ISACA • CyberSec-Audit
Cybersecurity Audit Certificate Practice Test
Validates the ability to evaluate cybersecurity risk and audit organizational cybersecurity controls, covering cybersecurity operations, technology topics, governance, the audit role in cybersecurity, security frameworks, threat assessment, and regulatory requirements.
Exam Details
Questions
597
Duration
120 minutes
Passing Score
65%
Difficulty
AssociateLast Updated
Feb 2026
Exam Domain Breakdown
Cybersecurity Operations45%
Cybersecurity Technology Topics30%
Cybersecurity Governance20%
Cybersecurity and Audit's Role5%
Exam Overview
The ISACA Cybersecurity Audit Certificate is a certificate-level credential designed to validate a professional's ability to evaluate cybersecurity risk and audit organizational cybersecurity controls. The program is organized across four high-level domains—Cybersecurity Operations, Cybersecurity Technology Topics, Cybersecurity Governance, and Cybersecurity and Audit's Role—developed through extensive research and input from subject matter experts worldwide. It bridges the gap between traditional IT audit and modern cybersecurity practice, equipping candidates to assess threat environments, evaluate security controls, and align audits with established security frameworks and regulatory requirements.
This certificate is recognized globally and is particularly valued in industries where assurance over cybersecurity posture is critical, such as finance, healthcare, government, and technology. Unlike ISACA's full CISA certification, it does not require prior work experience, making it accessible to those earlier in their audit or security careers while still demonstrating verified, exam-tested competency through a shareable digital badge issued via the Credly platform.
Who Should Take This Exam
The Cybersecurity Audit Certificate is primarily aimed at audit and assurance professionals who need to develop or formalize their cybersecurity audit skills, as well as IT risk professionals seeking a deeper understanding of cyber-related risks and mitigating controls. Security practitioners who want to understand the audit process from a cybersecurity lens are also well-served by this credential.
Suitable job roles include IT auditors, internal auditors, IT risk analysts, compliance officers, and information security analysts. ISACA recommends that candidates have a basic understanding of cybersecurity concepts and some prior industry experience, though neither is a formal requirement. The certificate is especially useful for professionals looking to add cybersecurity audit specialization without committing to the full CISA certification pathway.
Prerequisites
There are no formal prerequisites for the Cybersecurity Audit Certificate. Candidates may register at any time without needing to demonstrate prior certifications, educational qualifications, or work experience. This makes it one of ISACA's most accessible credentials.
However, ISACA recommends that candidates possess a foundational understanding of cybersecurity concepts and some practical experience within the IT audit or security industry before sitting the exam. Familiarity with common security frameworks (such as NIST, ISO 27001, or COBIT) and basic knowledge of audit methodologies will assist in exam preparation and in understanding the context of the domains covered.
Exam Format
The Cybersecurity Audit Certificate exam is delivered online as a closed-book, remotely proctored assessment. It consists of 75 multiple-choice questions and must be completed within a 2-hour time limit. The number of questions per domain is proportional to each domain's assigned percentage weight. A passing score of 65% or higher is required.
Candidates can register at any time on a continuous basis, and exam scheduling is available as early as 48 hours after payment of registration fees. Upon registration, candidates have a 12-month eligibility window in which to sit the exam. Exam fees are US$259 for ISACA members and US$299 for non-members. Upon passing, candidates receive a digital badge credential managed through the Credly platform.
Skills Measured
- 1.Cybersecurity Operations (45%): Covers the day-to-day operational aspects of cybersecurity programs, including asset management, threat and vulnerability management, incident response, identity and access management, security monitoring, and control implementation and assessment. This is the most heavily weighted domain on the exam.
- 2.Cybersecurity Technology Topics (30%): Addresses specific technology areas relevant to cybersecurity audits, including network security, cloud security, endpoint protection, cryptography, application security, and emerging technology risks. Candidates are expected to understand how these technologies are audited and assessed for control effectiveness.
- 3.Cybersecurity Governance (20%): Focuses on cybersecurity program governance structures, security policies and standards, risk management frameworks, regulatory and compliance requirements, and alignment of cybersecurity strategy with organizational objectives. Includes familiarity with frameworks such as NIST CSF and ISO 27001.
- 4.Cybersecurity and Audit's Role (5%): Examines the specific role that internal and external audit functions play within a cybersecurity program, including audit planning, execution, reporting, and how audit findings relate to organizational risk management and governance.
Study Tips
- Use the official ISACA Cybersecurity Audit Certificate Study Guide as your primary reference—it is structured around the four exam domains and doubles as a practical desk reference, making it the most aligned resource to the actual exam content.
- Enroll in ISACA's official online course (8+ hours, 10 CPE credits) to get structured instruction from current practitioners. The course covers all four domains and is designed specifically to prepare candidates for the exam format and question style.
- Download and read the Cybersecurity Audit Certificate Exam Candidate Guide from the ISACA website to understand exact rules around remote proctoring, exam administration, the retake policy, and how scoring works—eliminating surprises on exam day.
- Prioritize Cybersecurity Operations (45%) and Cybersecurity Technology Topics (30%) in your study schedule, as together they account for 75% of exam questions. Ensure you can distinguish between control types, describe audit procedures for each, and map controls to common frameworks.
- Build familiarity with major cybersecurity frameworks referenced in the exam—particularly NIST Cybersecurity Framework, ISO/IEC 27001, and COBIT—so you can answer governance and audit-role questions that require framework alignment.
- Practice applying audit thinking to cybersecurity scenarios: for each technology or operational topic you study, ask yourself how an auditor would test the related control, what evidence would be gathered, and what a finding might look like.
- After completing the study guide and course, take timed practice sessions of 75 questions to build stamina and simulate the 2-hour exam constraint. Focus on understanding why wrong answers are wrong, not just memorizing correct ones.
Career Benefits
The Cybersecurity Audit Certificate positions holders to pursue or advance in roles such as IT auditor, internal auditor, IT risk analyst, compliance officer, and information security analyst. It serves as a strong entry point toward ISACA's flagship CISA certification, and professionals who later earn the CISA can expect significantly elevated earning potential—ISACA salary survey data indicates that certified professionals earn approximately 20% more than non-certified peers, with average U.S. CISA salaries exceeding $149,000 annually. Even at earlier career stages, IT audit and cybersecurity audit professionals in the U.S. typically earn between $63,000 and $100,000 depending on experience level.
Demand for cybersecurity audit skills is strong across regulated industries including financial services, healthcare, and government, where assurance over cybersecurity controls is a compliance and governance requirement. The certificate's digital badge, shareable via LinkedIn and Credly, provides verifiable proof of competency that is recognized by employers globally. For professionals who are not yet ready for the full CISA, this certificate offers a credible intermediate credential that demonstrates practical knowledge of cybersecurity audit without requiring years of documented work experience.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 597 questions.
1. A financial services company uses Docker containers to deploy microservices applications. An auditor reviews the Dockerfile configurations and container runtime settings. Which finding represents the MOST critical security vulnerability requiring immediate remediation? (Select one!)
AContainers are configured to run as root user without implementing USER instruction in Dockerfiles
BSecurity group rules allow containers to communicate on all ports without network policy restrictions
CDocker socket is exposed to containers enabling direct communication with the Docker daemon
DContainers use read-write root filesystems instead of read-only filesystem configurations
Explanation
Exposing the Docker socket to containers represents the most critical vulnerability because it grants complete control over the Docker daemon, enabling container escape and host system compromise. The Docker socket provides full Docker API access, allowing any process with socket access to create privileged containers, mount host filesystems, manipulate other containers, and execute arbitrary code on the host. This effectively grants root-equivalent access to the entire container host. Running containers as root is a significant security issue enabling privilege escalation if container escape occurs, but requires exploiting a separate vulnerability to escape the container. Read-write root filesystems increase attack surface by allowing attackers to modify container files, but this affects the container environment rather than enabling host compromise. Lack of network policies between containers violates segmentation principles but remains within the container networking layer. Socket exposure bypasses all container isolation boundaries entirely.
2. During a security awareness program audit, the auditor discovers that the organization conducts annual security awareness training for all employees covering phishing, password security, and data handling. However, phishing simulation results show that 40% of employees still click on simulated phishing emails, and the click rate has not improved over three consecutive quarters. Which action would MOST effectively improve the training program? (Select one!)
AIncrease the training frequency from annual to quarterly sessions
BImplement role-based training with targeted content for high-risk positions
CEstablish immediate, contextualized training triggered by failed phishing simulations
DAdd disciplinary consequences for employees who repeatedly fail simulations
Explanation
Just-in-time training immediately following a failed phishing simulation provides teachable moments when employees are most receptive to learning. This approach delivers relevant, contextualized education at the point of failure, explaining what indicators the employee missed and why the email was suspicious. Research shows immediate feedback is significantly more effective than periodic training because it reinforces lessons while the experience is fresh. The employee understands their specific vulnerability rather than general concepts. CIS Control 14 (Security Awareness and Skills Training) emphasizes continuous education rather than annual checkbox exercises. Increasing frequency to quarterly still maintains the ineffective approach of periodic, general training that does not address individual vulnerabilities. Role-based training improves relevance but does not provide the immediate feedback loop of teachable moments. Disciplinary approaches create fear and reporting reluctance rather than genuine behavior change, and may discourage employees from reporting real security incidents.
3. A retail organization implements the NIST Cybersecurity Framework 2.0 and focuses on the GOVERN function first. Which activity is MOST closely aligned with the GOVERN function? (Select one!)
ADeploying endpoint detection and response agents on all workstations
BConfiguring SIEM correlation rules to detect lateral movement
CConducting penetration testing of the e-commerce platform
DEstablishing a cybersecurity risk management strategy approved by the board
Explanation
The GOVERN function in NIST CSF 2.0 establishes cybersecurity risk management strategy, expectations, and policy at the organizational governance level. Board approval of risk management strategy is a quintessential governance activity. Deploying EDR agents is a PROTECT function implementation activity. Configuring SIEM rules is a DETECT function activity focused on monitoring and detection. Penetration testing falls under the IDENTIFY function for understanding vulnerabilities and risks. GOVERN operates at the strategic level above these tactical implementations.
4. An auditor evaluates a Purple Team exercise and observes: the Red Team successfully deployed a web shell through an unpatched vulnerability, the Blue Team did not detect the initial compromise, the Purple Team facilitated knowledge transfer by demonstrating why existing signatures failed to detect the attack, and new detection rules were developed and tested. What is the PRIMARY value demonstrated by this Purple Team approach? (Select one!)
AIdentifying unpatched vulnerabilities requiring remediation
BDemonstrating Red Team's ability to bypass security controls
CProving Blue Team requires additional training and tools
DValidating detection capabilities and improving defensive controls through collaboration
Explanation
Validating detection capabilities and improving defensive controls through collaboration represents the primary value of Purple Team exercises. The Purple Team approach bridges offensive and defensive teams by facilitating knowledge sharing, testing whether attacks trigger alerts, identifying gaps in detection logic, and driving continuous improvement through the attack-detect-improve-retest cycle. This scenario demonstrates the complete Purple Team value proposition: the Red Team attack revealed a detection gap, the Purple Team facilitated understanding of why detection failed, and improved rules were developed and validated. While identifying unpatched vulnerabilities is valuable, vulnerability discovery is a secondary outcome rather than the primary purpose of Purple Team collaboration, which focuses on detection and response validation. Demonstrating Red Team bypass capabilities alone provides limited value without the collaborative improvement component that Purple Team facilitates. Proving Blue Team deficiencies without the constructive improvement process would be a Red Team outcome, not a Purple Team value.
5. An auditor tests the design effectiveness of privileged account controls and documents: privileged account inventory maintained and quarterly reviewed, credentials stored in enterprise password vault, session recording enabled for administrative connections, just-in-time access provisioning approved within 24 hours, privileged account analytics monitors for anomalous behavior. The auditor concludes design is adequate. What should the auditor do NEXT? (Select one!)
AReview privileged account analytics alerts to identify unremediated security incidents
BReport the finding as satisfactory since design effectiveness is confirmed
CTest operating effectiveness by sampling privileged access activities over the audit period
DInterview administrators to confirm their understanding of privileged account policies
Explanation
After confirming design effectiveness, the auditor must test operating effectiveness to determine whether controls functioned as designed throughout the audit period. This requires examining a representative sample of privileged access requests, approval workflows, session recordings, inventory reviews, and analytics alerts over typically 12 months to verify consistent operation. Design effectiveness only confirms the control is properly structured but provides no assurance it operated correctly. Reporting the finding as satisfactory without testing operations would provide false assurance as controls may be well-designed but not implemented or maintained. Administrator interviews provide evidence for design but not operations. Reviewing analytics alerts is part of operating effectiveness testing but not the complete next step.
$7
One-time access to this exam
Full access to all 597 questions
Or $15/mo for all 201 exams
Detailed explanations
Free preview stays available