Skip to content
CertGPS
News and updates

ISACA Exam Question Types: Still Multiple Choice, Except for CCOA

CISA, CISM, CRISC, CGEIT and CDPSE still use four-option multiple choice in 2026. Only CCOA, launched in 2025, adds performance-based lab questions.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
3 min
On this page

Related certifications

Topics

ISACA Exam Question Types: Still Multiple Choice, Except for CCOA

A CISA or CISM question in October 2026 is a stem, four options and one best answer. ISACA's 2026 candidate guide describes every question on CISA, CISM, CRISC, CGEIT and CDPSE that way. The one ISACA exam with a new question type is the Certified Cybersecurity Operations Analyst (CCOA), launched in January 2025, which ends in a lab.

What a CISA or CISM question looks like

The guide's rules are short. Every question has a stem, written as a question or an incomplete statement, and four answer choices. You pick the correct or best one, and wording such as MOST likely or BEST decides between options that are all partly right. Some questions come in sets: a scenario describes a situation, and two or more questions draw on it. The guide describes these five exams as multiple-choice, including questions sharing a scenario; those scenario sets still use four options and one best answer.

Length depends on the exam. CISA, CISM, CRISC and CGEIT are 150 questions in four hours. CDPSE is 120 questions in three and a half. Scores are scaled from 200 to 800, and you need 450 to pass. There's no penalty for a wrong answer, so leave nothing blank. The exams include unscored pretest items you can't tell apart from the rest, and the domain breakdown on your result is for information only, since the score counts total correct answers.

What did change: the outlines

ISACA's recent changes are to content. The current CISA outline took effect on 1 August 2024, announced in a release dated 1 May 2024. CISM moves to a new outline on 3 November 2026. ISACA's release of 10 September 2026 says the new version puts more weight on security strategy and program development and adds enterprise architecture and information security architecture, with domain weights of 18%, 20%, 33% and 29%. Neither release says anything about new question types or a different question count.

If you're sitting CISM this autumn, the date matters more than the format. The CISM study guide explains how to choose between the last weeks of the 2022 outline and the first weeks of the new one.

CCOA, the exception

ISACA announced CCOA on 29 January 2025 as a hybrid exam that tests knowledge and hands-on skill together. Its candidate guide sets it out: 115 multiple-choice questions and 25 performance-based questions in four hours, in English only. The multiple-choice section comes first, then the lab. Each performance-based question has a stem and one correct answer, and you reach it by working in the lab environment. ISACA's CCOA page lists the tools you're expected to handle, including Wireshark, Security Onion, CyberChef and Kibana.

The guide aims CCOA at analysts with two to three years of experience, and its weights lean toward operations: Incident Detection and Response is 34% and Technology Essentials 25%. The exam costs US$399 for members and US$499 for non-members. ISACA asks candidates to run its lab orientation and connectivity check before exam day, and remote candidates can't test from a virtual machine.

ISACA's launch release cites its own State of Cybersecurity survey for the reasoning: the two top factors in deciding whether a job candidate is qualified were prior hands-on experience, at 73%, and credentials held, at 38%. CCOA is how ISACA responded within its own credential range. Its management and audit exams haven't followed.

Preparing for the format you'll actually get

For the five multiple-choice exams, practise the best-answer judgement, not recall. When you review a missed question, ask why the right option is the one an auditor, a security manager or a risk owner would choose, because the distractors are often things a technician would sensibly do. Practise reading scenario sets as a block.

For CCOA, treat the 25 lab questions as their own section and time them. The candidate guide puts them last, so a slow multiple-choice section eats into lab time. Hours with the listed tools on real data count for more than another question bank.

Sources