Certified Information Systems Security Professional (CISSP)

Last checked October 22, 2026 against the official ISC2 exam page.

1. Question 1Security and Risk Management

   A company is writing a security policy after an incident in which a contractor kept access for months. The CISO wants the policy to define who is accountable for access decisions for each system. Which control best supports this?

   1. ARequiring the security team to approve every access request personally, so that no single owner is needed
   2. BAllowing each system administrator to grant access as needed, since the people closest to the system know best
   3. CAssigning a data owner for each information asset, who approves access and is accountable for classification
   4. DPublishing a quarterly list of all users to the intranet so that managers can spot anyone who should not be there
   Show answer and explanationHide answer

   Correct answer: C

   A data owner is accountable for classification and for approving access to an asset, which fixes accountability in the policy. Letting administrators decide spreads accountability, a central security approval bottleneck does not assign ownership, and a published list is a detection aid rather than an accountability control.

2. Question 2Identity and Access Management

   A company wants employees to sign in once and access several internal applications without entering their password again for each. Security requires that the central sign-in is strong and that the applications trust it. Which approach fits?

   1. AStore one shared password in a text file on the network drive that every application reads when it starts up
   2. BGive each application its own local password database, and ask employees to keep the passwords the same across all of them
   3. CSingle sign-on through a central identity provider using SAML or OpenID Connect, with MFA
   4. DDisable authentication on the internal applications, since they are only reachable from the corporate network
   Show answer and explanationHide answer

   Correct answer: C

   A central identity provider with a standard protocol gives single sign-on, and multi-factor authentication strengthens the central sign-in. Separate password databases with matching passwords and a shared password file weaken the controls, and removing authentication because the network is internal ignores insider and lateral threats.

3. Question 3Security Architecture and Engineering

   A system architect is choosing a cryptographic approach for protecting data at rest in a cloud database. The data must remain confidential even if the storage media is stolen. Which design is most appropriate?

   1. AStore the encryption key in the same database table as the data, so that the key is always available to the application
   2. BUse a homemade cipher that the team designed internally, since keeping it secret provides the strongest protection
   3. CHash the stored data with a fast unsalted algorithm so that the original values cannot be read back by anyone
   4. DEncrypt the data with a strong, standard algorithm, using keys stored and managed separately from the encrypted data
   Show answer and explanationHide answer

   Correct answer: D

   Strong standard encryption with keys managed separately from the data keeps the data confidential if the media is stolen. A key in the same table defeats the encryption, a homemade cipher is unvetted, and unsalted fast hashing is not reversible encryption and does not support reading the data back.

4. Question 4Communication and Network Security

   A company wants to protect traffic between its branch offices and its data centre over the public internet. The protection must include confidentiality and integrity of the packets, with authentication of the endpoints. Which technology fits best?

   1. AAn IPsec VPN between the branch and the data centre gateways, with strong authentication and encryption
   2. BSending the traffic over HTTP with a shared password in the URL so that each request is authenticated
   3. CAn open Wi-Fi network at each branch, with the data centre accessed by a public IP address and no further controls
   4. DA plain GRE tunnel between the offices, which carries packets without encryption or authentication of either end
   Show answer and explanationHide answer

   Correct answer: A

   An IPsec VPN provides encryption, integrity and endpoint authentication for traffic crossing the internet. A plain GRE tunnel has no encryption or endpoint authentication, shared passwords in URLs leak in logs and history, and open Wi-Fi with a public address exposes the data centre.

5. Question 5Security Operations

   A company's security team wants to hunt for threats that the automated detection rules have not caught. Which approach best supports this?

   1. ATurning off the detection rules so that analysts have more time to look at the raw logs, without any defined hypothesis
   2. BWaiting for the automated rules to produce an alert before any investigation starts, since the rules are assumed to be complete
   3. CProactively searching logs for indicators of compromise, guided by a hypothesis
   4. DAsking users to report anything that looks strange on their computers, and treating those reports as the only threat source
   Show answer and explanationHide answer

   Correct answer: C

   Threat hunting is proactive and hypothesis-driven, searching for indicators and unusual patterns the rules miss. Waiting for alerts relies on rules that are known to be incomplete, turning off detection removes coverage, and user reports alone miss attacks users cannot see.