ISACA CISM Practice Test
Nine free CISM practice tests for the exam outline in force through 2 November 2026. Each test has 20 questions on a roughly 32-minute clock, so you practise at the same 1.6-minutes-per-question pace as the 150-question CISM exam.
Mixed-set CISM practice tests
Use these when you want all four domains in one short paper. The current blueprint gives the largest share to Information Security Program and Incident Management, so those domains appear most often.
Domain-wise CISM practice tests
A mixed set tells you where the gap is. These four focused tests let you stay on that domain until the management logic starts to feel familiar.
Twenty questions finds the weak domain.
One hundred and fifty tests your four-hour judgment.
Use the free sets for diagnosis. When you want the full CISM workload, the full-length tests run 150 questions in 240 minutes, use the same current four-domain blueprint and return an estimated 200–800 practice score against the 450 benchmark.
| Free tests above | Full-length tests | |
|---|---|---|
| Questions | 20 | 150 |
| Time limit | ~32 minutes | 240 minutes |
| Coverage | Mixed set or one domain | All four current domains |
| Score you get | — | Estimated 200–800 practice score against 450 |
| Per-domain breakdown | — | Included |
| Answer format | Single best answer | Single best answer |
| Exam conditions | Timed short practice | Full four-hour paper |
| Report | — | Domain-level performance result |
| Number available | 9 | 10 |
| Price | Free | From $2₹99£1.47€1.70 per test |
How to use these tests in your study plan
Short tests and full papers do different jobs. Use them in that order.
Benchmark
Take two mixed sets before a heavy revision block. Look past the headline score and note which domain keeps producing the same kind of wrong decision.
Start with Practice Test 1 →Drill the gap
Move to the domain test for that weak area. CISM questions often turn on ownership, sequence and business alignment, so review why the tempting answer loses.
Start with Information Security Program →Dress rehearsal
When the domain gaps are smaller, sit 150 questions under the four-hour clock. That is where pacing and management judgment have to hold together.
Get Full-Length Tests →About the ISACA CISM exam
The current exam remains a 150-question, four-hour ISACA certification exam. The content outline changes on 3 November 2026, so the date you plan to sit matters.
What CISM tests
CISM is built around information security management: governance, risk, the information security program and incident management. The current outline puts 63% of its weight on the program and incident domains, which is why those two areas dominate serious preparation.
ISACA reports exam results on a 200–800 scale. A score of 450 or higher passes. That number is a scaled score, not a percentage target.
For exams through 2 November 2026, the weights are 17% Governance, 20% Risk Management, 33% Information Security Program and 30% Incident Management. From 3 November 2026, ISACA changes them to 18%, 20%, 33% and 29% respectively. The free and full-length tests linked on this page cover the current outline through 2 November 2026.
Exam format
Questions: 150 multiple-choice questions.
Duration: 4 hours / 240 minutes.
Score scale: 200–800.
Passing standard: 450.
Delivery: PSI test center or remote proctoring.
Exam fee: US$575 for ISACA members and US$760 for non-members.
Certification and maintenance
Experience: Five or more years of information security management experience. ISACA allows up to two years of experience waivers.
When to apply: Within five years of passing the exam.
Application fee: US$50.
CPE: At least 20 hours each year and 120 hours over a three-year reporting period.
Annual maintenance fee: US$45 for members and US$85 for non-members.
CISM domain weights through 2 November 2026
The current four-domain blueprint is 17 / 20 / 33 / 30. A 150-question paper at those proportions works out to about 26 / 30 / 49 / 45 questions.
| Domain | Topic | Current weight | Approx. questions / 150 |
|---|---|---|---|
| Domain 1 | Information Security Governance | 17% | ≈26 |
| Domain 2 | Information Security Risk Management | 20% | 30 |
| Domain 3 | Information Security Program | 33% | ≈49 |
| Domain 4 | Incident Management | 30% | 45 |
How our CISM practice tests are written
Management decisions come first. The questions are built around the level CISM expects: governance, authority, risk ownership, program decisions and incident leadership. A technically workable answer can still lose if it is owned by the wrong role or happens in the wrong order.
The current blueprint controls the mix. Mixed sets follow the 17 / 20 / 33 / 30 outline used through 2 November 2026. The full-length series turns that into a fixed 26 / 30 / 49 / 45 distribution across 150 questions.
The clock stays proportional. CISM gives four hours for 150 questions. The free 20-question sets use about 32 minutes, while the full-length papers use the complete 240-minute window.
Questions are original. They are written for practice against the published CISM domains. The goal is to make you choose between plausible management actions, not to memorize a live exam item.
CISM exam preparation tips
Study strategy
Start with the two heaviest domains. Information Security Program and Incident Management account for 63% of the current outline. Give them the largest share of your practice, then use your results to rebalance.
Read for ownership. Many CISM questions become easier once you identify who is accountable for the decision. Senior management, the risk owner, the security manager and the technical team are not interchangeable.
Review the reason, not just the key. If two answers looked defensible, write down why one was better. That distinction is usually more valuable than memorizing the correct letter.
Test-taking strategy
Protect the four-hour pace. You have about 96 seconds per question. If one item is consuming several minutes, make your best decision, mark it and move.
Watch words such as BEST, FIRST and MOST. CISM often gives you several reasonable actions. The task is to choose the one that belongs first or gives management the strongest assurance.
Prefer the answer that fixes the decision process. When the scenario is about governance or risk, a tactical technical fix may be useful but still sit one level too low.
Frequently asked questions
The CISM exam contains 150 multiple-choice questions and allows 4 hours, or 240 minutes.
ISACA reports scores on a 200–800 scale. A score of 450 or higher passes. It is a scaled score, so 450 should not be treated as a percentage of questions correct.
ISACA currently lists the exam at US$575 for members and US$760 for non-members.
The current outline remains in force through 2 November 2026. ISACA's updated outline starts 3 November 2026. The domain weights move from 17 / 20 / 33 / 30 to 18 / 20 / 33 / 29.
Yes. The free tests here are 20-question practice sets. The ISACA CISM full-length practice tests run 150 questions in 240 minutes, cover all four current domains, and return an estimated 200–800 practice score against the 450 benchmark. There are 10 full papers, or 1,500 questions in the complete set.
Yes. The five mixed sets and four domain-wise tests on this page are free.
Yes. Passing the exam and earning the certification are separate steps. You have five years after passing to submit the certification application and meet ISACA's experience requirements.
ISACA allows four attempts within a rolling 12-month period. After the first unsuccessful attempt, the wait is 30 days. The next two retakes each require a 90-day wait from the previous attempt, and every attempt requires the full registration fee.
CISM holders must report at least 20 CPE hours each year and at least 120 over a three-year reporting period. ISACA currently charges an annual maintenance fee of US$45 for members and US$85 for non-members.
Start short. Finish with the full four hours.
Use a free 20-question set to find the weak domain. When you are ready to test pacing and management judgment together, move to a 150-question full-length paper.
