CISA Exam Domain Weights: How Many Questions Per Domain?

If you're building a study plan around CISA practice test domain weighting, the numbers matter more than most candidates realize. The current exam draws 150 questions from five domains, but those domains are not equal: two of them now account for more than half the exam. This article answers the questions candidates actually ask about the weighting, from the exact percentages ISACA publishes to the question counts per domain, what changed in the 2024 blueprint refresh, and how to split your practice hours so your weakest domain doesn't sink a passing score. Every figure below is tied to the five-domain job practice that took effect on 1 August 2024 and remains the live blueprint for 2026 candidates.

What are the current CISA domain weights?

The five CISA domains carry these weights on the current exam: Domain 1 (Information System Auditing Process) at 18%, Domain 2 (Governance and Management of IT) at 18%, Domain 3 (Information Systems Acquisition, Development, and Implementation) at 12%, Domain 4 (Information Systems Operations and Business Resilience) at 26%, and Domain 5 (Protection of Information Assets) at 26%.

These percentages come from ISACA's job practice analysis, the periodic survey of working IS auditors that determines what the exam should test. The authoritative source is the CISA exam content outline on ISACA's site, and it's worth bookmarking, because third-party blogs and older course materials still circulate the pre-2024 figures. If a study resource shows Domain 1 at 21% or a six-domain structure, it's describing an exam that no longer exists.

A quick sanity check on the table below: the weights sum to 100%, and the question math follows directly from the 150-question format.

Domain	Focus area	Weight	Approx. questions (of 150)
1	Information System Auditing Process	18%	~27
2	Governance and Management of IT	18%	~27
3	IS Acquisition, Development, and Implementation	12%	~18
4	IS Operations and Business Resilience	26%	~39
5	Protection of Information Assets	26%	~39

Two domains at 26% each means Domains 4 and 5 together supply roughly 78 of your 150 questions. That's the single most important number on this page.

How many questions per domain will I actually see?

Multiply each percentage by 150 and round to a whole number: about 27 questions each from Domains 1 and 2, about 18 from Domain 3, and about 39 each from Domains 4 and 5.

One caveat before you build a spreadsheet around these figures. ISACA presents the weights as proportions of exam content, not as a promise that every form of the exam contains exactly 39 Domain 4 items. Exam forms are assembled from a large item pool and statistically equated, so your specific sitting may vary by a question or two in either direction. Treat the counts as reliable planning targets, not a contract.

There's a second wrinkle worth knowing. CISA, like many certification exams, can include unscored pretest items mixed into the 150 questions. These items don't count toward your result, and you can't identify them while testing. The practical effect on your prep is zero, since you must answer everything seriously, but it does mean the domain distribution of your scored questions may differ slightly from the headline percentages.

What the arithmetic does give you is a floor for readiness. If you're consistently scoring under 70% on Domain 4 practice sets, you're putting roughly a quarter of the exam at risk. No amount of Domain 3 strength can compensate for that, because Domain 3 only has about 18 questions to give.

Did the domain weights change recently?

Yes. ISACA updated the CISA job practice in 2024, and the revised content outline took effect for exams administered from 1 August 2024 onward. Candidates testing in 2026 are still sitting this blueprint, and no new public domain refresh has been announced for 2026 itself, as Spoclearn's 2026 study guide confirms.

The shifts compared with the 2019 baseline:

• Domain 1 dropped from 21% to 18%. The audit process domain is still foundational, but it no longer carries the largest single share.
• Domain 2 rose from 17% to 18%. Governance and management gained a point.
• Domain 3 held at 12%. Acquisition, development, and implementation remains the smallest domain.
• Domain 4 rose from 23% to 26%. Operations and business resilience gained three points, the biggest single move.
• Domain 5 fell slightly from 27% to 26%. Protection of information assets is now tied with Domain 4 as the joint-largest domain.

The direction of the change tells a story. ISACA moved weight away from pure audit process and toward operational resilience, business continuity, and asset protection. Coverage of the CISA exam changes also notes heavier emphasis on AI, cloud computing, and current cybersecurity threats inside those reweighted domains, which means the questions themselves have modernized along with the percentages.

The practical warning: any practice question bank built before August 2024 is calibrated to the wrong blueprint. The topics overlap heavily, but a bank that gives you 27% of its items on Domain 5 and only 23% on Domain 4 is training you for an exam nobody sits anymore. Check the publication or update date of every resource you use, and cross-check its domain claims against ISACA's outline. Overviews like Edudelphi's exam format breakdown that reflect the current outline are useful secondary confirmations.

Which domain should get the most study time?

Domains 4 and 5 deserve the most raw practice volume, because they control about 52% of the scored exam. But "most screen time" and "most study time" aren't the same allocation, and the right split depends on your background.

Start with the exposure math. Roughly 78 of 150 questions come from IS operations, business resilience, and asset protection. A candidate who works in security operations may already think fluently in Domain 5 vocabulary (encryption, access control, data classification) and need only maintenance practice there. The same candidate might find Domain 1 genuinely hard, because ISACA tests a very specific auditor's reasoning style: independence, evidence sufficiency, risk-based audit planning, and the "best answer" logic where two options are defensible and one is most defensible.

That auditor mindset is the hidden variable in CISA prep. Plenty of experienced security professionals fail Domain 1 practice sets not because they lack knowledge, but because they answer like engineers instead of auditors. If that's you, a 27-question domain can demand more calendar hours than a 39-question domain you already live in.

A sensible default allocation for a candidate without audit experience looks something like this:

• Domains 4 and 5 combined: 45–50% of practice volume. They're the biggest and most technical, and they reward repetition.
• Domain 1: 20–25%. Smaller in question count, but the reasoning style needs deliberate training.
• Domain 2: 15–20%. Governance frameworks (COBIT, risk management, IT strategy alignment) are learnable but dry; spaced repetition works well here.
• Domain 3: 10–15%. SDLC, project management, and systems acquisition concepts. Eighteen questions is too many to ignore, too few to over-invest in.

Then adjust after your first full-length timed practice test. Your score report by domain is a better planner than any generic split. PrepHoot's CISA question banks tag items by domain, so after a simulator run you can see exactly where your misses cluster and shift the next week's volume accordingly. Whatever tool you use, a structured CISA practice test review habit — reading why each wrong answer is wrong, not just noting the score — is what converts weighted practice into weighted points.

How does weighting interact with the passing score?

CISA is scored on a scale from 200 to 800, and you need 450 to pass. The exam runs 150 questions in four hours, a format confirmed across current sources including Infosectrain's overview of the updated CISA.

Because the score is scaled, there's no official statement that "each question is worth X points" or that domain weights map linearly onto your 450 target. ISACA's scoring process equates forms so that a 450 represents the same standard regardless of which item set you drew. Don't try to game the scaling.

What you can say with confidence: with Domains 4 and 5 supplying about 52% of scored content, a candidate who is strong in those two domains and merely adequate elsewhere has a structurally easier path to 450 than the reverse. The LinkedIn prep advice circulating in recent exam cycles — aim for 80% or better on Domains 4 and 5 before exam day — is directionally sound, even if the exact threshold is folk wisdom rather than ISACA policy.

Pacing also connects to weighting. Four hours for 150 questions is about 96 seconds per question, which is generous by certification standards. Candidates rarely run out of time on CISA; they run out of judgment. The risk is spending four minutes agonizing over a Domain 3 scenario that carries the same single-item value as everything else. In a timed simulator, practice the discipline of flagging and moving, especially on the long scenario items that cluster in Domains 3, 4, and 5. A timed mode that mirrors the real interface, like the one PrepHoot builds into its CISA exams, is where that habit actually forms. Reading about pacing doesn't build it.

Do practice tests match the official weighting?

Good ones do, and you can verify it in about two minutes. Take any practice bank, count (or estimate) the proportion of items per domain, and compare against 18/18/12/26/26. A bank that roughly matches those proportions is simulating the real exam's shape. A bank that's evenly split 20% across five domains is simulating convenience.

Three checks worth running on any CISA practice resource:

1. Blueprint date. Does the provider state which job practice version the bank reflects? You want explicit reference to the 2024 update or the current ISACA content outline.
2. Explanations on every answer. Weighted volume only helps if you learn from misses. An explanation that says "B is correct" teaches nothing; one that explains why the auditor's best answer is B and why C is a trap is the transferable part.
3. Domain-level reporting. After a timed run, you need per-domain scores, not just a total. Without them, the weighting arithmetic in this article is unusable for your own planning.

This is also where free question sets deserve skepticism. Many circulating CISA question collections were assembled years ago, still reflect the 21/17/12/23/27 split or older topic language, and carry no explanations. The exam-prep market has plenty of current options, and a quick comparison of stated domain weights against ISACA's outline will filter most of the stale ones. If you want to test the water first, PrepHoot publishes genuinely free CISA sample questions mapped to the current domains, so you can check the item style before committing study hours.

One tool idea that would make this easier: a simple domain-allocation calculator where you enter your per-domain practice scores and available weekly hours, and it outputs a weighted study split for the weeks remaining before your exam date. Until someone builds it, a spreadsheet with the table above does the same job.

How should I use the weights in my final two weeks?

In the final stretch, weighting becomes a triage tool. You've got limited evenings, and the question is where each hour buys the most points.

Run one or two full-length timed sets early in week one and record your per-domain percentages. Then apply a simple rule: practice volume goes to the intersection of high weight and low score. A 26% domain where you're scoring 65% beats an 18% domain where you're scoring 70%, every time. The two joint-largest domains dominate this math, which is why so many retakers discover their gap was operations and resilience all along.

In the last three or four days, stop chasing new volume. Re-attempt your missed questions instead — most candidates find their second-pass accuracy on previously missed items is the strongest predictor of exam-day performance. Flashcard mode works well for Domain 2's framework vocabulary (COBIT principles, governance structures, risk terminology) because those items reward recall more than reasoning.

And go in knowing the shape of what you'll face: 150 questions, four hours, roughly 27–27–18–39–39 across the five domains, 450 out of 800 to pass. Candidates who can recite that blueprint before they sit the exam spend less energy orienting themselves in the first twenty minutes, and that calm is worth real points.

Keep building your exam blueprint knowledge

• AZ-104 Exam Domains: The Practice Split Most Candidates Get Wrong
• Free Security+ Practice Test by Domain: Checks Before You Book
• How to Review CISA Practice Tests So Missed Questions Stick

Try the free sample questions, then create a free account or purchase full access or a membership for the exam they are preparing for. Get started