Think like the security manager
The technical fix feels right. The exam wants the management decision: governance, risk, then action.
Miss reason you can tag in CertArc: Answered as technician, not manager
Why CertArc · CISM, CISSP, CISA
Practice that shows you why the wrong answer felt right.
CISM, CISSP and CISA questions rarely test recall. They ask which plausible action is best, first or most appropriate for a specific role. CertArc is practice built around that decision: you rate your confidence, compare every option, read a role-based Lens, and tag why you missed. Those signals become your patterns, your readiness picture and your study calendar.
Last updated:
- 3
- certifications live: CISM, CISSP, CISA
- 4,450
- original scenario questions across all programs
- 21 days
- free access after your baseline. No credit card.
- Independent
- original scenarios, not official or recalled questions
Is CertArc for me?
Built for professionals who know the material and still miss the question.
CertArc is for you if
- You know the material but keep choosing the technical, operational or "fix it now" answer.
- You scored well on official practice and still did not pass, and you want to know why.
- You study in short windows around a full-time job and need the next step chosen for you.
- You are planning more than one certification and want one system for all of them.
- You have worked through large free CISSP question sets and still do not feel ready, because a remembered answer letter is not the same as understanding.
- You work in audit or assurance and keep choosing what management would do instead of what an auditor can evidence.
It is not for you if
- You are new to security and need concept teaching or video lectures first.
- You want recalled exam questions. CertArc uses original scenarios only.
- You want a promise about the exam result. CertArc gives evidence, not predictions.
The problem
Why do experienced professionals miss questions they know?
Every option on these exams is plausible. The question is which one is best, first or most appropriate for a specific role. Practitioners answer as the person they are at work, and the exam wants the person the certification describes.
Think like the security decision-maker
Every option is a valid control. The exam wants the right decision level, sequence and scope.
Miss reason you can tag in CertArc: Used the wrong decision level
Think like the IS auditor
The management answer feels responsible. The exam wants what an auditor can evidence and defend.
Miss reason you can tag in CertArc: Answered as management, not as an auditor
Go deeper: The CISM managerial mindset · Choosing between two correct CISSP answers · The CISA auditor mindset
Show, not tell
See a real review before you sign up.
One CISM question the way a learner reviews it: why the chosen answer felt right, every option compared, and the CISM Lens. CISSP and CISA reviews work the same way with their own Lens.
A CISM question from an example learner's practice exam
Active learning
You do the diagnosing. CertArc keeps the score.
Reading a good explanation feels productive and fades by the weekend. CertArc asks you to make a judgement at four moments in every question, then turns those judgements into evidence you can act on.
- 1 · Before you answer
You commit to a confidence level.
A score cannot tell a lucky guess from real knowledge. Your confidence rating can.
- 2 · After you answer
You compare all four options yourself before reading the Lens.
Working out why the tempting option fails is what makes the rule stick.
- 3 · When you miss
You choose the reason you missed.
Naming the habit is the first step to breaking it. CertArc keeps count so you can see it recurring.
- 4 · Before you move on
You save the rule in your own words.
Retrieval beats re-reading. A rule you wrote transfers to a scenario you have not seen.
What happens after you answer
Rate your confidence
Before you submit: Confident, Unsure or Guess. It takes a second and it is the most honest data you will produce all day.
Compare every option
See why each option attracts you, why it fails, and the rule to carry forward, including the ones you did not pick.
Read the Lens
A role-based explanation of the decision frame and the trap in the question, written for your certification.
Tag why you missed
Choose one of six reasons. Knowledge gap or reasoning habit? Each needs a different fix.
Patterns shape your plan
Recurring reasons, confident mistakes and domain gaps set your next sprint and your calendar.
Coaching on every question
The three-tab review explains every option, not just the right one.
- Tab 1
Your answer
What you chose, your confidence, your miss reason and your saved rule.
- Tab 2
Compare the answers
All four options side by side: why each attracts, why it fails, what to carry forward.
- Tab 3
CertArc Lens
The decision frame for your role, the trap in the question and the rule to remember.
The Lens is written for your certification: a CISM Lens coaches the management decision, a CISSP Lens the decision level, a CISA Lens what an auditor can defend.
Go deeper: How to review wrong CISM answers
Analytics
What CertArc shows you that a score hides.
A percentage tells you how many you got right. It cannot tell you which right answers were guesses, which wrong answers you were sure about, or whether you keep missing for the same reason.
Trust Calibration Audit
Confident-but-wrong answers, the costliest kind on exam day.
Pattern Intelligence
Your missed reasons ranked, so you can see which habit keeps recurring.
Domain and Knowledge Area snapshots
Where your evidence is strong, where it is thin, and what needs attention.
Pace and timing
Your pace pattern, rushing risk and slowest knowledge area against real exam pacing.
Take history
Take 1, Take 2 and the composite, with what changed between them.
Recommended next move
One next step chosen from all of the above. Open the app and it is already there.
Go deeper: Why CISM practice scores can be misleading
Retakes
Retakes that prove improvement instead of assuming it.
- Retakes open 48 hours after a take. The wait discourages memorising answer letters.
- Choose a full retake or a focus retake that re-tests only the questions you are still missing.
- Take 1, Take 2 and a composite score show what moved, so improvement is visible rather than assumed.
Go deeper: CISM retake strategy · CISSP retake strategy
Beside your other prep
How CertArc fits beside what you already use.
Most candidates arrive with official materials, an app or a course. CertArc does not replace any of them. It adds the evidence they do not produce.
Official question databases, such as ISACA's QAE
- Does well
- Official items, resets and practice on the questions you missed.
- CertArc adds
- An independent check that your reasoning transfers to unfamiliar wording, plus confidence calibration and missed-reason patterns.
Question-bank apps
- Does well
- Volume, explanations, mock exams and a readiness number.
- CertArc adds
- Role-based decision traps, coaching on every option, patterns by miss reason and a practice-to-final sequence the product enforces.
Video courses
- Does well
- Concept teaching and structured review.
- CertArc adds
- Active retrieval under exam conditions, with evidence of what improved between takes.
Free question dumps
- Does well
- Free and plentiful.
- CertArc adds
- Original scenarios reviewed before release, so a remembered answer letter never counts as readiness.
| What you may already use | What it does well | What CertArc adds |
|---|---|---|
| Official question databases, such as ISACA's QAE | Official items, resets and practice on the questions you missed. | An independent check that your reasoning transfers to unfamiliar wording, plus confidence calibration and missed-reason patterns. |
| Question-bank apps | Volume, explanations, mock exams and a readiness number. | Role-based decision traps, coaching on every option, patterns by miss reason and a practice-to-final sequence the product enforces. |
| Video courses | Concept teaching and structured review. | Active retrieval under exam conditions, with evidence of what improved between takes. |
| Free question dumps | Free and plentiful. | Original scenarios reviewed before release, so a remembered answer letter never counts as readiness. |
CertArc does not replace official study materials or the certifying body's requirements. It sits beside them as an independent check on judgement.
Go deeper: How CertArc compares with ISACA QAE · CertArc compared with CISM question banks · Failed CISM after QAE: what to change
Learner journey
From first visit to final readiness.
This order is real: the product enforces it. A 25-question sprint fits a lunch break, timed exams unlock in sequence, and you review your misses before the next one opens, so practice builds instead of piling up.
Free from your first visit
Coached warmup
Free5 questions with instant coaching
Explanations appear immediately, so you meet the Lens and the confidence rating before any pressure.
Scored baseline
Free20 questions under exam conditions
No answers until the end. With the warmup it forms a 25-question baseline across every domain.
Results, analysis and study calendar
FreeYour starting map
Domain and knowledge-area signals, early missed-reason patterns, and a day-by-day calendar built to your exam date.
Free access starts
FreeSprint 1 in every domain plus Practice Exam 1
No credit card. Everything you answer gets the full three-tab review. Retakes are not included.
With paid access
Study sprints
Paid6 × 25-question sprints per domain
Foundation, then application, then mastery. Untimed, with coaching after every question.
Practice exams
Paid10 × 30-question practice exams
Timed and mixed-domain. No answers until the end. Review your misses before the next exam opens.
Mock exams
Paid5 × 50-question mock exams
Unlock after all practice exams. Built for stamina and pacing.
Final readiness assessment
Paid25-question closing check
Unlocks after all mock exams. One last read on transfer before exam day.
Retakes
PaidFull or focus
Available 48 hours after a take. Take 1, Take 2 and the composite show what changed.
The calendar does the scheduling.
Set an exam date and study days, and the calendar places every sprint and exam. Miss a day and you rebalance the unfinished items in one click. Completed work stays where it is.
Go deeper: CISM study plan · CISSP study plan · CISA study plan
Programs
The same system for every certification. Reasoning written for each one.
Every program goes through the same launch checklist and gets the full product: the same onboarding, the same review depth and the same dashboard. What changes is the role the coaching trains.
- CISMISACA
- Role it coaches
- Security manager
- Domains
- 4 · 17 / 20 / 33 / 30%
- Original questions
- 1,200+
- Study sprints
- 24 × 25 questions
- Free path
- 155 free questions
- CISSPISC2
- Role it coaches
- Security decision-maker
- Domains
- 8 · 16 / 10 / 13 / 13 / 13 / 12 / 13 / 10%
- Original questions
- 1,800+
- Study sprints
- 48 × 25 questions
- Free path
- 255 free questions
- CISAISACA
- Role it coaches
- IS auditor
- Domains
- 5 · 18 / 18 / 12 / 26 / 26%
- Original questions
- 1,300+
- Study sprints
- 30 × 25 questions
- Free path
- 180 free questions
| Program | Role it coaches | Domains | Original questions | Study sprints | Free path |
|---|---|---|---|---|---|
| CISMISACA | Security manager | 4 · 17 / 20 / 33 / 30% | 1,200+ | 24 × 25 questions | 155 free questions |
| CISSPISC2 | Security decision-maker | 8 · 16 / 10 / 13 / 13 / 13 / 12 / 13 / 10% | 1,800+ | 48 × 25 questions | 255 free questions |
| CISAISACA | IS auditor | 5 · 18 / 18 / 12 / 26 / 26% | 1,300+ | 30 × 25 questions | 180 free questions |
What is free
Try the whole loop free for 21 days. No card, no password.
Free access is a real slice of the product, not a locked demo. Sign in with an email code or Google, or continue as a guest and attach your progress later.
- A coached warmup, then a scored baseline under exam conditions
- Results, analysis and a study calendar built from your baseline
- Sprint 1 in every domain, with the full three-tab review
- One mixed-domain practice exam with results and review
- Confidence capture, miss-reason tagging, patterns and the dashboard throughout
- CISM
- 155free questions
- CISSP
- 255free questions
- CISA
- 180free questions
Free access covers these selected sessions, not the full bank. Later sprints, exams and retakes require paid access. Retakes are not included in free access.
No credit card required
Go deeper: Free CISM diagnostic · Free CISSP diagnostic · Free CISA diagnostic
Readiness score
A readiness score built from your own evidence.
It is calculated from what you actually do in CertArc: your baseline, domain mastery, practice exam results, how sure you were and your pace. Older evidence counts less, so the score moves as you study.
The readiness score is a preparation signal, not a pass prediction. A correct answer marked Confident earns full credit; Unsure and Guess earn less. Older evidence counts less over time, and the score stays provisional until every domain has evidence.
Go deeper: CISSP readiness methodology
The questions
Where the questions come from.
Original scenarios
Every question starts from a decision pattern for the role, not from a recalled exam item. No brain dumps, ever.
Mapped to the published outline
Domains and knowledge areas follow each certifying body’s published exam outline, with the source linked on the program pages.
Reviewed before release
Structural checks, role-alignment review and coaching gates run before a question is promoted. Missing evidence fails closed.
Corrected in the open
Report a question from inside the review and the correction process is documented on the methodology page.
Read the full content standards, review process and correction handling on the methodology page. CertArc is not affiliated with, endorsed by, or sponsored by ISACA or ISC2. CISM and CISA are registered trademarks of ISACA. CISSP is a registered trademark of ISC2.
Cost
One price table for every program.
Every plan includes the same learning system. Choose the window that matches your exam date.
Free
$0
21 days · no card
Baseline, Sprint 1 in every domain, one practice exam.
Flexible
$49
per month · cancel anytime
One certification program.
One exam window
$99
once · 90 days
One certification program.
All programs
$199
once · 24 months
Every program, including programs released during your access.
Refund within 7 days if you have barely started; the exact question limit is in the Terms. Payments are handled by Creem and no card data is stored on CertArc servers. Compare plans by program.
Questions candidates ask
Before you start.
Is CertArc just another question bank?
No. Every answer is followed by a confidence check, a comparison of all four options and a role-based Lens. Misses are tagged by reason and turned into patterns, a readiness picture and a study calendar. The free baseline shows the whole loop before you pay.
What exactly is free, and do I need a card?
No card. Free access includes the 25-question baseline with results and analysis, a study calendar, Sprint 1 in every domain, one 30-question practice exam, and the full three-tab review on everything you answer. Later sprints, later exams and retakes need paid access.
Does the readiness score tell me whether I will pass?
No. It is a preparation signal, not a pass prediction. It is built from your own evidence, and it should be read together with your domain results, confidence patterns and pace.
Are these official ISACA or ISC2 questions?
No. CertArc writes original scenarios and is not affiliated with, endorsed by, or sponsored by ISACA or ISC2. It does not replace official study materials or the certifying body’s requirements.
How long does a study session take?
A study sprint is 25 questions with coaching after each one, which fits a lunch break or a commute. The calendar sets how many sprints and exams land on each of your study days, and you can rebalance it when life gets in the way.
Can I use it on my phone?
Yes. CertArc is a responsive web app. Progress is saved as you go, so you can start a session on a laptop and finish it on your phone. One timed exam can be active at a time.
What happens when my free access ends?
Your baseline results, calendar and analysis stay with your account, and you can resume or review the sessions you already own. Continuing to later sprints, exams and retakes requires paid access.
I failed once already. Does CertArc help retakers?
Retakers use CertArc as an independent check on whether their reasoning transfers to scenarios they have not seen. Confidence calibration shows where certainty and accuracy split, and missed-reason patterns separate knowledge gaps from reasoning habits. It sits beside official preparation rather than replacing it.
Find out why the wrong answer felt right.
Take the free baseline. See what your answers reveal before you decide anything.