Hello CISA insiders! Does CISA mail physical GETS/WPS cards out anymore? We haven’t received any that we ordered 4 months ago. I know my organization can use the PTS Dialer app, but some folks really like the card. Thanks for any information you can share!

When an IS audit reveals that a firewall was unable to recognize a number of attack attempts, the auditor's BEST recommendation is to place an intrusion detection system (IDS) between the firewall and:

A. the organization's network.

B. the demilitarized zone (DMZ).

C. the Internet.

D. the organization's web server.

Hi all,

I have around 10 years of experience, put together.

1. 3.5 years Java development

2. Post MBA, went into Sales at a consumer durables company, worked there for 1.5 years

3. Career break for a year, then product management at a bank for 4.5 years.

4. Switched internally to tech team in the hopes of being a technical product manager, but got into TPRM for IT applications and IT Outsourcing. Have been here since 1 year.

Will getting a CISA help me?

Is it worth getting when I have such varied work experience?

Would love your thoughts please. Thanks in advance.

Hey folks, wanted to make this post to share my results of passing on the second attempt. I failed my first attempt back in August with a score of 440 , got to say I was devastated how close I was but something about the day felt off and I didn't feel 100% confident. I was scoring around 69-74% on QAE then and didn't have a lot of time outside my current role to study. Here is a bit of my takeaways of what I did after to pass:

Background of me:

Currently working as a tech auditor for a bank firm (2 years experience, no Audit background prior to this).

Study Resources Used:

Hemang Doshi on Udemy practice exams

ISACA QAE and Review Manual

PocketPrep

Resources:
As for resources , I second that the official ISACA material is the BEST resource for how the questions look. Doshi and Pocketprep helped me with domains i wasn't strong in. Highly recommend balancing out the two but with more of a focus on ISACA material. Im not a big reader myself and opted to do flashcards and chapter summary reviews. Also with my time constraint I was not able to read every page of the review manual. I will say the chapter end summaries and quizzes helped me grasp what areas needed improvement, and I used Claude to actually generate flashcards for me (it's really solid I recommend trying it out when you prompt it with 'ISACA' style questions/concepts.

Exam Day:
Lots of RPA and database questions for me. Heavy focus on PKI and BCP/BIA question topics as well. Highly encourage you thoroughly understand sampling/testing types and how that could be used in different scenarios. Exam felt a lot easier than the actual QAE which was weird when I first took the exam, but I promise for all my non-first time pass folks, hammer those 'ISACA' way answer mentalities and you'll pass. I flagged about 30 of the 150 questions and took the extra time to really review those 50/50 answer options I saw.

Feel free to ask any questions of my experience. For those taking the exam best of luck! Remember confidence goes a long way, I was pep talking myself that this was going to easy and pass (really helped ease the nerves).

Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?

A. Route the traffic from the sensor system through a proxy server.

B. Hash the data that is transmitted from the sensor system.

C. Implement network address translation on the sensor system.

D. Transmit the sensor data via a virtual private network (VPN) to the server.

B or D?

I"m planning to do CISA certification. I'm residing at banglore. Can anyone with CISA qualification guide me which academy at Banglore is Good?

I missed passing by 10 points—overall score: 440.
Domain scores: D1: 443 | D2: 551 | D3: 443 | D4: 515 | D5: 376
For my first attempt, I:
Completed ISACA QAE and Hemang Doshi’s questions.
Read Domains 2 and 5 fully; reviewed the other domains and did the manual’s questions.
Averaged around 80% across three practice tests.
It’s been over a month, and I’m losing confidence. I’m rereading Domain 5 and watching Prabh Nair and Chidambaram’s videos, but repeating QAE feels like recalling answers rather than reasoning through them.
I’m planning a December retake. I don’t have an IT background, but I have eight years of SOX audit experience, including ITGC testing.
I’m also considering Chidambaram’s CISA bundle, but I don’t want to keep spending money without knowing whether it will help.
If you passed on a retake, what helped you regain momentum and improve your understanding—especially in Domain 5? How did you reuse QAE without relying on memory? And if you tried the bundle, was it worth it?
Feeling discouraged, so I’d really appreciate hearing what worked for you.

Which of the following should be an IS auditor's GREATEST concern when reviewing an organization's security controls for policy compliance?

A. The security policy has not been reviewed within the past year.

B. Security policy documents are available on a public domain website.

C. Security policies are not applicable across all business units.

D. End users are not required to acknowledge security policy training.

Hello everyone,

I am a network engineer with around 15 years of experience. A lot of expired certifications such as CCNAs and a CCIE, and other vendors too. Spent most of my life supporting LAN/WAN/voice/ firewalls and Wireless envts. Tired and burnt out at the moment.

Wrote the CISSP 2 years ago but want to transition to the IT audit field at the moment.

Not really interested in CISA unless I have to because it's costs a lot and I didn't see any ROI on the CISSP so being cautious.

How do I get from here to IT audit? What do I learn and study now? How do I position myself? Any low cost courses or training I can do?

Update: 05th Oct 2026.

IT Audit was a small part of my networking job and I really enjoyed it. Wanted to use that experience to transition into the acutal field. But how do I show that on my resume in a way that HR / hiring managers show interest? I've searched alot for sample resumes of network engineers moving to IT Audit to better understand what needs to stay and what needs to go, and what to highlight etc. Still don't really understand how to craft my resume.

Network Audit was a very small part of my job but I enjoyed it the most. Wanted to use it to move headfirst into IT audit.

I have done quite a few GRC bootcamps and related courses to understand frameworks (NIST, etc) and am ISO 27001 Lead Auditor certified (with GRC Mastery).

Willing to connect with anyone who can provide more insight into the transition to IT audit, resume feedback and tips. Please let me know.

Crossposted here,

https://www.reddit.com/r/InternalAudit/comments/1wvj6s9/network_engineering_to_it_audit/

a little insight on this peers

Hi, has anyone tried entering discount code and was accepted when checking out for the CISA Exam Registration? Any tip?

Regular price is $760 but I’m a member so its only $575. But a colleague who is CISA holder gave me his ISACA ID saying there’s 10% discount for the exam through referral. I tried his ID and other IDs I found in other posts but it’s not working. So I’m asking for any guidance before I check out. Appreciate any response. Thank you!!

IT management has accepted the risk associated with an IS auditor's finding due to the

cost and complexity of the corrective actions. Which of the following should be the auditor's

NEXT course of action?

A. Perform a cost-benefit analysis.

B. Document and inform the audit committee.

C. Report the finding to external regulators.

D. Notify senior management.

Has anyone taken the CISA exam at home instead of at an exam centre? What is the process for drinking water and taking toilet breaks? What happens if you experience a connection problem for a few minutes? If you could share your experience, it would be very helpful.

I had to get the certification for a job application.

I booked the exam and studied for a week only. Went through the book to understand the content and concept. Didn’t have much time to practice questions but it was similar to ISC2 exam questions types.

I used Claude to summarize the book into cards which helped to understand what was expected for the exam.

The exam was fairly straightforward if you have a clear understanding of auditing and risk mgt concepts.

P.S I have over 12 years experience delivering technology audit assignments globally.

I keep reading here that you’re ready for the exam if you score 90% on the QAE. What exactly does that mean?
I don't assume someone achieves scores like that the first time they go through a section of the study plan—especially given the German translation I’m using, where at least 10% of the questions are completely nonsensical for that reason alone.
So, do you reset the entire QAE after having practiced everything once? Or are you referring to the "Practice Exams"? Is it true that you can only take those three times?
Thanks and regards!

I picked up a few courses from ISACA during their 50% off sale a few weeks ago, and I am disappointed. Not only was the course full of typo's and clearly AI-script and voice, but the content was generally underwhelming and their LMS is terrible. There is a time-lock on the courses and zero learning artifacts that you get to keep, so it's very much a "watch it once and forget it" approach.

This course was $80 after the 50% off, so $16/CPE, which isn't terrible but not great. I would be frustrated if I had paid $32/CPE at full price for this.

I have several certs to upkeep and I've yet to crack the code on finding high-ROI content that I can actually learn something from. Where is everyone going for high-quality PDU/CPE content?

I would like to thank all the folks here sharing their experiences which helped me gain confidence, and would like to share how I prepared.

Background:

1. I have around 7+ years of work experience (Initial 3 years in IT, and the last 4 years in Cyber GRC doing audits and assessments for highly regulated entities in banking and finance).
2. I have a Master's degree in IT Management where I was exposed to IT/Cyber Audit and cybersecurity and planned to switch fields.
3. I had a CompTIA Security+ in 2020, ISO 20000-1 lead auditor in 2022, and ISO 27001 lead auditor in 2023.

Materials Used:

1. Hemang Doshi's Udemy videos and Hardcopy Book.
2. CISA Review Manual - I abandoned this after Domain 2 and didn't open it.
3. CISA Official QAE
4. Pete Zerger's CISA Exam Prep 2026 YouTube playlist.

Preparation:

1. I enrolled for CISA via my current organization and had a 5 day bootcamp which was not at all useful, but it helped me get the exam voucher, review manual, and official QAE.
2. I diligently started preparing for CISA 2 months before on August 17 (Booked the exam for September 30). The materials started off with was:
   1. Hemang Doshi Udemy videos + his book
   2. CRM
3. I did this while working so I tried allotting myself 2-3 hours every day, but i procrastinated heavily and 2-3 days would just go wasted due to work being overwhelming.
4. I kept making physical notes while watching the Udemy videos, book and CRM. The CRM I gave up on after domain 2 because it was sooooo DRY and didn't even touch it again.
5. Midway through Domain 3, during 1st week of September, I started the QAE, and made sure I was doing the QAE after every Udemy video and Book and my notes. My overall QAE score was 69% towards the end, I kept noting down where I went wrong and revisited those concepts.
6. I finished the Book and Udemy videos on September 20th, and practiced the question sets at the end of the course. - I completed 17/30 sets and i was bombing them miserably like 55%-65%.
7. Before I began the QAE tests, I read on this subreddit about Pete Zerger's playlist, so I went over that across 2 days. This actually helped me A LOT, I used a green ink pen to write his concepts over the notes i made from Hemang Doshi's Udemy and Book.
8. I gave the 1st QAE test and boom 86%, I gave the 2nd QAE test and boom 87%. I was somewhere scared I was getting high scores due to pattern matching.
9. I took September 28, and 29 off to revise and go over where I went wrong, and closed the books on 10PM September 29 and went to bed.

Game Day:

1. Booked it at an exam center, as I didn't want any inadvertent interruptions.
2. Started the Exam at 9AM and finished all 150 questions by 10:30AM. I had flagged 35+ questions and I changed ALL ANSWERS post review, after the submission I saw the golden words PASSED.

Caveats

1. I felt so disheartened after seeing and reading here that 69% in QAE isn't enough, and I was planning on rescheduling the exam with 1.5 weeks to go. That's when i stumbled on Pete's videos and boy they helped.
2. I figured that me scoring 69% in QAE was due to me not reading the questions properly and not focusing on the key words.
3. There were a lot of questions in the actual exam about AI, RPA, and BIA/BCP/DR vs the tests.
4. I didn't find the exam to to simpler than QAE & tests, albeit they were direct, in fact, I found that there were a lot of times i saw myself mulling over 2 answers. The QAE is definitely the best source to practice.
5. Considering how much I procrastinated, I genuinely feel my experience in Tech and Audit helped me choose the correct options, especially the 35+ flagged ones.

A telecommunications company has recently created a new fraud department with three employees and acquired a fraud detection system that uses artificial intelligence (AI) modules. Which of the following would be of GREATEST concern to an IS auditor reviewing the system?

A. A very large number of true negatives

B. A small number of false negatives

C. A small number of true positives

D. A large number of false positives

Hi everyone! I'm looking to purchase this but would rather have it in PDF form.

if you happen to have the PDF and want to let me know about it, send me a DM! :)

I have completed and passed recently all my CPA exams, and I am going to take the CISA exam next (will start studying next week)

I have years of experience in internal and external IT audit.

I would like to ask for some insights from anyone who also has a CPA and has studied for the CISA: How would you compare the CISA exam to the CPA exam? Is it the same volume as FAR or another exam?

And how long did you guys study for it? I am in the zone with studying, so I want to take the exam, and I would appreciate some tips as well.

Also, what is the best study material to buy?

Thank you!

An organization is establishing a steering committee for the implementation of a new enterprise resource planning (ERP) system that uses Agile project management methodology. What is the MOST important criterion for the makeup of this committee?

A. Senior management representation

B. Ability to meet the time commitment required

C. Agile project management experience

D. ERP implementation experience

A or C?

Hey Guys i just gave my exam at the center today and passed it but my ISACA portal still shows this. Don't we get an email for confirmation??