CISA practice examsIn development
Certified Information Systems Auditor
The CISA certification validates expertise in auditing, controlling, monitoring, and assessing an organization's information technology and business systems. It is the globally recognized standard for IS audit professionals.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Information Systems Auditing Process | 21% |
| Governance and Management of IT | 17% |
| Information Systems Acquisition, Development, and Implementation | 12% |
| Information Systems Operations and Business Resilience | 23% |
| Protection of Information Assets | 27% |
Two sample questions
1. An IS auditor is evaluating an organization that uses containerized microservices in production. Hundreds of containers are deployed daily. What should concern the auditor MOST?
- The container orchestration platform uses open-source software to meet the requirements of both internal policies and external regulations
- Container logs are aggregated to a centralized logging system using a structured methodology aligned with recognized industry standards
- Containers have shorter lifecycles than virtual machines within the context of the organizations overall security posture assessment
- Container images are pulled from a public registry without vulnerability scanning or image signing verification — correct
Why: Pulling unvetted container images from public registries introduces supply chain risk. Images may contain vulnerabilities, malware, or malicious code. Without vulnerability scanning and image verification, compromised containers could be deployed directly into production.
2. Which is the MOST effective method for ensuring IT policies remain current and relevant?
- Allowing IT policies to remain unchanged indefinitely once approved by senior management
- Automatically copying IT policies from industry competitors to ensure following best practices
- Assigning a single individual to review all IT policies once every five years on a predetermined date
- Establishing a regular policy review cycle with triggers for additional review based on significant changes — correct
Why: Regular review cycles with triggers for additional review based on significant changes keep policies current.
The real CISA exam
| Length | 240 minutes (4 hours) |
|---|---|
| Questions | 150 |
| Pass mark | 450 out of 800 |
| Price | $575 (ISACA members) / $760 (non-members) |
| Recommended before you sit it | 5+ years of IS audit, control, assurance, or security experience (waivers available for up to 3 years) |
| Valid for | 3 years |
Exam facts as published by ISACA; always check the vendor’s page before you book.
Study CISA with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.