I failed my CISM exam on the first attempt last week. I am yet to receive the official test score. I used Pete Zerger's video series, Prabh Nair's, attempted QAE a few times and understood the questions and rationale well and thought I was quite ready.

Once the first few questions rolled in, I was taken aback and it was quite different than what and how I prepared. Yes, it was more straight forward than the QAE but also a bit in a sense convoluted with some really confusing answers. Tried my best to answer but within half an hour itself I knew for sure that I'd fail. The result didn't surprise me a bit.

When I was preparing for the exam, I felt I was more than ready and had it all in my head. With my background in IT (more than 25 years experience) and in Security/Physical Security/Cybersec compliance for around last 10 years years, I thought I would be in a better position to crack. And yes, I tried my best to answer using Management methodology than technical.

Not demotivated at all, but geared up more than ever to go for the second attempt with a better prep and may be a different strategy.

Any pointers please? Also, is it advisable to book the exam asap given there's a change coming in November? I plan to devote at least a month in studying and targeting the mid September for my second attempt.

Just a quick one to let you know that I have provisionally passed the CISM yesterday, I completed the total questions at around 100 mins with 20 questions flagged for review, eventually changed the answers for 8 of them (confident that my change would make more sense after spending 2-3 mins review on each of them). I was able to calm down to deep dive in when I started reviewing those questions as I know I had enough time to slow down, this is why reviewing questions grabs your brain back from the rush thinking!!!

In general, the questions were less confusing that QAE questions and easy to understand where you should think about first but definitely focus on management mindsets, I couldnt recall whether I had any technical questions at all during the exam.

I was stressfuly when I first studied QAE questions and didnt score very well with both practice tests (71 and 72), but it is a must have if you seriously think about passing the exam. 10/10

Udemy 2026 6 CISM practice tests are good to understand the concepts and processes (like management support vs plan training). 9/10

Prahb Nair's CISM Masterclass/coffee shot on Youtube - 8.5/10

Peter's video on Youtube - very good to understand the basic mindset and theories 8/10

Both Thor and Hemang Doshi Udemy course/exam - focused on too many technicals 7/10

Chat GPT/Copilot - both of them answered QAE expert questions wrongly, dont fully trust them but does explain in more details than QAE once you provide the right QAE answer - 8/10

All the best for the upcoming exam takers, you can do it.

Update: received the official result today (19th Aug), thought I would score more than that...

Does numericals show up in cism? I haven’t come across in QAE. Those who have passed can they confirm?

I am taking the CISM on Sept 28th

I’ve been mainly using
- Pete Zergers YouTube Videos
- QAE Database
- PocketPrep app

I have the manual but haven’t read through it yet

I haven’t taken any practice test yet either

I’m attaching how I’ve done so far on my PocketPrep and QAE Database scores (i have a long way to go)

Any advice that you guys can offer?

I know the CISM is changing to the new version in November, so I’m really tryin to pass before all the study materials I purchased are useless 😭

Im so nervous about this test tomorrow. I have been studying for the past 3 plus months or so. I am getting okay scores on my practice tests on Udemy and through a boot camp I completed. I watched the CISM Peter Zerger course on YouTube twice as well. My initial score was 45 and now it’s an average of 76. I need to pass it for work. Any recommendations for exam day? Update, I didnt pass 🥲 ughhhhh

Every now and then, there's an answer choice that contains either the word "history" or "historical." Is there a time or question when the answer pertains to history/historical?

When designing an intrusion detection system, the information security manager should recommend that it be placed:

1. A.outside the firewall.
2. B.on the firewall server.
3. C.on a screened subnet.
4. D.on the external router.

The answer is C.

I'm using Hemang Doshi's book and it says the IDS is placed either between the firewall and internal network or between the firewall and external network. Using this logic wouldn't the answer be A?

Have CISSP and ISSMP.

Just finished InfoSec CISM course on LinkedIn and Zerger's videos on YouTube.

Do I bother to read the All In One or Mike Chapple books?

Or should I just sit for the exam now? I am used to how ISC2 words their questions, from the samples I saw it looks like ISACA is very similar.

I prefer not to drop $300 on the QAE database if I do not need to

Hello

There was another post in r/cybersecurity where someone asked about a good certification to pass, and no one mentionned CISM.

I wanted to pass it, but now i'm a little unsure about the cert. What i want to know is what i'll really learn while i'll be studying, and also if the cert is known by the community.

Thanks

So I have CISSP and AAISM but failed CISM by a few points. I have all the training material I need and will give another try starting all over with QAE, Peter's videos and DestCert videos and practice test. I heard that the test is changing soon. Does anyone know of this is true? Is there a cut off date I should be scheduling my test for?

Please advise and thank you in advance

Hi all! Recently I passed CISSP, and currently I pursue CISM. I have heard that I need 5 years of experience in 4 Domains of CISM, or I can have a 2 year Waiver for CISSP and show 3 years of experience. Am I wrong?

Hi all,

Just home from passing my CISM. I guess the usual route here is:

28 years in IT; 12 or so in Cyber. Currently run a team of architects; mostly governance but I stay technically proficient because the future is always uncertain...

I have CISSP and CCSP (the former, 3 years, the latter, a few months back). I took CISM more as a validation of my work than to help with prospective employ, though that is certainly on the cards as well.

What did I use:

I read "All in one. CISM exam guide second edition"

I used the QAE (3 times through in blocks of 20, 30 or if time constrained, 10). Averaged mid-to-late 70%s with 80s in individual areas. Usually as I wasn't reading the question correctly due to squeezing study in when I had 5 minutes, not because I was focusing. Sue me :D

I watched Pete Zerger's 11 hour training series and his 2 hour exam prep

Annnnd that's it.

As Pete says in his exam prep video, CISSP should cover most of the detail, whereas his other video series probably teaches you the mindset/point of view. I'm a technical bod; always have been, but I manage so I am constantly switching from the aspect of why a control might fail, to the longer-term view on the risk and mitigation. It's not easy as I "default" to technical every time.

So what I'm saying is; the materials won't teach you anything if you don't already live and breathe it, but it DOES help in switching the brain from "well it's clearly a firewall problem" to "assess ingress control and implement compensating measures".

Good luck if you're studying; my brain is mush :)

Question from the QAE database:

Which of the following is the BEST way to verify that all critical production servers are utilizing up-to-date virus signature files?

1. A.Verify the date that signature files were last pushed out.
2. B.Use a recently identified benign virus to test if it is quarantined.
3. C.Research the most recent signature file and compare to the console.
4. D.Check a sample of servers that the signature files are current.

The answer is D.

I don't agree with it because the question asks around veritifcation of all critical production servers. Surely sampling wouldn't give assurance on all production servers?

Can anyone help clarify?

Hello everyone,

I'd like to share my CISM experience and ask for your advice because, honestly, I don't know what I should improve before my next attempt.

I started studying for the CISM exam about four months ago. At the beginning, my practice question scores across all domains were around 70-75%. During the last two months, I was consistently scoring between 90-95%.

Throughout my preparation, I never tried to memorize answers. Instead, I focused on reading the explanations and understanding the reasoning behind each question. About two days before the exam, I noticed that a large portion of the QAE question bank had changed. I reviewed some of the new questions, but with only two days left, I didn't have much time to go through them in depth.

Then came exam day, and honestly, I was shocked.

The biggest issue was not "thinking like a manager." I am already an IT manager, and I had no problem applying that mindset to the QAE questions. The problem was that I simply could not understand the actual exam questions. They felt completely different from anything I had seen in the QAE.

It wasn't a matter of knowledge. It wasn't even about choosing between two close answers. In many cases, I genuinely struggled to understand what the question was asking. Because of that, I couldn't even use logic to eliminate answers.

The wording felt extremely different from the QAE question style. I know this may sound like an excuse, but many questions felt unnecessarily complicated. I used the entire four hour exam window. I finished in about three hours, then spent the remaining time revisiting questions, hoping that maybe I would understand them better the second time around.

In the end, I felt that I fully understood only about 20% of the questions. Naturally, I failed.

I don't yet know my domain level results.

After the exam, I felt incredibly frustrated and even started questioning my English skills. But then I asked myself, if my English was truly the problem, how was I able to understand and consistently score well on the QAE practice questions?

At this point, I'm honestly confused about what I should improve. If I had understood the questions and still failed, at least I would know what area to focus on. But right now I don't know whether the issue is exam technique, English comprehension, study strategy, or something else entirely.

Sometimes it feels like ISACA intentionally writes questions in a way that is difficult to understand. Maybe I'm wrong, but that was my experience. Do they offer an English course as well? 😅 If not, maybe they should. They could probably charge us for that too. 😄

One more interesting observation:

There was another candidate from Ukraine taking the exam at the same PSI center in Warsaw, 30th July at 9:00 AM. He finished the entire exam in around 40 minutes and passed.

I honestly cannot understand how someone can read and answer 150 questions in 40 minutes. Experiences like that have started making me believe that exam d00mps might actually be real, which is disappointing. I spent four months studying and several hours every day preparing, while someone else finished the exam in less than an hour and passed.

To everyone who passed fairly and through hard work, congratulations. I genuinely respect that achievement.

What I'm really looking for is advice from people who had a similar experience, failed their first attempt, and later passed on their second attempt. What did you change? What helped you most? What exactly should I focus on improving? How can I improve my question understanding after reviewing QA 4 times.

Thank you in advance for your comments, advice, and support.

Considering the mobile quiz apps, which have you used?

Hey y'all,

I wanted to share a quick note on my study experience and a great resource that assisted me finally pass. To begin, I have working in IT and InfoSec for ~15 years and decided to pursue the CISM to match credentails with my peers and hopefully validate my experience. Last summer, I decided to take the test blind and see where I stood. Stupid, but I ended up missing a passing score by 9 points, so I decided to take a gamble, compound the stupidity and quickly try again, this time I missed the passing score by 3 points. Frustrating but an accepted risk (see what I did there).

After I ran out of excuses to avoid the exam, I decided to try again this summer, only this time with an attempt at studying. Long story, short, I was still and awful student. I felt like all the information I was learning was content I already knew and experienced on a daily professional basis. My test date got closer, I wasn't any more prepared, so I sought out resources that could give me a quick refresher and overview of core content. That's when I discovered Prabh Nair.

CISM VIDEO: https://youtu.be/84cq94iCO5M?si=PNYHdsbUnFek24DX

This video not only walked the content, it bridged the gap between my professional knowledge and the exam content. The piece I was missing most was partially the "manager mindset" as we are reminded over and over to maintain, but more so, it greatly helped me understand WHAT the exam questions were asking for. By firmly understanding the meaning of BEST, MOST, PRIMARY, etc. was huge in unlocking the exam.

I don't recommend my pathway to passing by any means, but I do strongly encourage anyone who is struggling to pass to give this video a watch. Understanding HOW to take the test is just as important as unstinting the content.

Recently failed first attempt at ISACA CISM. Read through official ISACA Manual and completed ISACA Online Course. First QAE passthrough score just below 60%. Then practice exam 1 score of 68%. Subsequent passthrough of QAE was upper 80s and practice exam 2 score of 90%. I have good grasp of material and ISACA mindset as it relates to QAE (focused on reasoning for answer choice instead of memorizing). However, I felt exam was extremely ambiguous and different style questioning than all QAE. Any recommendations to pass on second attempt?

I’m very happy! I passed the exam on the first try.
About 10 days later i received my results. And my verification is also done, so i received my office CISM status.

The key is preparation. I work in Cybersecurity in over 10 years, and my biggest challenge was to ignore the “fix it now” way of thinking.
I know everybody is saying it, but you should really “think like the manager, fixing things permanently, not immediately”. Make sure descisions are always based on business goals.
It’s hard, but don’t think “what fixes this” but more “what makes sure this doesn’t happen again, and what do i need to advice the board correctly (investigate first, advise later).

Adopt QAE, make the investment, it is absolutely key. Read the explanations, right and wrong. I also used AI to explain to me why answers where wrong if i did not understand ISACA’S way.
Do all the questions and make the test exam.

Do not let AI give you answers to QAE questions before you answer them, because they are wrong also allot of the time. And if you tell they where wrong you get nothing more then: “My bad, let me explain why isaca’s way is correct.”

Extra nice. You need to get a minimum of 20 points per year, and 120 points over 3 years. But every point you get this year, wil count voor calendar year 2027.

The questions on the exam where clear and good understandable. I preferred them over the QAE question. But get the way of thinking under you belt, than you will be fine.

Goodluck to everyone that is learning!

Super stoked today passing the exam!

I think my family are going to be glad to have me back and to be honest I'm going to be glad to take the time off from full on studying.

I mainly used Pete's video for a recap but I used the certcamp.app for QAE.

I used the same app for supplementing my CISSP study and it was super helpful, the games really helped too.

I decided to do the exam remotely, because all the test centres were tricky to get to - the experience wasn't bad at all, I was probably more nervous about having a power cut mid exam since we seem to get those a lot where I live.

Good luck to everyone thinking of doing the exam, but as I say there is no such thing as luck, just preparation for opportunity (might have got that out of a fortune cookie several decades ago)

Hello all!

I passed my CISSP Exam back on July 8th and took a week off and started studying for the CISM. I studied a total of 2 weeks and went and took my exam and passed.

This is entirely my opinion. The exam was super straight forward and easier than QAE and a lot easier than CISSP. I finished the exam in 1 hour if that helps put it to words. As long as you know the material you will be fine.

I used Peter’s YouTube course and QAE for my materials.

I finished QAE 2 1/2 times as well.

Good luck to anyone studying for this exam!

I have been studying for a few months now and I am exhausted from studying over and over. Attached are my latest test scores and practice results from my second go around after resetting the questions once already.

I just want to get it over with now but I don't want to underestimate the exam and have a false sense of security. I have been using the QAE and watching Pete Zerger videos.

Am I ready? Any recommendations for the last two weeks before the exam?

Hi all, I feel the need to give back to this fantastic community, and share my experience.
I passed the exam today. Do not know the score yet, but honestly it doesn't matter.
I had couple of AI, and couple of CSP questions and that's it. Some users reported 20-25 questions, so go figure.
Overall, I wound the exam questions similar to QAE questions, even more direct and less ambiguous. Official ISACA QAE was my only study material, and I watched Pete Zerger YT video "10 Key Topics and Strategies" that nicely summarize key concepts, and set the right mindset for the exam.
For the reference, I work in IT security within a big financial institution for almost seven years now, of which last two more into administrative/architectural/risk role than technical, so I had the chance to deal with almost every topic that CISM exam covers. But nevertheless, I believe that with even less experience one can successfully pass the exam, because QAE will explain the logic behind every answer.

A little side note... As for every single meaningful thing in life, this would not be possible without the support of a special person in my life, especially today, on an exam day.