Free CISM mock exams
Full-length ISACA Certified Information Security Manager (CISM) rehearsals: 150 questions in 240 minutes, drawn to the official domain weights and scored on the same scale as the real exam. Pass mark 450 / 800.
- Questions
- 150~1.6 min each
- Time limit
- 240 minserver-timed
- Pass mark
- 450on a 200–800 scale
- Papers
- 3retake any of them
More ways to rehearse
Every attempt draws questions you haven't met yet first · Pro.
A full-length paper drawn to the same domain weights, from the questions we rate hardest — the ones that combine two facts or weigh workable options against each other.
One exam domain at the real exam's pace — for the domain your last mock went worst in.
What's in a CISM mock paper
Each paper draws its questions per domain in the same proportions ISACA publishes for the real CISM — so a mock that goes badly in one domain is telling you something a randomly-drawn quiz couldn't.
| Domain | Official weight | Questions drawn | Share of paper |
|---|---|---|---|
| Information Security Governance | 18% | 27 | 18% |
| Information Security Risk Management | 20% | 30 | 20% |
| Information Security Program | 33% | 50 | 33% |
| Incident Management | 29% | 43 | 29% |
| Total | 100% | 150 | 100% |
What a CISM paper is shaped like
Which way this particular paper applies pressure.
The clock
At roughly 1.6 minutes a question, the pacing is comfortable but not generous. You can afford to think on a hard question, and you cannot afford to do it twice. Most candidates finish with time for a second pass if they keep the first pass moving.
The weighting
Information Security Program is the largest domain at 33%, but with 4 domains in play no single one decides the result. A mock score here is usually a fair reflection of overall coverage rather than a verdict on one topic.
The standard
The pass mark is 450 on the 200–800 scale. Because scaling adjusts for the difficulty of the particular set you were served, there is no fixed number of questions that guarantees it — which is exactly why a single mock result means less than a consistent one.
Pacing a CISM paper
Where you need to be on the clock, quarter by quarter.
| Checkpoint | Elapsed | Be at question | Questions left |
|---|---|---|---|
| First quarter | 60 min | 38 | 112 |
| Halfway | 120 min | 75 | 75 |
| Three quarters | 180 min | 113 | 37 |
| Time called | 240 min | 150 | 0 |
What trips people up on a CISM mock
CISM is a management exam, and it is written that way. The questions rarely ask how a control works; they ask what a security manager should do about a situation, and most of them hinge on a qualifier: FIRST, BEST, MOST or PRIMARY. Several options are usually reasonable things to do eventually. The mark goes to the one that comes first, or that best serves the business, so read the qualifier before the options and treat every review of a wrong answer as a question of sequence, not of knowledge.
The most common wrong pick is the technical fix. Experienced engineers see a breach, a misconfiguration or a failing control and reach for the option that repairs it directly. The CISM answer is usually one step earlier: confirm the business impact, involve the risk or asset owner, check the policy or the risk appetite, or escalate to the person with the authority to decide. If your mock misses cluster around "the security team should just do it", that is the pattern to unlearn.
The information security program is the largest domain, and on the 2026 outline it carries the new information security architecture area alongside resources, frameworks, policies, control design, testing, awareness and third-party management. Its questions range widely, so a weak score here is rarely one gap. Break your misses down by subtopic before deciding what to restudy.
Incident management is close behind and is the most concrete domain: plan contents, classification, the business impact analysis and its recovery objectives, containment, communication and post-incident review. Questions often turn on who decides (the incident manager, the business owner, senior management) and on the difference between recovery objectives that sound alike, so learn each objective as the question it answers.
Governance is the smallest domain but its logic runs through the whole paper: the board is accountable, the business owns its risk, and security serves the organization's objectives. Risk management questions lean on the same idea, since the right response is the one that fits the agreed appetite rather than the lowest possible risk. Before booking, check that no domain sits well below the others across two mocks in a row; a strong program score can lift the total over the line on a mock and still leave a gap that a different draw exposes.
Before you sit a CISM mock
CISM mock exams: your questions
Source
Exam structure, domain weights and scoring on this page come from the official CISM exam guide.
- ISACA CISM Exam Content Outline — ISACA