Validates knowledge of IT risk governance, risk assessment, risk response and reporting, and technology controls.
CRISC is 150 multiple-choice questions in four hours. It puts you in the risk owner's seat: the best answer ties to the business objective. We compared the main options on question volume, full-length tests and price.
Most people should start with ISACA's free 10-question quiz. Use ISACA's QAE database as your main bank, then add Hemang Doshi's Udemy tests for extra full-length runs.
| Practice test | Best for | Questions | Price |
|---|---|---|---|
 Free CRISC Practice Quiz | Free first look | 10 | Free |
| CRISC Questions, Answers & Explanations Database | Official question bank | 983 | $399 |
 Practice Tests to prepare for CRISC Exam (Updated 2026) | Extra full-length tests | 750 | $20 |
 ISACA CRISC Question Bank | Study on your phone | 600 | $21/month |
Ten questions in ISACA's own style, each with an explanation of why the best answer fits and why the others do not. You submit a short contact form to see your results.
Great fit if you want a free look at how ISACA frames risk questions before paying for a bank.
Poor fit if you need volume or a timed run; use the QAE database.
ISACA's own bank (version 8.1) explains every answer choice, builds sessions by domain and subcategory, and tracks results by domain. It includes three full-length timed practice exams, flashcards and a study planner.
Great fit if you want the closest thing to ISACA's wording and a bank you can work through domain by domain.
Poor fit if you want a cheaper second bank for fresh questions; see Doshi's tests.
Five 150-question tests with explanations and unlimited attempts, organised by the four current CRISC domains. Candidates use them for extra full-length runs, and one finds the questions similar to the QAE.
Great fit if you have worked through the QAE and want more full-length tests at a low price.
Poor fit if you want ISACA's exact wording; one candidate saw many cryptography questions that ISACA's own material never showed.
A phone-friendly bank of 600 questions with subject quizzes and a premium mock exam, built around the four current domains. It is a lighter supplement to the QAE.
Great fit if you study in short sessions on your phone and want a low-cost monthly bank.
Poor fit if you want ISACA's own wording; use the QAE database.
ISACA: CRISC QAE database ↗ISACA: CRISC exam content outline ↗Reddit: passed, QAE 8th edition ↗Reddit: ready for exam, QAE and Doshi scores ↗Reddit: how I passed CRISC ↗
ISACA offers a free 10-question quiz with explanations; you submit a short form to see your results. Pocket Prep lets you try 30 questions free. There is no larger free ISACA bank, and free lists elsewhere vary widely in quality.
Candidates name it as the main bank and the best preparation for ISACA's phrasing, though the real questions are worded differently, so reading the explanations matters more than the scores. It costs $399 for non-members and $299 for members for six months.
In principle yes, since ISACA does not require it, but r/CRISC pass reports almost all name the QAE as the main bank. On a tight budget, combine the free quiz, Pocket Prep's 30 free questions and Doshi's $20 tests, and expect a looser match to ISACA's wording.
ISACA sets no number. The QAE includes three timed exams; adding one or two from Doshi's set gives fresh full-length practice before you book.