CISA / EXAM GUIDE Know the format.
Build a plan for every question.
Understand CISA questions, timing, and scoring so you can practise with a clear purpose.
Published by PrepForCerts · Editorial responsibility and sources
How Many Questions Are on the CISA Exam? A Complete 2026 Guide
The ISACA CISA exam structure directly impacts how you should prepare. From question count to time management, here's everything CISA candidates need to know.
The ISACA CISA certification from ISACA validates your expertise in this field. This guide covers 150 questions across 240 minutes, the 450/800 passing threshold, and strategic approaches for each question type. From time management to scoring mechanics, here's everything candidates need for effective exam preparation.
Plan your next step
CISA has 150 questions and 240 minutes. It uses multiple-choice questions with a fixed exam length. CISA requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published.
- Questions
- 150
- Time Limit
- 240 minutes
- Passing Score
- 450/800
Provider reference: CISA requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published. Study schedules and practice percentages are planning examples, not official requirements or pass predictions. Confirm current fees and eligibility before purchase. Exam details · Maintenance policy
The ISACA Certified Information Systems Auditor (CISA) exam contains 150 multiple-choice questions with a generous 240-minute (4-hour) time limit. The passing score is 450 on a scale of 200-800, utilizing ISACA's scaled scoring model. CISA is recognized globally as the gold standard for IT auditing, control, and assurance professionals, currently held by over 151,000 experts worldwide.
With an average of 1 minute and 36 seconds per question, time pressure is rarely the primary challenge on the CISA exam. Instead, the real difficulty lies in grasping ISACA's distinctive questioning style, which heavily emphasizes the "best" or "most important" auditor action in complex, ambiguous scenarios. Passing CISA requires adopting a strict audit and risk-based mindset.
CISA Domain Breakdown (5 Domains)
The CISA exam evaluates your competence across five distinct job practice domains. Understanding this distribution is crucial for focusing your study efforts:
| Domain | % of Exam | ~Questions | Key Topics |
|---|---|---|---|
| 1. IS Auditing Process | 18% | Varies by exam form | Audit planning, risk-based auditing, execution, reporting, follow-up, evidence gathering |
| 2. Governance and Management of IT | 18% | Varies by exam form | IT governance frameworks, strategic alignment, policies, enterprise architecture, risk management |
| 3. IS Acquisition, Development, Implementation | 12% | Varies by exam form | SDLC, project management, post-implementation reviews, change management |
| 4. IS Operations and Business Resilience | 26% | Varies by exam form | IT service management, database admin, disaster recovery (DRP), business continuity (BCP) |
| 5. Protection of Information Assets | 26% | Varies by exam form | Access controls, network security, encryption, physical security, PKI, cyber attacks |
Question Format and ISACA's Testing Philosophy
The CISA exam is entirely multiple-choice with exactly four options per question. There are no performance-based questions (PBQs), simulations, or drag-and-drop elements. However, ISACA questions are famously tricky. You must adapt to the "ISACA way":
The Audit Mindset
- "Best" and "Most Important": Often, 3 or even all 4 answers are technically correct actions. You must identify what ISACA considers the optimal action based on audit standards and risk management.
- Auditor vs. Manager: A CISA candidate must think like an auditor. The correct answer is usually to recommend, report, or advise, rather than to implement or configure. If a question asks what to do about a missing patch, an auditor notes the deficiency in the report; an IT admin installs the patch.
- Risk dictates action: The answer that addresses the highest risk to the business is almost always the right choice.
- Independence: An IS auditor must remain independent. They do not design systems they will later audit.
Time Management Strategy
With 240 minutes for 150 questions, rushing is unnecessary. A structured approach works best:
- First pass (120-150 minutes): Answer every question. Flag questions where you are debating between two options. Do not leave any blank.
- Break (10 minutes): Step away from the screen, stretch, and clear your head. Reading ISACA questions is mentally exhausting.
- Second pass (45-60 minutes): Review all flagged questions. Re-read the scenario carefully. Pay attention to qualifiers like "FIRST", "GREATEST", or "PRIMARY".
- Final review (20 minutes): Ensure all questions are answered.
With 150 questions in 240 minutes, time management is critical. Here's how to approach it:
Calculate Your Average Time Per Question Divide your total time by the number of questions to get your baseline pace. For ISACA CISA, this works out to approximately 96 seconds per question on average.
Strategy for Maximum Efficiency: 1. First Pass (60% of time): Answer all questions you're confident about. Mark difficult questions for review. 2. Second Pass (30% of time): Return to marked questions and work through them carefully. 3. Final Review (10% of time): Check your answers, especially where your reasoning was uncertain.
Don't Get Stuck
If you spend more than 2 minutes on any single multiple-choice question without progress, mark it and move on. Spending too much time on difficult questions can prevent you from answering easier questions you know well.
CISA vs. Other Governance & Security Certifications
| Certification | Questions | Time Limit | Passing Score | Cost | Primary Focus |
|---|---|---|---|---|---|
| CISA (ISACA) | 150 | 240 minutes (4 hours) | 450/800 | Check current provider price | IS Auditing & Assurance |
| CISM (ISACA) | 150 | 240 minutes (4 hours) | 450/800 | Check current provider price | Security Management |
| CRISC (ISACA) | 150 | 240 minutes (4 hours) | 450/800 | Check current provider price | IT Risk Management |
| CISSP (ISC)² | 100–150 (CAT) | 180 minutes (3 hours) | 700/1000 | Check current provider price | Broad Information Security |
| CIA (IIA) | Part 1: 125; Parts 2 and 3: 100 each | Part 1: 150 min; Parts 2 and 3: 120 min each | 600/750 | Varies | Internal Auditing (Broad) |
CISA vs. CISM: CISA is designed for auditors who evaluate and report on IT controls. CISM is for managers who design and oversee security programs. If your job involves checking compliance and evaluating risk controls, pursue CISA. If you build security strategies, pursue CISM.
Study Preparation Guide
Candidates typically need 8-12 weeks of study at 2-3 hours daily. Preparation is heavily reliant on practice questions:
- ISACA QAE Database: The official Questions, Answers, and Explanations database is widely considered the most vital resource. Complete all questions, and more importantly, read the explanations for why the incorrect options are wrong.
- CISA Review Manual (CRM): ISACA's official textbook. It is dense but acts as the ultimate source of truth for ISACA terminology.
- Audit standards: Familiarize yourself with ISACA's ITAF (Information Technology Assurance Framework).
ISACA CISA Exam Structure Overview
The ISACA CISA exam is designed to thoroughly assess your knowledge and skills. Here's the complete breakdown of what you'll face:
Total Questions: 150 Time Allowed: 240 minutes Passing Score: 450/800 Number of Exams: 1
The exam is administered by ISACA and can be taken at authorized testing centers or online with live proctoring. The questions are designed to test both theoretical knowledge and practical application of concepts.
Types of Questions You Will See
The ISACA CISA exam includes fixed-length multiple-choice questions. Understanding each question type helps you prepare effectively:
Multiple-Choice Questions (MCQ) The majority of questions are traditional multiple-choice with four answer options. Read the item and select the single best answer.
CISA uses a fixed-length exam of 150 multiple-choice questions in four hours. You can review questions within the exam session. CISA requires 450 on ISACA’s 200–800 scaled score. The score is not a raw percentage or a fixed number of correct answers.
Question Distribution by Domain
Questions are distributed across all exam domains based on their weight in the exam objectives. Higher-weighted domains have more questions. Review the official exam objectives to understand the percentage breakdown for each domain.
Scoring and Passing Requirements
Understanding how ISACA CISA scoring works helps you set realistic goals:
CISA uses a fixed-length exam of 150 multiple-choice questions in four hours. You can review questions within the exam session. CISA requires 450 on ISACA’s 200–800 scaled score. The score is not a raw percentage or a fixed number of correct answers.
Understanding the passing standard: CISA requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published.
Score Report
After the exam, you receive a score report showing your performance by domain. If you don't pass, this report helps identify weak areas for focused study before your retake. Use the available report feedback to identify study topics; it is not a raw percentage breakdown.
How to Prepare for 150 Questions
Preparing for 150 questions across all domains requires a strategic approach:
1. Master the Exam Objectives Every question is tied to the official exam objectives. Get the current objectives from ISACA and use them as your study checklist.
2. Practice with Realistic Questions Complete at least 500+ practice questions before your exam. Focus on questions that match the exam format, including fixed-length multiple-choice questions.
3. Time Your Practice Exams Take full-length practice exams under timed conditions. This builds stamina and helps you calibrate your pacing for the real exam.
4. Focus on Weak Domains Use practice test results to identify domains where you score below 80%. Concentrate additional study time on these areas.
5. Understand, Don't Memorize With 150 questions covering diverse scenarios, memorization alone won't work. Focus on understanding concepts so you can apply them to novel situations.
More study tips
ISACA questions often have multiple "correct" answers—choose the BEST or FIRST action.
Review ISACA's glossary to ensure you understand terms exactly as ISACA defines them.
ISACA exams test policies and procedures, not just technical controls.
Understand the ISACA code of professional ethics—questions may reference it.
Focus on frameworks like COBIT and how they apply to IT governance.
ISACA exams focus on audit, risk, and governance perspectives. Think like an auditor or risk manager.
Mistakes to check
Over-relying on deep technical knowledge without understanding broader organizational context.
Underestimating the length and intensity of advanced certification exams.
Not practicing with realistic scenario-based questions that mirror exam difficulty.
Failing to manage stress and mental fatigue during lengthy exams.
Ignoring the "soft" skills and governance aspects that advanced certs emphasize.
Approaching the exam as a technical test when it often emphasizes management and strategy.
Ready to Practice ISACA CISA Questions?
Test your knowledge with CISA practice questions. Practise the tested concepts and identify areas for improvement.
Frequently Asked Questions
What's the exact number of questions on ISACA CISA?
The ISACA CISA exam features 150 questions. With 240 minutes allowed, time management is crucial. Follow the provider’s current candidate guide for the exam format.
Does CISA include unscored questions?
ISACA may include unscored "beta" or "pilot" questions for future exam development. Since you can't identify which questions are unscored, treat every question as if it counts toward your final CISA score.
What question formats does CISA use?
The ISACA CISA exam includes fixed-length multiple-choice questions. Read each multiple-choice item carefully and select the best answer.
How many minutes do I get for CISA?
With 150 questions in 240 minutes, you have approximately 96 seconds per question on average. Budget extra time for complex scenarios and review.
Does CISA allow reviewing previous questions?
CISA uses a fixed-length exam of 150 multiple-choice questions in four hours. You can review questions within the exam session. CISA requires 450 on ISACA’s 200–800 scaled score. The score is not a raw percentage or a fixed number of correct answers.
What's the minimum passing score for ISACA CISA?
CISA requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published.
What's the margin for error on CISA?
CISA requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published.
Is every CISA exam different?
Yes, ISACA CISA draws questions from a large pool and randomizes order. An exam form can vary, but do not assume every question will be new. Prepare against the objectives instead of memorizing earlier items. This prevents memorization of specific question sequences.
What happens if I fail the CISA exam?
ISACA allows four attempts within a rolling 12-month period. Wait 30 days after the first attempt, then 90 days after the second and third attempts before the next try. Pay the registration fee in full for each attempt. Review your available results, address weak topics, and check the candidate guide before booking.
Can I take CISA without work experience?
Yes. You can take the CISA exam before you meet the certification experience requirement. Full certification requires five years of qualifying information-systems audit, control, or security work, subject to approved substitutions in the current application. Experience must fall within the ten years before your application, and you must apply within five years after passing. Passing alone does not make you CISA-certified.
How many questions are on the CISA exam?
The exam contains 150 multiple-choice questions to be completed in 240 minutes (4 hours). This gives you about 1 minute and 36 seconds per question.
What is the CISA passing score?
450 on a scaled score of 200-800. ISACA uses a scaled model where raw results are converted to a common reporting scale, so you cannot translate this to a simple percentage.
How hard is CISA compared to CISSP?
CISA is narrower in scope (5 domains focused on auditing) but requires a deep understanding of audit methodology. CISSP is generally considered harder because it covers 8 broad domains of security engineering and management.
What experience is required to get CISA certified?
You need 5 years of professional IS audit, control, or security experience. Substitutions are available (up to 3 years) for specific degrees or other certifications.
How long should I study for CISA?
If you have an audit background, 8-12 weeks at 2-3 hours daily is typical. If you have an IT background but no audit experience, expect 12-16 weeks to fully grasp the auditor mindset.
Does CISA have PBQs or simulation questions?
No. The CISA exam is entirely multiple-choice with scenario-based questions. There are no command-line simulations or PBQs.
How much does CISA cost?
$575 for ISACA members and $760 for non-members. ISACA membership typically costs $135 plus local chapter fees, making the member route cost-effective.
Does CISA expire?
Yes. To maintain your CISA, you must earn a minimum of 20 Continuing Professional Education (CPE) hours annually, reach 120 CPEs over a 3-year cycle, and pay an annual maintenance fee.
Practice CISA Questions
Build your IS audit knowledge with scenario-based practice questions covering all five CISA domains.
Start Free Practice Test →Related Resources
Related CISA resources
Practice and exam format
- CISM Question Count
How many questions
- CRISC Question Count
How many questions
- Free ISACA CISA Practice Test
Test your knowledge with realistic exam questions.
Complete certification overview and career benefits.
- A+ Exam: Up to 90 per exam Questions (2026)
How many questions
- Security+ Exam: Up to 90 Questions (2026)
How many questions
- Network+ Exam: Up to 90 Questions (2026)
How many questions
Study and requirements
- What If I Fail CISA?
- How to Pass ISACA CISA
Study strategies and exam tips.
- CompTIA A+ Exam Objectives Explained (2026 Domain Guide)
Exam objectives
- CompTIA Network+ Exam Objectives & Domains (2026)
Exam objectives
Renewal and next steps
- Does CISA Expire?
CISA renewal requirements and validity period.
Does it expire?
- CISA vs CISM