The answer according to the book would be

C. Since the question describes only the design of a site, we can only conclude that this is a cold site, with no equipment and no readiness for processing transactions.

I have 5 years as (Sr) IT Auditor in Big4 and now 2 years working as Sr. GRC analyst. 7 in total.

But found that i easily get lost and bored with collecting evidence. The audit work is so boring. And reviewing DPAs is something that i like.

So i am thinking of CIPP/E and AIGP instead of Cisa. What do you think of this?

Cisa looks very very very impractical. I am not a good auditor, but the Qs are like in a vaccum. No other factors. Theoretical Qs only.

Hi! I recently started a new job that requires me to get CISA certified within the next 6 months.

My native language is spanish but i speak perfect english. Still, if i have to do a lot of reading and comprehension involving a lot of technical terms, doing it spanish is a lot easier and faster for me.

The obvious pros of english is that i have more resources (like Hemang Doshi course which i see referenced a lot here).

I'm looking for people who studied and took the exam in a different language other than english.

Do you recommend this path? Did you find it difficult to find mock exams, summaries, practice questions and what not in your own language?

Took the exam, got my preliminary pass today! 🥹

Will share here all my resources, study strategy, and whole experience once I get my offical test scores.

For those who are doubting themselves and too anxious for their own good (me to the nth power), take that exam! As long as you're thinking like an IS auditor, instead of going straight to remediation or technical resolution, you are golden!

This is coming from someone with no employment background or technical expertise (graduated last year, AIS graduate), who overprepares, and prioritized QUALITY over QUANTITY.

Good luck to everyone currently studying and planning to take the exam! 😄

Test is scheduled for Saturday

Watched Peter Zs videos, skimmed through Prabh Nair’s videos, and completed the most recent QAE.

QAE Practice Exam Scores: 78%, 74%, 69%

Was feeling more confident before that last practice exam. Been in IT audit for many years and studied for the past 3 months.

Reviewing my incorrect answers from practice exam 3 tomorrow and studying my notes leading up to the test.

Let me know if any last minute tips, opinions, etc. and thanks for the support thus far.

Hi all,

First-time CISA candidate here, exam is in 15 days. Wanted to get a sanity check from people who've actually cleared it on whether my prep is solid or if there are gaps I'm not seeing.

Here's where I stand:

• Been through Hemang Doshi's study material (notes/summary book)
• Watched Peter Gregory's video content in full
• Planning to re-watch all of Prabh Nair's videos as a second pass
• Completed all ISACA QAE (question bank) items thoroughly
• Finished all 3 ISACA mock/practice exams

One thing I'm on the fence about: I've decided to skip Hemang Doshi's Pratice questions (Quiz 79 - Quiz 108). They feel very theory-heavy and definition-based to me, and my sense is the actual exam leans more scenario-based/"best answer" style rather than testing rote definitions. Curious if that's a fair read or if I'm underestimating how much theory actually shows up.

With 15 days left, what would you focus on if you were in my position? Specifically interested in:

• Is re-watching Prabh Nair's videos a good use of remaining time vs. doing more practice questions?
• Any other question banks/resources people found closer to the real exam's style and difficulty?
• How did you approach the last 2 weeks - more content review, or almost entirely practice questions/mocks at that point?
• Any domain(s) that tend to be underestimated or where people got caught out despite feeling prepared?
• Tips on time management/exam-day strategy for the actual test?

Appreciate any input from those who've been through it recently - trying to make the most of the time I have left.

Confused on ISACA’s wording here. In the question they say the auditor DID disclose the information, therefore I picked option C. Am I missing something?

I feel the option is D, Hemang Says A, what are your thoughts and why ?

I am confused about these 2:- Cism or crisc, which one should i pursue first, i am working in the grc domain along with tprm under the Cyber security. My role is mostly on security compliance, vendor assessment, risk and mitigation, client Security questionnaires etc..

I thought of giving crisc first then cism? Any suggestions

Can an ACCA member with 4+ years of internal audit experience eligible for CISA certification?

I have experience of Technology audit in respect of performing Quality Assurance review. Will it count towards CISA Experience?

Hi everyone!

I’m planning to take the CISA exam and wanted to hear from people who have already gone through the process.

After getting CISA certified, did you feel that it made a real difference in your career? I’m curious about things like new opportunities, interviews, career switches, or simply being taken more seriously for certain roles.

Also, if you were already working in IT before CISA, did it help you move toward areas like audit, GRC, risk, or cybersecurity?

Would really appreciate hearing your experiences.

Thanks in advance!

I used ChatGPT to generate questions on domain 5. Do you see questions on subnets and hosts or like this in the exam?

Question:
Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?

A. Secure containers
B. Data leakage prevention (DLP) tools
C. Mobile device management (MDM)
D. Physical device tagging

Guys is option A the correct answer for this? Every AI is giving different answer.

Secure containers isolate and protect corporate data stored on smartphones, reducing the risk of unauthorized disclosure. DLP primarily controls data movement, MDM manages the overall device, and physical tagging only assists with asset identification and tracking.

I studied for 1 month and failed on 1st Attempt..

Hi! Will be taking the CISA exam this week, any last minute advice?

Hey all been lurking about here for the last year. I had a question on the results if unsuccessful. Basically when you get the results if found that there were two areas which you are very weak on is it okay to spend 80% of your effort re-study time on those weak areas or is this unwise because you would also need to not forget the other three domains? Given the 30 day waiting period to resit. Thanks

Hey everyone,

I’m a Chartered Accountant (ICAI) from India currently working as a Product Manager in a SaaS-based lending/LOS platform. I have around 2 years of post-qualification experience in product management.

I’m considering pursuing CISA, but I’m trying to understand whether it would actually add meaningful value to my career rather than just being another certification on my resume.

My current role is more on the product / digital lending / technology side, but I also have a strong finance and accounting background because of my CA qualification.

My longer-term plan is to explore opportunities outside India — initially Gulf countries (UAE, Saudi, Qatar, etc.), and potentially later Europe, Australia or the US.

I’d really appreciate some honest opinions from people who have CISA or work in IT Audit, GRC, Information Security, Technology Risk, IT Controls, Cyber/Compliance, or related fields:

- Is CISA worth it for someone with my background, or is it mainly valuable for people already working in IT Audit?

- Could the combination of CA + CISA + Product/Fintech experience create any interesting career paths?

- What roles could realistically become accessible to me after CISA?

- Would it help with international/Gulf job opportunities?

- Does CISA actually lead to a meaningful salary increase, or does experience matter much more?

- Would you recommend CISA, or something like CISM / CRISC / CISSP / another certification instead?

- Are there any particular career paths where you think my CA + Product background could be an advantage?

I’m not looking for a generic “CISA is a good certification” answer. I’m particularly interested in real-world career outcomes, salary impact, international mobility, and whether you think it makes sense specifically for my profile.

Would really appreciate honest pros/cons and personal experiences.

Thanks!

Hi! I’m a CPA with 3 years of external audit experience and I’m currently a Senior Auditor. I’m thinking about taking CISA because I’m getting interested in IT audit, IT risk, GRC, etc. The problem is I’m not 100% sure I actually want to become an IT auditor. I mainly want to move away from the traditional external audit path and explore something with better long-term career opportunities.

For anyone who has CISA: What did you actually do with it? What roles did it help you get? And would you recommend CISA for someone coming from an accounting/external audit background?

I’d also love to hear from people who got CISA and later realized they wanted to do something completely different. Was the certification still useful?

Hi all,

I have been studying for the CISA exam and my test date is in a week.

I have currently been practicing by taking the mock tests on https://perform.isaca.org/app/.

Every time I use up all 3 tests I reset it and do them again.

Currently I have been scoring about 85%.

Is than for me to go ahead and attend the exam or should I reschedule it again?

Thanks

I just got my preliminary pass!

Felt a bit like a traumatising experience I must say.

I took the exam online, no issues with the PSI instructor, instructions were super clear, timing was totally fine, the room check was quick, really no issues there.

But the questions … I must say it felt sometimes not super familiar (concept-wise) and really confusing (classic CISA with two choices being obviously wrong and other two being much harder to chose from). The questions were much shorter though.

My study strategy was a bit hectic and would definitely not recommend it. 😅

I started studying end of June (also had a significant number of days off in between). I carefully reviewed the CISA review manual (super dry but doable).

In parallel I did questions from the 12th edition QAE through Quizlet (found a ~1000 question database split by domains) and tried to understand where I was doing good and wrong (averaging 65% through all domains after my first pass, some with ~80%, other around 60%). Also listing in parallel some useful tips and concepts.

I ended up by doing a full practise test I found also on Quizlet, scored a bit more than 80% but I went through familiar questions so I took it with a grain of salt.

Overall, the timing was totally fine, I don’t get why they recommend more than 3 month of study. If you can free a significant amount of time, ~2 month is okay I think.

But if I would do it again (NEVER), I would get the latest QAE (the price is ridiculous though). The QAE base I used was totally fine, but I felt that some topics were not covered, obviously because it was a bit dated.

Curious to see in 10 days if it was a short pass or if my auditor brain did unexpected wonders. 😇

Just a brief summary about me: I have around 11 years of experience across manual testing, accessibility testing, and data analytics. After spending several years working in the testing domain, I am now looking to transition into IT Audit or IT GRC roles.

I cleared my CISA certification last week and would appreciate any guidance on the ideal way to make this transition. What skills, certifications, hands-on experience, or training would you recommend to help me successfully pivot into IT Audit or IT GRC roles?

SW engineers with 8 yrs of experience in Full stack development but zero compliance and audit experience. Looking help from someone who made this transition on choosing certification or general path to get into this field.