How many questions are in the ISACA CISM practice bank?

The Certilum bank for the ISACA CISM holds 150 Foundation questions across 4 exam domains. Every question ships with a written explanation of why the right answer is right, and each row exists in three wording variants, so a session never repeats itself verbatim.

How long is the ISACA CISM exam?

The real ISACA exam is timed at around 240 minutes, with a passing score of 70%. The Certilum diagnostic mirrors that structure so your practice session feels like test day.

What is the ISACA CISM exam complexity score?

We measured 150 questions and scored them 1-10 on a composite of format difficulty: multi-select questions (which require every correct option), scenario-length questions, interactive code questions and explanation depth. The ISACA CISM scores 2.0 out of 10, with a per-domain breakdown on the difficulty page.

Is the ISACA CISM exam practice free?

Yes. You can run the full diagnostic for free, get domain-level scoring and see which domains cost you the most points before deciding whether to go further.

Which domains should I focus on for the ISACA CISM?

The ISACA CISM blueprint is split into 4 domains, and the heaviest one carries 33% of the exam. The difficulty breakdown shows where the hardest questions actually sit, so you can spend your study time where it pays.

Free diagnostic practice

ISACA CISM

CISM

CISM validates a professional's ability to manage and govern an enterprise information security program

240 min

70% to pass

150 bank questions

4 domains

certilum

Start the full practice examISACA CISM — freshly shuffled Foundation questions, timed, with domain scoring and explanations.

Exam syllabus, organized by domain

The official ISACA blueprint, with the real weight each domain carries on test day.

Try a real question

Answer one question from the live bank. Grading happens on our servers, so the answer key never reaches the page.

Try a real question

Sample ISACA CISM exam question

Answer this question the same way you would on exam day. No sign-up needed — one random question, three tries to swap it out.

ProficientInformation Security Risk Management

Which two responses are appropriate when residual risk exceeds the organization's risk appetite?

Exam facts at a glance

Every figure below comes from the certification record or from the question bank itself.

Time limit: 240 minutes
Passing score: 70%
Domains: 4
Questions in our bank: 150
Level: PROFESSIONAL
Measured complexity: 2.0 / 10
Question mix: 51 single · 50 multi · 49 interactive

Where the hard questions actually are

We score every question in the bank 1-10 on a reproducible formula. Below is the per-domain breakdown.

Exam complexity score2.0/10Gentle · measured across 150 bank questions

Incident Management43 questions · complexity 2.0/10 · Gentle
35% multi-select · 0% scenario · 33% interactive
Information Security Governance27 questions · complexity 2.1/10 · Gentle
37% multi-select · 0% scenario · 33% interactive
Information Security Program50 questions · complexity 2.0/10 · Gentle
34% multi-select · 0% scenario · 32% interactive
Information Security Risk Management30 questions · complexity 2.0/10 · Gentle
33% multi-select · 0% scenario · 33% interactive