Free CISA mock exams
Full-length ISACA Certified Information Systems Auditor (CISA) rehearsals: 150 questions in 240 minutes, drawn to the official domain weights and scored on the same scale as the real exam. Pass mark 450 / 800.
- Questions
- 150~1.6 min each
- Time limit
- 240 minserver-timed
- Pass mark
- 450on a 200–800 scale
- Papers
- 3retake any of them
More ways to rehearse
Every attempt draws questions you haven't met yet first · Pro.
A full-length paper drawn to the same domain weights, from the questions we rate hardest — the ones that combine two facts or weigh workable options against each other.
One exam domain at the real exam's pace — for the domain your last mock went worst in.
What's in a CISA mock paper
Each paper draws its questions per domain in the same proportions ISACA publishes for the real CISA — so a mock that goes badly in one domain is telling you something a randomly-drawn quiz couldn't.
| Domain | Official weight | Questions drawn | Share of paper |
|---|---|---|---|
| Information Systems Auditing Process | 18% | 27 | 18% |
| Governance and Management of IT | 18% | 27 | 18% |
| Information Systems Acquisition, Development and Implementation | 12% | 18 | 12% |
| Information Systems Operations and Business Resilience | 26% | 39 | 26% |
| Protection of Information Assets | 26% | 39 | 26% |
| Total | 100% | 150 | 100% |
What a CISA paper is shaped like
Which way this particular paper applies pressure.
The clock
At roughly 1.6 minutes a question, the pacing is comfortable but not generous. You can afford to think on a hard question, and you cannot afford to do it twice. Most candidates finish with time for a second pass if they keep the first pass moving.
The weighting
Information Systems Operations and Business Resilience is the largest domain at 26%, but with 5 domains in play no single one decides the result. A mock score here is usually a fair reflection of overall coverage rather than a verdict on one topic.
The standard
The pass mark is 450 on the 200–800 scale. Because scaling adjusts for the difficulty of the particular set you were served, there is no fixed number of questions that guarantees it — which is exactly why a single mock result means less than a consistent one.
Pacing a CISA paper
Where you need to be on the clock, quarter by quarter.
| Checkpoint | Elapsed | Be at question | Questions left |
|---|---|---|---|
| First quarter | 60 min | 38 | 112 |
| Halfway | 120 min | 75 | 75 |
| Three quarters | 180 min | 113 | 37 |
| Time called | 240 min | 150 | 0 |
What trips people up on a CISA mock
CISA asks what an IS auditor should do, and the auditor rarely fixes anything. When a question describes a weak control, an unauthorised change or a missing approval, the tempting option repairs it. The CISA answer is usually to gather evidence, assess the risk, report it to the right party or recommend a control, because an auditor who builds or corrects the control has lost the independence to audit it. If your misses cluster around "the auditor should just correct it", that is the pattern to unlearn.
Sequence is the other common trap. Several options are often things an auditor would do eventually, and the question asks for the FIRST, BEST or MOST important one. Understanding the process before testing it, confirming a finding before reporting it, and looking at the risk before the control are the usual orderings. Read the qualifier before the options.
Operations and business resilience and the protection of information assets carry half the paper between them, and both reach well beyond pure technology: a business impact analysis that sets recovery objectives, a backup that is never restore-tested, or an access review that nobody acts on. These questions reward knowing what good evidence of a working control looks like, not how to configure one.
The audit-process domain looks like theory and decides more questions than its weight suggests. Risk-based planning, sampling, the difference between compliance and substantive testing, evidence reliability and who receives the report run through scenarios in every other domain. Candidates from engineering backgrounds often lose marks here first.
Governance and management questions are about alignment and accountability: IT strategy serving the business, the board and senior management owning risk, and contracts, service levels and metrics that let you show whether IT delivers. Acquisition and implementation is the smallest domain, so a weak score there costs less than the same weakness in the two large ones. Before booking, check that no domain sits well below the others across two mocks in a row.
Before you sit a CISA mock
CISA mock exams: your questions
Source
Exam structure, domain weights and scoring on this page come from the official CISA exam guide.
- ISACA CISA Exam Content Outline — ISACA