Free CISA practice exam 2026: 20 questions, no signup
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

Free CISA practice exam 2026: 20 questions without signup

Start the free CISA practice exam

20 questions from the real bank, every option explained. No signup, no card.

Start free CISA practice exam →
5 domains 2900 questions 240 min exam
Questions on the exam
150
Time allowed
240 minutes format →
Passing score
450 of 800 — vendor, checked September 4, 2026 detail →
Exam fee
$760 ($575 members) — vendor, checked September 4, 2026 detail →

2900 practice exam questions for CISA, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min CISA readiness check →

CISA certification: requirements, cost and exam format → ·  CISA exam format →  ·  CISA passing score →  · CISA exam cost →

Questions by domain

Sample questions

An auditor-verified inventory matched to observed: Which evidence most strongly supports whether technology co

Information Systems Operations and Business Resilience Hard
During a regional bank audit, management provides a technology inventory and a dashboard showing server uptime. The inventory identifies owners, locations, and dependencies. Which evidence most strongly supports whether technology components are controlled?
  1. A vendor brochure describing recommended infrastructure monitoring capabilities for banks.
    Generic vendor information does not evidence the bank’s implemented controls.
  2. A monthly uptime dashboard showing all critical servers exceeded target availability.
    Availability results do not establish complete component inventory or dependency control.
  3. A signed statement from the infrastructure director confirming inventory accuracy.
    Management representation is less persuasive than independently corroborated operational evidence.
  4. An auditor-verified inventory matched to observed components and recorded dependencies. ✓
    Verification links recorded components, ownership, and dependencies to actual technology.
The trap
Relies primarily on management assertion Uses generic capability information Confuses availability with component governance

All 754 Information Systems Operations and Business Resilience questions →

A risk-based mapping linking business requirements: Which evidence provides the strongest assurance of framewo

Protection of Information Assets Hard
A regional bank claims alignment with a security framework. Auditors find a completed compliance checklist, a risk register, mapped controls, and business-impact ratings. Interviews show several checklist controls lack documented risk rationale. Which evidence provides the strongest assurance of framework application?
  1. The framework certificate displayed by management.
    A certificate alone does not establish applicable controls or local implementation.
  2. A risk-based mapping linking business requirements, risks, and implemented controls. ✓
    This evidence demonstrates framework use connected to organizational requirements and risk.
  3. A consultant’s presentation describing common framework practices used by comparable banks.
    General practices do not prove this bank’s control selection or implementation.
  4. The completed checklist.
    A checklist may confirm review activity without demonstrating risk-based control alignment.
The trap
Relies on symbolic certification. Substitutes industry commentary for bank evidence. Treats compliance enumeration as assurance.

All 754 Protection of Information Assets questions →

Disclose the conflict and assess whether safeguards: What is the most appropriate action?

Information Systems Auditing Process Medium
During a regional bank audit, the auditor discovers a personal relationship with the privileged-access control owner. The relationship could influence judgment. What is the most appropriate action?
  1. Disclose the conflict and assess whether safeguards preserve independence. ✓
    Disclosure and safeguard assessment address independence before affected audit judgments continue.
  2. Ask the control owner to confirm the auditor’s impartiality.
    The subject of the conflict cannot independently establish the auditor’s objectivity.
  3. Continue and disclose the relationship in working papers.
    Documentation alone does not protect objectivity when personal influence remains possible.
  4. Let management decide whether the auditor may continue the engagement.
    Management cannot authorize compromised professional judgment or assume auditor responsibility.
The trap
Treats disclosure as sufficient protection Relies on management confirmation Transfers independence responsibility to management

All 522 Information Systems Auditing Process questions →

A current approved file lists each applicable requirement: Which provides the strongest basis for concluding t

Governance and Management of IT Easy
A regional bank’s audit scope requires evaluating whether a new customer-data process follows applicable requirements. The team has four possible evidence sources. Which provides the strongest basis for concluding that the process meets relevant requirements?
  1. A current matrix maps applicable requirements to controls, owners, evidence, exceptions, review status, and remediation tracking.
    The matrix is useful but lacks the approved file’s documented test results and rationale.
  2. A current approved file lists each applicable requirement, mapped control, test result, owner, exception rationale, and remediation status. ✓
    This source traces requirements through controls, testing, ownership, exceptions, and remediation.
  3. Training records show completion, acknowledgment, refresher participation, manager review, and corrective action for affected staff.
    Training evidence supports awareness but does not establish process compliance comprehensively.
  4. A policy cites several standards.
    Policy references alone do not demonstrate implemented and tested compliance.
The trap
Confuses references with implementation evidence Shows training rather than process compliance Lacks complete testing support

All 522 Governance and Management of IT questions →

Approved steering minutes record scope: Which evidence is BEST?

Information Systems Acquisition, Development and Implementation Medium
A regional bank audit examines project governance for a core banking upgrade. The auditor must select the strongest evidence that the project’s major scope, cost, and risk decision was authorized. Which evidence is BEST?
  1. Approved steering minutes record scope, cost, risk, and sponsor authorization. ✓
    Approved minutes directly evidence governance review and authorization.
  2. A developer’s meeting notes describe the preferred design and expected implementation schedule.
    Developer notes lack evidence of sponsor or steering authorization.
  3. A project manager’s spreadsheet lists estimated costs and current milestones.
    The spreadsheet shows information but not authorized governance decisions.
  4. An email from the vendor confirms that configuration work has started.
    Vendor activity does not demonstrate internal authorization of major changes.
The trap
Uses supplier activity as governance evidence. Confuses project tracking with approval evidence. Confuses technical preference with governance approval.

All 348 Information Systems Acquisition, Development and Implementation questions →

Undocumented sanitization of retired devices: Which control gap is most consequential?

Information Systems Operations and Business Resilience Hard
A healthcare network is retiring laptops used for patient administration. Asset records show ownership and retirement dates, but eight retired devices lack documented media sanitization, while licenses were properly removed. Which control gap is most consequential?
  1. Failure to record retirement dates for devices with documented sanitization and license removal.
    Retirement dates are recorded, making this concern unsupported by evidence.
  2. Undocumented sanitization of retired devices. ✓
    Patient data could remain recoverable despite otherwise completed retirement activities.
  3. Incomplete documentation of license removal evidence.
    License evidence is complete, so this does not represent the stated gap.
  4. Missing ownership records for devices already retired and removed from service.
    Ownership records are stated as complete for the retired devices.
The trap
Invents a missing lifecycle record Contradicts supplied asset evidence Overlooks completed license control

All 754 Information Systems Operations and Business Resilience questions →

Backup cooling lacks tested outage capability: Which gap is most consequential?

Protection of Information Assets Easy
A healthcare network reviews physical and environmental safeguards for its communications room. Access logs are reviewed, cameras function, and temperature alarms are installed. However, the backup cooling system has never been tested under load, and an outage could disrupt patient connectivity. Which gap is most consequential?
  1. Camera footage retention is shorter than management prefers.
    Retention concerns are less consequential than untested environmental continuity capability.
  2. Temperature alarms use manual rather than automated escalation.
    Escalation matters, but cooling failure remains the greater availability risk.
  3. The room lacks a visitor sign-in sheet.
    Visitor records matter, but untested cooling threatens sustained equipment availability.
  4. Backup cooling lacks tested outage capability. ✓
    Untested cooling leaves critical connectivity exposed despite installed environmental alarms.
The trap
Prioritizes documentation over resilience. Focuses on notification method alone. Overstates surveillance retention impact.

All 754 Protection of Information Assets questions →

Absence of monitoring and review for emergency privileged: Which gap is most consequential for the defined ass

Information Systems Auditing Process Hard
A healthcare network review covers confidentiality and availability of electronic patient records. The auditor finds outdated procedures, incomplete privileged-access recertifications, and no review of emergency accounts. Which gap is most consequential for the defined assessment scope?
  1. Minor inconsistencies between the network’s policy titles and assessment workpapers
    Title inconsistencies do not materially threaten confidentiality or availability directly.
  2. Absence of monitoring and review for emergency privileged accounts ✓
    Unreviewed emergency privileges can enable unauthorized access to patient records.
  3. Outdated procedures that do not reflect current terminology
    Terminology weaknesses matter less than unchecked access to sensitive records.
  4. Incomplete recertification evidence for ordinary user accounts
    Incomplete evidence is concerning, but emergency privileges present greater exposure.
The trap
Prioritizes documentation appearance Confuses administrative inconsistency with risk Overlooks higher-risk privileged access

All 522 Information Systems Auditing Process questions →

CISA exam: the facts

How many questions are on the CISA exam?

150, as published by the exam vendor.

How long is the CISA exam?

240 minutes. Across 150 questions that is about 96 seconds per question.

What topics does the CISA exam cover?

5 domains: Information Systems Operations and Business Resilience, Protection of Information Assets, Governance and Management of IT, Information Systems Auditing Process, Information Systems Acquisition, Development and Implementation. Weights: Information Systems Operations and Business Resilience 26%, Protection of Information Assets 26%, Governance and Management of IT 18%, Information Systems Auditing Process 18%, Information Systems Acquisition, Development and Implementation 12%.

How many CISA practice exam questions does Certsqill have?

2900, spread across 5 exam domains. Every one shows all options, which is correct, and why each of the others is not.

CISA exam: how many questions, how much time?

The real exam has 150 multiple-choice questions and four hours (240 minutes) to answer them, which leaves just over a minute and a half per question. ISACA reports the result on a scale from 200 to 800, and 450 is the pass mark — a scaled score, not a percentage of correct answers.

The questions follow the five domains of ISACA’s exam content outline, weighted 18% for the auditing process, 18% for governance and management of IT, 12% for acquisition, development and implementation, 26% for operations and business resilience, and 26% for protection of information assets. Good CISA exam practice questions follow the same balance.

How to use CISA sample questions

CISA sample questions are most useful when you treat each one as a lesson rather than a score. Read the scenario, decide what the auditor’s role is, choose an answer — and then read the explanation for every option, not only the correct one. On CISA exam questions, the wrong options are often actions that would be right for a manager or an engineer, but not for an independent auditor.

Work by domain first, then mix. CISA exam sample questions grouped by domain show you where you are weak; a mixed CISA sample test of 150 questions in four hours shows whether your pace holds. Because ISACA’s score report gives no question-level feedback, the explanations you read in practice are the only place you find out why you got something wrong.

Free CISA certification sample questions from ISACA

ISACA offers a free 10-question CISA practice quiz on its certification page. It is a good first set of sample CISA exam questions and shows how ISACA phrases its CISA test questions. For a domain-by-domain picture you need more than ten questions; Certsqill’s CISA questions are expert-developed against the five domains, every answer option is explained, and your readiness score is shown per domain. There is a 7-day money-back guarantee.

CISA dumps and “questions and answers PDF” files

A CISA exam dump claims to contain questions from the live exam. ISACA’s candidate guide forbids candidates from selling, distributing, sharing, disclosing or discussing exam content, and lists consequences that include a ban from all ISACA exams, voided scores and revocation of ISACA membership and any certifications held. A file sold as CISA exam questions and answers PDF exists only if someone broke those rules — or it is invented and only presented as real.

Either way, a CISA dump is poor preparation: you cannot check whether the answers are correct, there are no explanations, and memorised answers do not help when the scenario changes. Practice questions written against ISACA’s published outline teach the reasoning the exam tests.

CISA study guide PDFs: what to check

If you searched for a CISA Certified Information Systems Auditor study guide PDF free download, check where the file comes from. ISACA sells its own CISA Review Manual in digital and print form, so a free copy of it is not an ISACA release, and an unauthorised copy of any commercial study guide is a copyright problem.

Whichever CISA Certified Information Systems Auditor study guide you use, pair it with questions you can study from: a guide explains the material, practice questions show whether you can apply it to ISACA’s scenarios.

CISA certification salary: what ISACA states

ISACA’s CISA overview displays “US$149K+ average annual salary” and lists “22% received a pay boost” among the benefits of the certification. It does not name the survey, the year or the countries behind these figures. A CISA job salary for a specific role depends on the market and the position, so use ISACA’s figure as a headline, not as a benchmark for an offer.

CISA practice: questions people ask

How many questions on the CISA exam, and how much time?

150 multiple-choice questions in four hours (240 minutes). Source: ISACA candidate guide, checked 9 October 2026.

Are Certsqill’s CISA questions taken from the real exam?

No. They are expert-developed against ISACA’s published exam content outline, with an explanation for every answer option. ISACA forbids sharing live exam content.

Are CISA exam dumps allowed?

No. ISACA’s candidate guide prohibits selling, sharing or disclosing exam content and lists sanctions including a ban from ISACA exams and revocation of certifications. Checked 9 October 2026.

Is there a salary figure for CISA salary jobs from ISACA?

ISACA’s CISA page shows “US$149K+ average annual salary” without naming the survey or year behind it. Checked 9 October 2026.

CISA in detail

Would you pass CISA today?

Five minutes, and you get a score per domain — not one number, but which section to open tonight.

Test your CISA readiness — free
Certsqill CISA question bank · 2900 questions across 5 domains · Every answer, right and wrong, comes with its own explanation.