Certified Information Systems Auditor® (CISA®): the practice module
Exam body: ISACA. Verified for CISA Examination Content Outline (Effective August 2024), ISACA Certification Exam Candidate Guide Version 1.26 on October 19, 2026.
What it covers
Covers: standard multiple-choice questions written to this exam’s outline, format and timing.
Does not cover: nothing else; the real exam is multiple-choice throughout.
Question format
- Every question has exactly 4 options.
- One correct answer per question.
- Not allowed as an option: “all of the above”, “none of the above”.
- Stems follow the exam’s conventions, such as “Which of the following actions should the IS auditor take?”, “Which of the following areas is the MOST important?”, “The IS auditor should:”.
Exam mode
The real exam is 150 questions in 240 minutes. Exam mode keeps that pace for any number of questions.
Topics
The official topic list, as the exam body names it. Your questions must use these names; the coverage dashboard compares your set to each topic’s official weight.
| Topic | Weight | Subtopics |
|---|---|---|
| Information System Auditing Process | 18% | IS Audit Standards, Guidelines, Functions, and Codes of Ethics · Types of Audits, Assessments, and Reviews · Risk-Based Audit Planning · Types of Controls and Considerations · Audit Project Management · Audit Testing and Sampling Methodology · Audit Evidence Collection Techniques · Audit Data Analytics (including audit algorithms) · Reporting and Communication Techniques · Quality Assurance and Improvement of Audit Process |
| Governance and Management of IT | 18% | Laws, Regulations, and Industry Standards · Organizational Structure, IT Governance, and IT Strategy · IT Policies, Standards, Procedures and Practices · Enterprise Architecture (EA) and Considerations · Enterprise Risk Management (ERM) · Privacy Program and Principles · Data Governance and Classification · IT Resource Management · IT Vendor Management · IT Performance Monitoring and Reporting · Quality Assurance and Quality Management of IT |
| Information Systems Acquisition, Development, and Implementation | 12% | Project Governance and Management · Business Case and Feasibility Analysis · System Development Methodologies · Control Identification and Design · System Readiness and Implementation Testing · Implementation Configuration and Release Management · System Migration, Infrastructure Deployment, and Data Conversion · Post-Implementation Review |
| Information Systems Operations and Business Resilience | 26% | IT Components · IT Asset Management · Job Scheduling and Production Process Automation · System Interfaces · Shadow IT and End-User Computing (EUC) · Systems Availability and Capacity Management · Problem and Incident Management · IT Change, Configuration, and Patch Management · Operational Log Management · IT Service Level Management · Database Management · Business Impact Analysis (BIA) · System and Operational Resilience · Data Backup, Storage, and Restoration · Business Continuity Plan (BCP) · Disaster Recovery Plans (DRP) |
| Protection of Information Assets | 26% | Information Asset Security Policies, Frameworks, Standards, and Guidelines · Physical and Environmental Controls · Identity and Access Management · Network and End-Point Security · Data Loss Prevention (DLP) · Data Encryption · Public Key Infrastructure (PKI) · Cloud and Virtualized Environments · Mobile, Wireless, and Internet-of-Things (IoT) Devices · Security Awareness Training and Programs · Information System Attack Methods and Techniques · Security Testing Tools and Techniques · Security Monitoring Logs, Tools, and Techniques · Security Incident Response Management · Evidence Collection and Forensics |
Trademarks
DoMcq is an independent practice tool. It is not affiliated with, endorsed by, sponsored by or approved by any exam body. Exam names are used only to say which exam a module is for. DoMcq holds no exam content: a module is the exam body's published topic names, the question format, the exam's timing, its published weights and a prompt, and every question in DoMcq is a student's own. The marks below belong to their owners. Trademarks
DoMcq is an independent practice tool and is not affiliated with, sponsored by or endorsed by ISACA; the names are used only to identify the exam. ISACA® and the names of ISACA certifications, including Certified Information Systems Auditor® (CISA®) and Certified Information Security Manager® (CISM®), are trademarks of ISACA.
Use it
Convert questions I already haveGenerate new questions
Free to start. DoMcq never writes or fixes questions; it checks the file your AI produces and gives you the practice system.