal for security managers, IT directors, and professionals aspiring to CISO or security leadership roles. It is particularly well-suited to those who have moved beyond hands-on technical roles into strategy, governance, and programme oversight responsibilities.
See how CISM stacks up against related certifications.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CISM Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified Information Security Manager CISM questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CISM questions linked to Information Security Program.
Practise CISM questions linked to Information Security Risk Management.
Practise CISM questions linked to Information Security Governance.
Practise CISM questions linked to Incident Management.
Practise CISM questions linked to CISM fundamentals.
Practise CISM questions linked to CISM scenario.
Practise CISM questions linked to CISM troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 36 tests. See all 36 CISM practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CISM questions in this domain →
Practise CISM questions in this domain →
Practise CISM questions in this domain →
Practise CISM questions in this domain →
Free study guide
The Courseiva CISM study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: Risk avoidance
Risk avoidance would involve not implementing the platform or eliminating the risk entirely, which is not the case here.
Trap 2: Risk acceptance
Risk acceptance would mean acknowledging the risk and not taking any action, which contradicts the implementation of MFA.
Trap 3: Risk transfer
Risk transfer would involve shifting the risk to a third party, such as through insurance, not implementing a control.
Risk avoidance
Why wrong: Risk avoidance would involve not implementing the platform or eliminating the risk entirely, which is not the case here.
Risk mitigation
MFA reduces the likelihood or impact of the risk, which is the definition of risk mitigation.
Risk acceptance
Why wrong: Risk acceptance would mean acknowledging the risk and not taking any action, which contradicts the implementation of MFA.
Risk transfer
Why wrong: Risk transfer would involve shifting the risk to a third party, such as through insurance, not implementing a control.
Trap 1: A network architecture diagram
This is a technical artifact, not a core program component.
Trap 2: An incident response log
This is an operational record, not a program component.
A network architecture diagram
Why wrong: This is a technical artifact, not a core program component.
An incident response log
Why wrong: This is an operational record, not a program component.
Trap 1: Minimize security spending to maximize ROI.
Cost reduction may compromise necessary security controls.
Trap 2: Adopt a best-practice framework such as NIST CSF and implement all…
May not address specific business needs or risk tolerance.
Trap 3: Focus on regulatory compliance to ensure legal requirements are met.
Compliance is necessary but insufficient for full alignment with business objectives.
Minimize security spending to maximize ROI.
Why wrong: Cost reduction may compromise necessary security controls.
Adopt a best-practice framework such as NIST CSF and implement all controls.
Why wrong: May not address specific business needs or risk tolerance.
Focus on regulatory compliance to ensure legal requirements are met.
Why wrong: Compliance is necessary but insufficient for full alignment with business objectives.
Develop a risk-based prioritization framework linking security initiatives to business risk appetite.
Directly aligns security investments with business objectives through risk management.
Trap 1: Implement strict access controls and encryption for all data.
Technical controls alone do not address the innovation balance.
Trap 2: Adopt a 'security by design' approach for all new projects.
Important but may not provide the balance needed; too security-centric.
Trap 3: Create a separate innovation sandbox with limited data access.
May limit innovation scope and does not address governance balance.
Implement strict access controls and encryption for all data.
Why wrong: Technical controls alone do not address the innovation balance.
Establish a risk appetite framework that defines acceptable risk levels for innovation initiatives.
Enables informed decision-making balancing innovation and security.
Adopt a 'security by design' approach for all new projects.
Why wrong: Important but may not provide the balance needed; too security-centric.
Create a separate innovation sandbox with limited data access.
Why wrong: May limit innovation scope and does not address governance balance.
Trap 1: To manage day-to-day security operations.
Operational tasks are handled by security teams, not governance committees.
Trap 2: To implement security controls across the organization.
Implementation is the responsibility of operational teams.
Trap 3: To approve technical security solutions.
Technical approvals are typically delegated to technical boards.
To manage day-to-day security operations.
Why wrong: Operational tasks are handled by security teams, not governance committees.
To implement security controls across the organization.
Why wrong: Implementation is the responsibility of operational teams.
To approve technical security solutions.
Why wrong: Technical approvals are typically delegated to technical boards.
To ensure security strategy aligns with business objectives and provide oversight.
Governance committees bridge security and business strategy.
Trap 1: Eliminate all information security risks.
Risk elimination is impossible; governance manages risk.
Trap 2: Maximize profitability through security investments.
Profit is a business goal, not governance objective.
Trap 3: Achieve compliance with all applicable regulations.
Compliance is a requirement, but not the primary objective of governance.
Eliminate all information security risks.
Why wrong: Risk elimination is impossible; governance manages risk.
Align security strategy with business goals.
Core objective of governance.
Maximize profitability through security investments.
Why wrong: Profit is a business goal, not governance objective.
Ensure accountability for security decisions.
Essential governance objective.
Achieve compliance with all applicable regulations.
Why wrong: Compliance is a requirement, but not the primary objective of governance.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.