CISA Certified Information Systems Auditor Practice Test
Use the free CISA practice tests to find weak domains before you spend four hours on a full benchmark. Each short set has 20 questions and a roughly 32-minute timer, matching the exam's pace of 240 minutes for 150 questions.
Mixed-set CISA practice tests
Five short sets covering all five job-practice domains. The heavier 26% domains appear more often than the 12% acquisition and implementation domain, so the mix stays close to the current outline.
Domain-wise CISA practice tests
A mixed set tells you where the gap is. These five focused tests let you stay on that domain until the auditor's decision process starts to feel automatic.
Twenty questions finds a weak domain.
One hundred fifty questions reveal your four-hour pace.
Use the free sets for diagnosis. Move to a full-length test when you want a clean 150-question benchmark across all five domains without stopping after twenty questions.
| Free tests on this page | Full-length tests | |
|---|---|---|
| Questions | 20 | 150 |
| Time limit | About 32 minutes | 240 minutes |
| Coverage | Mixed sample or one domain | All five domains in every test |
| Blueprint | Current CISA domain weighting | 27 / 27 / 18 / 39 / 39 questions |
| Question format | Single-best-answer practice | 150 single-best-answer questions |
| Practice conditions | Short timed set | Four-hour timed benchmark |
| Feedback | Review the short set | Explanation attached to every question |
| Number available | 10 free tests | 10 full-length tests |
| Price | Free | From $4.49₹159£3.69€4.29 per test |
How to use these tests without wasting them
Keep the sequence simple. Diagnose first, repair the weak area, then test whether your concentration holds across the full four-hour format.
Benchmark
Take two mixed sets before you change your study plan. Look for the domain that keeps costing you questions, not one isolated miss.
Start with practice test 1 →Drill the gap
Move into the matching domain test. CISA rewards judgment, so pay attention to why the best audit action beats an answer that is merely technically possible.
Try the 26% operations domain →Dress rehearsal
When the short sets stop exposing obvious gaps, sit a 150-question test on the 240-minute clock. That is where pacing and late-test concentration become visible.
Go to full-length tests →About the CISA exam
The current CISA outline has been in force since August 2024. The 2026 ISACA candidate guide keeps the exam at 150 multiple-choice questions over four hours.
What CISA tests
CISA is built around the work of an information systems auditor: planning and performing audits, evaluating governance, reviewing system acquisition and implementation, assessing operations and resilience, then judging how well information assets are protected.
That is why strong CISA questions rarely reward the fastest technical fix. The better answer is often the one that protects audit independence, preserves evidence, addresses risk at the right level, or keeps management ownership where it belongs.
Exam format
Questions: 150 multiple-choice questions.
Duration: 4 hours / 240 minutes.
Answer model: one best answer from four options.
Passing standard: 450 on ISACA's 200–800 scale.
Delivery: authorized PSI testing centers or remote proctoring.
Exam fee: US$575 for ISACA members and US$760 for non-members.
Eligibility and maintenance
Taking the exam: you can sit CISA before meeting the certification experience requirement.
Certification experience: five years of professional information systems auditing, control or security work, gained within the ten years before application.
Application window: five years after passing the exam.
Experience waivers: qualifying education or experience can reduce the requirement by up to three years.
CPE: at least 20 hours each year and 120 hours across a three-year reporting period.
CISA domain weights
Operations and Business Resilience plus Protection of Information Assets make up 52% of the exam. If your score is weak in either 26% domain, fix that before spending equal time everywhere else.
| Domain | Topic | Weight | Questions in a 150-question full-length test |
|---|---|---|---|
| Domain 1 | Information System Auditing Process | 18% | 27 |
| Domain 2 | Governance & Management of IT | 18% | 27 |
| Domain 3 | Information Systems Acquisition, Development & Implementation | 12% | 18 |
| Domain 4 | Information Systems Operations and Business Resilience | 26% | 39 |
| Domain 5 | Protection of Information Assets | 26% | 39 |
How the CISA practice tests are written
Current outline, not an old domain map
The sets follow the five-domain CISA outline effective August 2024: 18%, 18%, 12%, 26% and 26%.
Audit decisions, not command recall
Questions focus on evidence, control effectiveness, governance, ownership and risk. CISA wants the best auditor action, not the quickest technician action.
Short sets keep the exam pace
Twenty questions in about 32 minutes preserves the exam's 1.6-minute-per-question pace while keeping each free session practical.
Original practice questions
The questions are written for practice against the published CISA objectives. They do not reproduce live or recalled exam items.
CISA preparation strategy
Study for the auditor's point of view
Ask who owns the decision, what evidence is sufficient, and whether the recommendation addresses the root risk. Technical knowledge matters, but CISA keeps pulling you back to assurance and governance.
Spend study time in proportion to the blueprint. Domains 4 and 5 together account for more than half the exam, while Domain 3 carries 12%.
Use missed questions as prompts for review. A wrong answer is useful when it exposes a rule you can apply to the next scenario.
Manage the four-hour paper
You have about 96 seconds per question on average. A difficult item can take longer, but it cannot be allowed to eat five minutes unnoticed.
Qualifiers matter. FIRST, BEST, MOST and PRIMARY can turn two reasonable answers into one correct choice.
When two answers look plausible, prefer the one that fits audit responsibility and control objectives without taking management's job away from management.
Frequently asked CISA questions
How many questions are on the CISA exam?
The current exam has 150 multiple-choice questions and a four-hour, 240-minute time limit.
What score do you need to pass CISA?
ISACA reports certification exam scores on a 200–800 scale. You need 450 or higher to pass. The scaled score is not a fixed percentage-correct conversion.
What do CISA questions look like?
The 2026 candidate guide says each question has a stem and four options, with one correct or best answer. Scenario questions are used, and qualifiers such as MOST likely or BEST matter.
How much does the CISA exam cost?
Current ISACA registration is US$575 for members and US$760 for non-members.
Do I need five years of experience before taking the exam?
No. You can take the exam first. To earn the certification, you need five years of qualifying work experience, subject to ISACA's waiver rules, and you must apply within five years of passing.
What is the CISA retake policy?
ISACA allows four attempts within a rolling 12-month period. After the first failed attempt, the wait is 30 days. After the second and third failed attempts, the wait is 90 days each. The full registration fee applies to every attempt.
How do I maintain CISA after certification?
You need at least 20 CPE hours each year and 120 CPE hours over a three-year reporting period, along with the other ISACA maintenance requirements.
Are the short CISA practice tests on this page free?
Yes. The five mixed sets and five domain-wise tests on this page are free.
Do you have full-length CISA practice tests?
Yes. There are ten 150-question full-length CISA practice tests built on the current five-domain allocation. See the full-length CISA practice tests →
Start short. Go full-length when the weak spots are gone.
Use a free 20-question set to find the gap. Then sit 150 questions on the 240-minute clock when you want a proper CISA benchmark.
