How many MCQs and TBSs are on ISC in 2026?

ISC has 82 MCQs across testlets of 41 and 41, followed by 6 TBSs across testlets of 1, 3, and 2.

How are MCQs and TBSs weighted on ISC?

ISC assigns 60% of the score to MCQs and 40% to TBSs. The official Blueprint lists these as score weights, not suggested study-time allocations.

Are the five ISC questions on this page official AICPA questions?

No. They are original CPAPass questions reviewed against their cited primary sources. They are not official, released, retired, or current CPA Exam items.

Where can I verify the official ISC scope?

Use the linked 2026 AICPA Blueprint for the authoritative content areas, representative tasks, skill levels, item counts, and score weights.

Discipline · ISC

Free ISC CPA Practice Questions

Answer five original, source-reviewed ISC questions and review each option. Current counts, score weights, and content areas come from the dated 2026 Blueprint contract.

By CPAPass Team

Quick answer

Answer five original, source-reviewed ISC MCQs without an account. The 2026 exam structure has 82 MCQs and 6 TBSs across five testlets. This short set is not a score prediction or a complete practice test.

Public set first

Try five questions, then continue in CPAPass

Each question and explanation is available without registration. Create an account when you want to continue ISC practice and keep your work together.

Create free account Try five questions first

2026 ISC format

ISC is a Discipline section with 4 hours of testing time. Its first two testlets contain 41 and 41 MCQs. Its final three testlets contain 1, 3, 2 TBSs.

MCQs carry 60% of the score and TBSs carry 40%. These are official score weights, not a suggested study-time formula.

Section typeDiscipline

Testing time4 hours

MCQs82 · 60%

TBSs6 · 40%

Official 2026 ISC content areas

ISC focuses on information systems, data management, security, business processes and controls, and IT audit and advisory work including SOC engagements.

Open the official 2026 AICPA Blueprint for the detailed groups, topics, representative tasks, and skill levels.

Area	Official name	Score-weight range
I	Information Systems and Data Management	35-45%
II	Security, Confidentiality and Privacy	35-45%
III	Considerations for System and Organization Controls (SOC) Engagements	15-25%

Official content-area explorer

Explore the 2026 ISC content areas

Select an area to see its official Blueprint number and score-weight range. No generated skill percentages or predicted question mix are shown.

Score-weight range

Information Systems and Data Management

35-45%

This is the official range assigned to Area I. It is not a promise about the exact questions in an individual exam form.

Blueprint limitationBlueprint tasks are representative, not exhaustive. The number of listed tasks does not establish content weight or predict the exact questions a candidate will receive.

Source contract reviewed 2026-08-03.

Try five source-reviewed ISC practice questions

Commit to an answer before reading each explanation. Review every distractor, then choose Next question to continue through the five-item set.

Question 1 of 5

ISC - SOC Engagements

A payroll processor has controls that may affect a customer's internal control over financial reporting. Which SOC examination focuses on those controls?

Report issue

ISC practice questions with answers

Browse all five ISC questions from the session above. Try each question before opening its answer, then review why the other choices do not work.

ISCQuestion 1 of 5

SOC Engagements

A payroll processor has controls that may affect a customer's internal control over financial reporting. Which SOC examination focuses on those controls?

A.SOC 1
B.SOC 2
C.SOC 3
D.A compilation engagement

Show answer and explanation

Correct answer: A. SOC 1

A SOC 1 examination addresses controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting.

Why each choice is right or wrong

A. SOC 1 is designed for controls relevant to user entities' internal control over financial reporting.
B. SOC 2 addresses controls relevant to the trust services criteria, not specifically financial reporting controls.
C. SOC 3 is a general-use report related to the trust services criteria.
D. A compilation does not examine a service organization's controls.

Source reviewed 2026-08-12: AICPA SOC 1 guidance

ISCQuestion 2 of 5

SOC 2

A service organization wants an examination of controls relevant to security, availability, processing integrity, confidentiality, or privacy. Which engagement is designed for that purpose?

A.SOC 1
B.SOC 2
C.Compilation
D.Financial statement review

Show answer and explanation

Correct answer: B. SOC 2

SOC 2 examinations address controls relevant to one or more of the AICPA Trust Services Criteria.

Why each choice is right or wrong

A. SOC 1 focuses on controls relevant to user entities' internal control over financial reporting.
B. SOC 2 is the examination aligned with the Trust Services Criteria.
C. A compilation does not examine service-organization controls.
D. A financial statement review is not a SOC controls examination.

Source reviewed 2026-08-12: AICPA SOC 2 guidance

ISCQuestion 3 of 5

NIST Cybersecurity Framework

Under NIST Cybersecurity Framework 2.0, which Function addresses establishing and monitoring the organization's cybersecurity risk-management strategy, expectations, and policy?

A.Govern
B.Detect
C.Respond
D.Recover

Show answer and explanation

Correct answer: A. Govern

The Govern Function covers the cybersecurity risk-management strategy, expectations, and policy that guide the other Functions.

Why each choice is right or wrong

A. Govern establishes and monitors the risk-management direction and accountability context.
B. Detect focuses on finding and analyzing possible cybersecurity attacks and compromises.
C. Respond focuses on actions taken regarding a detected incident.
D. Recover focuses on restoring affected assets and operations after an incident.

Source reviewed 2026-08-12: NIST Cybersecurity Framework 2.0

ISCQuestion 4 of 5

Logical Access

Which access-control design most directly applies the principle of least privilege?

A.Give every employee administrator access for convenience
B.Grant users only the access needed to perform assigned tasks
C.Share one privileged account across the department
D.Keep access unchanged after employees change roles

Show answer and explanation

Correct answer: B. Grant users only the access needed to perform assigned tasks

Least privilege restricts access to the minimum authorizations necessary for assigned organizational tasks.

Why each choice is right or wrong

A. Universal administrator access exceeds normal task requirements.
B. Limiting authorization to assigned needs is the core least-privilege design.
C. Shared privileged accounts weaken accountability and do not minimize authorization.
D. Role changes should trigger access review rather than preserving outdated privileges.

Source reviewed 2026-08-12: NIST SP 800-53 Revision 5, Security and Privacy Controls

ISCQuestion 5 of 5

Incident Response

A security team confirms that malware is actively spreading between company systems. Which response should take immediate priority?

A.Contain the incident to limit further harm
B.Delete all incident records
C.Delay action until the annual risk assessment
D.Restore every system before stopping the spread

Show answer and explanation

Correct answer: A. Contain the incident to limit further harm

Incident response should contain active harm while preserving the ability to analyze, eradicate, and recover in a coordinated manner.

Why each choice is right or wrong

A. Containment limits further impact while the response team continues analysis and remediation.
B. Deleting records can destroy evidence needed for investigation and recovery.
C. An active incident requires timely response rather than deferral to a periodic assessment.
D. Restoration before containment can allow malware to compromise restored systems again.

Source reviewed 2026-08-12: NIST SP 800-61 Revision 3, Incident Response Recommendations

How to review these five ISC questions

Choose an answer for each question before opening its explanation. Then review the correct-answer reasoning and every distractor, including when your first choice was correct.

A useful ISC comparison task gives you a system or service-organization scenario and asks which control, risk response, evidence, or report consideration fits the facts.

If the vocabulary feels familiar but answer choices remain close, practice explaining the control objective and the risk it reduces. Because ISC is weighted 60 percent MCQ, precise distinctions deserve deliberate review.

What five ISC questions can and cannot show

This set can reveal how you apply its reviewed rules and explain the alternatives. It cannot estimate a CPA Exam score, predict a pass, or represent the full Blueprint.

Use the official Blueprint to verify scope, the section guide to plan coverage, and a larger set of unfamiliar questions when you need broader evidence.

Choose the next ISC practice step

If a rule was unfamiliar, return to the ISC guide before doing more questions. If a rule was familiar but the scenario caused the miss, continue with changed-fact practice and explain why each wrong option fails.

Create a CPAPass account when you want to continue section practice and keep your work together. The five free questions, official Blueprint link, and PDF resource remain available without treating account creation as proof of readiness.

Continue with the resource that matches your next job

Request the ISC PDF pack

Keep the section resource available for offline review. The PDF request is separate from creating a CPAPass account.

Get the ISC PDFs

Try a different CPA section

Choose another section and try its five free questions, with explanations for every answer.

Browse all CPA practice questions

Review the ISC section guide

Review the exam format, tested topics, and study-planning advice for your section.

Open the ISC guide

Review the official Blueprint

Verify detailed groups, topics, representative tasks, and tested skill levels with the official source rather than treating this five-question set as complete coverage.

Open official Blueprint

ISC practice questions: common questions

How many MCQs and TBSs are on ISC in 2026?: ISC has 82 MCQs across testlets of 41 and 41, followed by 6 TBSs across testlets of 1, 3, and 2.
How are MCQs and TBSs weighted on ISC?: ISC assigns 60% of the score to MCQs and 40% to TBSs. The official Blueprint lists these as score weights, not suggested study-time allocations.
Are the five ISC questions on this page official AICPA questions?: No. They are original CPAPass questions reviewed against their cited primary sources. They are not official, released, retired, or current CPA Exam items.
Where can I verify the official ISC scope?: Use the linked 2026 AICPA Blueprint for the authoritative content areas, representative tasks, skill levels, item counts, and score weights.

Continue ISC practice in CPAPass

Create a free account to continue beyond this public ISC set and keep your practice activity together.

Create My ISC Account