How ISACA Exam Questions Are Written — and How to Read Them
ISACA publishes item development guides for CISA and CISM. They describe exactly how real exam questions are constructed — and therefore how to read them.
What every question looks like
- A stem with a direct question or an incomplete statement, often with a short scenario.
- Four options: one key and three distractors.
- The key is either the only correct option or the BEST option compared with the others.
- Distractors are written to look correct to an inexperienced professional.
What ISACA avoids
- Negative questions (NOT, LEAST) — they test poorly.
- True/false and "which statement is true" items.
- All of the above / none of the above.
- Vendor-specific products and region-specific regulations.
- Pure definitions — the exams are experience-based.
- Absolute words such as always and never, and vague words such as commonly or rarely.
How to use this
- Do not look for trick wording. ISACA deliberately avoids it; read the stem literally.
- Expect several plausible options. Eliminate those that do the wrong job for the role in the stem.
- Watch for the qualifier. FIRST asks about sequence; BEST asks about quality; MOST asks about degree.
- Use the scenario. ISACA requires stems to contain enough context for one best answer — the clue is usually there.
Every Auditor Path question follows these same rules, and a test checks the bank for banned patterns on every build.
Related on Auditor Path
Sources
ISACA CISA Item Development Guide (updated April 2022); ISACA CISM Item Development Guide (updated April 2022).