How We Check Our CISA and CISM Questions
Practice questions with wrong or ambiguous answer keys do real damage: they teach the opposite of the judgment the exam rewards. Here is exactly how every Auditor Path question is checked before it reaches you, and what happens when something slips through.
The bank at a glance
- 1,047 CISA questions and 1,069 CISM questions, every one original.
- Every question is mapped to an official subtopic of the current ISACA exam content outline, with at least ten questions per subtopic.
- Every domain holds enough questions to build a full 150-question mock on the official domain weights.
1. Written to ISACA's item-writing rules
Each question follows the rules in ISACA's published item-writing guidance, and automated tests reject any question that breaks them:
- One clear best answer, with FIRST, BEST, MOST or PRIMARY where the exam would use them.
- No NOT, LEAST or EXCEPT stems, no "all of the above" or "none of the above", no second-person wording.
- Four options, each wrong option with a written reason it is wrong.
- An explanation that names the exam mindset being tested and cites a source: the exam content outline, ITAF, COBIT, NIST or ISO/IEC.
2. Blind answer-key review
Every question is answered again by a separate reviewer that never sees our answer key. The reviewer is an AI model briefed on the IS auditor and security manager mindsets and told to flag any question with two defensible answers, no correct answer or an ambiguous stem.
- In the latest full review, the blind answers matched our keys on all 2,116 questions.
- Every answer the reviewer gave with less than full confidence (153 questions) went to a second, stricter reviewer, asked one thing: could a well-prepared candidate argue another option is equally correct?
- That second review found five questions where it could. All five were rewritten so the best answer clearly wins.
- An earlier review found one question with a misleading stem. It was rewritten and retired from the bank.
Blind review catches disagreements, not shared blind spots, so it does not replace the report button below.
3. No answer giveaways
Test-wise candidates learn to spot patterns that have nothing to do with the content. Automated tests check the whole bank for the most common one:
- Option length. In many practice banks the correct answer is usually the longest, most qualified option. In our bank the correct answer is the longest option in about a quarter of questions, as it would be by chance, and the same holds for second longest, second shortest and shortest. A test fails the build if any length position holds more than 35% of answers in either exam.
- Answer position. Options are shuffled, so the correct letter is spread evenly across A to D.
- Repeats. A test compares every pair of questions in the same exam and rejects two that test the same idea in different words.
4. Plausible wrong answers
Every wrong option is written to be tempting to someone who lacks the experience to choose the key, usually the technically sound action that ignores the auditor's or manager's role. Options that no candidate would choose, such as joke answers, are removed.
5. Report anything that looks wrong
Every question has a Report button. Reports go to a review queue, and a question with a confirmed problem is corrected or retired. Retired questions are removed from practice and mocks automatically.
If you think a key is wrong, report it with your reasoning. We would rather fix a question than defend it.
Related on Auditor Path
Sources
ISACA CISA and CISM exam content outlines; ISACA item development guidance for CISA and CISM.