12 Answer Traps That Cost Candidates Points on CISA and CISM

ISACA-style questions have one best answer and three plausible distractors. The same traps appear across both exams.

Role traps

  1. The auditor fixes it. On CISA, options where the auditor disables accounts, changes settings or deletes data are almost always wrong. Auditors report.
  2. Security owns the risk. On CISM, options where the security manager accepts business risk are traps. The risk owner decides.
  3. Approving instead of advising. Auditors and security teams advise; management approves.

Sequence traps

  1. Acting before understanding. "FIRST" questions usually want the step that establishes facts, scope or risk.
  2. Recovering before containing. In incidents, contain first.
  3. Writing procedures before policy. Direction comes before detail.

Scope traps

  1. The symptom fix. An option that solves one instance when another solves the cause. Prefer the root cause.
  2. The technology answer to a governance problem. Buying a tool rarely fixes missing ownership, policy or process.
  3. Absolutes. "Always", "never", "all", "guarantee" and "eliminate" are rarely right.

Evidence traps

  1. Inquiry as proof. "Ask the administrator" is the weakest evidence.
  2. Policy as proof. A policy shows intent, not operation.
  3. Activity as effectiveness. "100% completed training" does not show behavior changed.

A routine that beats the traps

  1. Identify your role in the stem.
  2. Identify the qualifier: FIRST, BEST, MOST, PRIMARY.
  3. Predict the answer before reading the options.
  4. Eliminate options that match a trap above.
  5. Choose the most complete remaining option.

Related on Auditor Path

Sources

ISACA CISA and CISM Item Development Guides; ISACA exam content outlines.