Frequently asked questions
Is Auditor Path affiliated with ISACA?
No. Auditor Path is an independent study site. CISA® and CISM® are registered trademarks of ISACA, which runs both exams. Register, schedule and check official results at isaca.org.
Are these real exam questions?
No. Every question here is original, written against ISACA's published exam content outlines and public frameworks (COBIT, NIST, ISO/IEC 27001 and others). Candidates agree to ISACA's confidentiality terms, so real exam items must never be shared — avoid any site that claims to have them.
What does the real exam look like?
Both CISA and CISM have 150 multiple-choice questions in 4 hours. Scores are reported on a 200–800 scale and you need 450 to pass. Wrong answers are not penalised, so answer every question. (ISACA Exam Candidate Guide.)
How is my mock exam scored here?
ISACA does not publish how raw answers convert to its 200–800 scale, so we do not pretend to. Mocks show your raw score per domain against a readiness target of 70% correct (105 of 150). Treat it as a conservative estimate, not an official score.
What changes in the CISM exam on 3 November 2026?
ISACA updates the CISM exam content outline on 3 November 2026. The four domains stay, with new weights: Governance 18%, Risk Management 20%, Program 33%, Incident Management 29%. Enterprise architecture and information security architecture are added. Auditor Path's CISM mock uses the new weights.
How often can I retake if I fail?
ISACA allows four attempts in a rolling 12 months. You wait 30 days before the second attempt and 90 days before the third and fourth, and each attempt costs the full exam fee (US$575 for members, US$760 for non-members at the time of writing). Check isaca.org for current rules.
Why do the explanations talk about "mindset"?
The most common reason candidates fail is answering as a technician instead of an auditor (CISA) or a security manager (CISM). Every explanation names the mindset the question tests and explains why the tempting technical answer is wrong.
Where do the answers come from?
Every explanation ends with its source — the framework, standard or outline section it relies on. Each question is cross-checked before it is published. If you think an answer is wrong, use "Report" on the question and we will review it.
How much does it cost?
Practice is free with your daily coins. If you want more, buy a one-time coin pack by card — no subscription, no ads, and coins never expire.