CertArea
All ISC2 exams

Free Certified Information Systems Security Professional (CISSP) practice test: 30 questions with answers

30 original questions for Certified Information Systems Security Professional (CISSP), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
100-150 (computerized adaptive) questions, 180 min
Passing score
700 out of 1000

Certified Information Systems Security Professional (CISSP) exam guide: topics, cost and format

All 30 Certified Information Systems Security Professional (CISSP) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security and Risk Management (4 questions)

  1. Question 1

    A company is writing a security policy after an incident in which a contractor kept access for months. The CISO wants the policy to define who is accountable for access decisions for each system. Which control best supports this?

    1. ARequiring the security team to approve every access request personally, so that no single owner is needed
    2. BAllowing each system administrator to grant access as needed, since the people closest to the system know best
    3. CAssigning a data owner for each information asset, who approves access and is accountable for classification
    4. DPublishing a quarterly list of all users to the intranet so that managers can spot anyone who should not be there
    Show answer and explanation
    Correct answer: C

    A data owner is accountable for classification and for approving access to an asset, which fixes accountability in the policy. Letting administrators decide spreads accountability, a central security approval bottleneck does not assign ownership, and a published list is a detection aid rather than an accountability control.

  2. Question 2

    An organization is selecting a risk response for a web application vulnerability that would cost more to fix than the expected loss from exploitation. Which response is most consistent with sound risk management?

    1. AIgnore the vulnerability entirely, since fixing it is more expensive than any loss the company might face
    2. BAccept the risk formally, document the rationale and the residual exposure, and have the risk owner approve it
    3. CTransfer the risk by buying a bigger bug bounty, which keeps the vulnerability in place and pays for its discovery
    4. DMitigate every risk to zero regardless of cost, because any remaining exposure is unacceptable to the company
    Show answer and explanation
    Correct answer: B

    Formal acceptance with documented rationale and owner approval is a legitimate response when mitigation costs exceed the expected loss. Ignoring the issue is undocumented, a bounty does not transfer the risk, and mitigating everything regardless of cost is not a risk-based decision.

  3. Question 3

    A security manager wants to measure whether the security program is improving over time, using measures that leadership can act on. Which set of metrics is most useful?

    1. AThe number of security awareness posters displayed in offices and the number of printed handouts distributed
    2. BTrends in open high-risk findings, time to remediate them, and patch coverage
    3. CThe count of firewall rules in the environment and the total number of log lines generated last month
    4. DThe number of security staff hired this year and the number of training hours each analyst completed
    Show answer and explanation
    Correct answer: B

    Trends in open high-risk findings, time to remediate and patch coverage show risk exposure and program effectiveness that leadership can act on. Poster counts, rule counts and log volume measure activity rather than outcomes, and staffing numbers do not show security performance.

  4. Question 4

    An employee has been found accessing customer records outside their job role. Human resources and legal want the investigation to hold up if the matter reaches court. Which step should the security team take first?

    1. AConfront the employee immediately and ask them to explain their access, then decide on disciplinary action
    2. BPreserve the relevant logs and system state with documented chain of custody before anyone changes the systems
    3. CDelete the employee's account and recent activity records so that the evidence cannot be used against the company
    4. DPost the access findings to the company chat so that other managers can confirm whether the access was authorized
    Show answer and explanation
    Correct answer: B

    Preserving logs and state with a documented chain of custody keeps evidence admissible and reliable. Confronting the employee first can prompt destruction of evidence, deleting records destroys evidence, and public posting breaches confidentiality and prejudges the case.

Identity and Access Management (4 questions)

  1. Question 5

    A company wants employees to sign in once and access several internal applications without entering their password again for each. Security requires that the central sign-in is strong and that the applications trust it. Which approach fits?

    1. AStore one shared password in a text file on the network drive that every application reads when it starts up
    2. BGive each application its own local password database, and ask employees to keep the passwords the same across all of them
    3. CSingle sign-on through a central identity provider using SAML or OpenID Connect, with MFA
    4. DDisable authentication on the internal applications, since they are only reachable from the corporate network
    Show answer and explanation
    Correct answer: C

    A central identity provider with a standard protocol gives single sign-on, and multi-factor authentication strengthens the central sign-in. Separate password databases with matching passwords and a shared password file weaken the controls, and removing authentication because the network is internal ignores insider and lateral threats.

  2. Question 6

    A company is designing a role-based access model. Developers need to deploy code in test but not in production, and auditors need read-only access to production logs. Which design best fits?

    1. AGrant permissions to each person individually in each environment, without roles, so that every user is customized
    2. BGive all staff the same administrator role so that no one is blocked, and rely on monthly reviews to catch misuse
    3. CDefine roles for developer, auditor and operator, with each role granted only the permissions its duties require in each environment
    4. DLet developers keep production administrator rights as a backup, since they know the code best if an outage occurs
    Show answer and explanation
    Correct answer: C

    Roles mapped to duties, with permissions scoped per environment, enforce least privilege in a maintainable way. A shared administrator role gives everyone excessive rights, per-person grants do not scale, and production admin for developers breaks separation of duties.

  3. Question 7

    A user has access to a sensitive application because of a group membership, but the access should end when the user changes department. The IAM team wants to find these cases automatically. Which control helps most?

    1. AAn annual password change for all users, which will remove the old access when users change their passwords
    2. BAccess reviews and automated provisioning and deprovisioning tied to the authoritative HR source of job changes
    3. CA rule that users must report their own department change within a day, with no check by any other system
    4. DLeaving all group memberships unchanged, since the user is trusted and the application logs will show any misuse
    Show answer and explanation
    Correct answer: B

    Automated provisioning and deprovisioning tied to the HR source, combined with access reviews, removes access on a job change. Annual password changes do not remove group access, self-reporting depends on the user, and trusting the user while relying on logs detects misuse only after it happens.

  4. Question 8

    An organization is deciding how to authenticate privileged administrators to production systems. Which approach gives the strongest assurance?

    1. AMulti-factor authentication with a hardware token or certificate, plus a separate privileged account used only for admin tasks
    2. BStandard user accounts for everything, with administrator rights granted by a script that runs every time the user logs in
    3. CA four-digit PIN for administrators, since it is easy to remember and the systems are behind a firewall anyway
    4. DA single shared administrator account with a long password that is written down in the operations room for emergencies
    Show answer and explanation
    Correct answer: A

    Hardware-backed multi-factor authentication with separate privileged accounts gives strong assurance and separates admin activity from everyday use. A shared account destroys accountability, automatic admin grants at login remove control, and a short PIN is weak.

Security Architecture and Engineering (4 questions)

  1. Question 9

    A system architect is choosing a cryptographic approach for protecting data at rest in a cloud database. The data must remain confidential even if the storage media is stolen. Which design is most appropriate?

    1. AStore the encryption key in the same database table as the data, so that the key is always available to the application
    2. BUse a homemade cipher that the team designed internally, since keeping it secret provides the strongest protection
    3. CHash the stored data with a fast unsalted algorithm so that the original values cannot be read back by anyone
    4. DEncrypt the data with a strong, standard algorithm, using keys stored and managed separately from the encrypted data
    Show answer and explanation
    Correct answer: D

    Strong standard encryption with keys managed separately from the data keeps the data confidential if the media is stolen. A key in the same table defeats the encryption, a homemade cipher is unvetted, and unsalted fast hashing is not reversible encryption and does not support reading the data back.

  2. Question 10

    A company's web application is being designed with defence in depth. Which design best reflects this principle?

    1. ASeveral independent layers, such as segmentation, host hardening and monitoring
    2. BA single strong perimeter firewall, with all internal systems trusted once traffic has passed through it
    3. CA complex password policy as the only security control, because it applies to every system in the organization
    4. DAn air-gapped server that has no network connections, which is the only defence the design needs
    Show answer and explanation
    Correct answer: A

    Defence in depth layers independent controls so that a failure in one does not expose the system. A single perimeter trusts everything inside it, a password policy is one control rather than layers, and an air-gapped server cannot serve the web application.

  3. Question 11

    A system must continue operating safely if a component fails. The designers want the system to fail in a way that protects confidentiality and integrity, even when availability is reduced. Which principle applies?

    1. AFail open, so that users can always reach the system even if a security check breaks
    2. BFail randomly, so that an attacker cannot predict which controls will be active at any given moment
    3. CFail silent, so that no error is shown to users and the failure does not appear in any log
    4. DFail secure, so that the system denies access or stops processing safely when a security function fails
    Show answer and explanation
    Correct answer: D

    Fail secure ensures a failed security function leads to denial or safe shutdown rather than unprotected access. Fail open exposes data when a check fails, silent failure hides the problem, and random failure does not protect anything.

  4. Question 12

    A security architect is reviewing a cloud environment where workloads from different tenants share hardware. Which concern is most directly related to this shared infrastructure?

    1. AThe font used on the cloud provider's portal, which may not match the company's corporate style guide
    2. BThe monthly billing cycle, which may show different amounts for each tenant depending on the workloads they run
    3. CSide-channel leakage between tenants that share physical resources, such as CPU caches, and the need for strong isolation
    4. DThe time zone of the provider's data centre, which may cause logs to show different timestamps than the company uses
    Show answer and explanation
    Correct answer: C

    Shared physical infrastructure raises the risk of side-channel leakage between tenants, which makes isolation a central architectural concern. Billing, portal fonts and time zones are operational matters rather than security isolation risks.

Communication and Network Security (4 questions)

  1. Question 13

    A company wants to protect traffic between its branch offices and its data centre over the public internet. The protection must include confidentiality and integrity of the packets, with authentication of the endpoints. Which technology fits best?

    1. AAn IPsec VPN between the branch and the data centre gateways, with strong authentication and encryption
    2. BSending the traffic over HTTP with a shared password in the URL so that each request is authenticated
    3. CAn open Wi-Fi network at each branch, with the data centre accessed by a public IP address and no further controls
    4. DA plain GRE tunnel between the offices, which carries packets without encryption or authentication of either end
    Show answer and explanation
    Correct answer: A

    An IPsec VPN provides encryption, integrity and endpoint authentication for traffic crossing the internet. A plain GRE tunnel has no encryption or endpoint authentication, shared passwords in URLs leak in logs and history, and open Wi-Fi with a public address exposes the data centre.

  2. Question 14

    An administrator must allow a secure remote management session to a Linux server while blocking password-based logins. Which configuration meets this need?

    1. AEnable Telnet with a complex password, since its traffic is only visible inside the trusted management network
    2. BEnable a web-based remote console that accepts a username and password typed into a plain HTTP page
    3. CAllow root logins over SSH with a strong password and rely on the firewall to block all other access to the server
    4. DEnable SSH with key-based authentication only and disable password authentication in the server configuration
    Show answer and explanation
    Correct answer: D

    SSH with key-based authentication and password authentication disabled removes password logins and encrypts the session. Telnet sends traffic in clear text, a plain HTTP login page exposes credentials, and root with a password keeps password logins and relies on the firewall alone.

  3. Question 15

    A firewall administrator is reviewing rules. Traffic from the internet to a web server should be allowed on port 443 only, and everything else should be denied. Which rule set is correct?

    1. AAllow inbound on all ports from the internet so that the web server is reachable by every service the team may need
    2. BAllow outbound on port 443 from the web server only, with no inbound rules and no default deny at all
    3. CAllow inbound on port 443 from the internet and also allow all traffic from the internal network without restriction
    4. DAllow inbound TCP 443 from any source to the web server, and deny all other inbound traffic to it by default
    Show answer and explanation
    Correct answer: D

    Allowing TCP 443 inbound and denying other inbound traffic by default matches the stated requirement. Allowing all ports exposes the server, outbound-only rules do not allow inbound web requests, and unrestricted internal access ignores the least-privilege intent.

  4. Question 16

    An organization wants to ensure that devices joining its wired network are authenticated before they receive network access. Which standard and mechanism are most appropriate?

    1. AIEEE 802.1X port-based network access control, with authentication against a central authentication server
    2. BHiding the network name and relying on the fact that most people will not know the network exists
    3. CA static list of MAC addresses typed into each switch port, updated by the network team once a year
    4. DAssigning every device an IP address by DHCP without any authentication, since the switch will block unknown users
    Show answer and explanation
    Correct answer: A

    IEEE 802.1X authenticates devices or users at the port against a central server before granting access. Static MAC lists are easy to spoof, hiding a network is not a control, and DHCP without authentication gives access to anyone who connects.

Security Operations (4 questions)

  1. Question 17

    A company's security team wants to hunt for threats that the automated detection rules have not caught. Which approach best supports this?

    1. ATurning off the detection rules so that analysts have more time to look at the raw logs, without any defined hypothesis
    2. BWaiting for the automated rules to produce an alert before any investigation starts, since the rules are assumed to be complete
    3. CProactively searching logs for indicators of compromise, guided by a hypothesis
    4. DAsking users to report anything that looks strange on their computers, and treating those reports as the only threat source
    Show answer and explanation
    Correct answer: C

    Threat hunting is proactive and hypothesis-driven, searching for indicators and unusual patterns the rules miss. Waiting for alerts relies on rules that are known to be incomplete, turning off detection removes coverage, and user reports alone miss attacks users cannot see.

  2. Question 18

    A company wants its incident response plan to be useful during a real event. Which element is most important to test and maintain?

    1. AThe contact list of the response team, verified regularly and tested through exercises that include the decision steps
    2. BThe cover page of the plan document, which should show the company logo and the date of the last print run
    3. CA list of past incidents from ten years ago, which should be kept in the plan for historical reference only
    4. DA printed copy of the plan kept in a locked office that only the chief executive is allowed to open
    Show answer and explanation
    Correct answer: A

    A verified contact list with exercises that test the decision steps makes the plan usable under pressure. A cover page, old incident history and a locked printed copy do not help responders act.

  3. Question 19

    A company is deciding how long to keep security logs. The legal team says some logs must be kept for three years, and the security team wants them available for quick searches for the last ninety days. Which approach fits both needs?

    1. AKeep only ninety days of logs in total, since the legal requirement can be met with a written summary instead
    2. BKeep every log in the fast searchable store for three years, regardless of cost, so that nothing is ever archived
    3. CKeep the last ninety days in a searchable store and archive the full three years in a cheaper, protected store
    4. DDelete all logs after ninety days and create a monthly report, which the legal team can use as its evidence
    Show answer and explanation
    Correct answer: C

    A tiered approach keeps recent logs searchable and archives the full retention period in cheaper protected storage. Keeping everything in the fast store is costly, a summary does not meet a log retention rule, and deleting logs after ninety days breaks the legal requirement.

  4. Question 20

    A company's operations team needs to ensure that changes to production systems do not cause unplanned outages. Which practice best supports this goal?

    1. AA change management process with risk assessment, testing, approval, a rollback plan and post-change review
    2. BAllowing every engineer to change production at any time, so that problems are fixed as quickly as they are found
    3. CScheduling changes only at midnight with no record kept, since few people are awake to be affected at that time
    4. DStopping all changes for a year so that production stays exactly as it is, regardless of security patches or business needs
    Show answer and explanation
    Correct answer: A

    A change process with risk assessment, testing, approval, rollback and review reduces unplanned outages while keeping systems current. Uncontrolled changes cause outages, unrecorded midnight changes cannot be traced, and freezing changes for a year blocks necessary security patches.

Asset Security (4 questions)

  1. Question 21

    A company is classifying data held in a new analytics platform. Some datasets contain personal information subject to privacy regulations. Which action should the data owner take first?

    1. ALet each analyst decide the sensitivity of the datasets they use, based on their personal judgment of risk
    2. BMove all datasets into one encrypted store and assume that encryption alone satisfies the privacy regulations
    3. CClassify each dataset by sensitivity and impact, then apply handling requirements that match the classification
    4. DDelete all personal information from the platform so that no classification or handling rules are needed at all
    Show answer and explanation
    Correct answer: C

    Classification by sensitivity and impact is the step that determines the handling requirements, including retention, access and privacy controls. Encryption alone does not address all regulatory requirements, individual judgments are inconsistent, and deleting all personal data may be impossible for the business.

  2. Question 22

    A retention schedule requires that email records be kept for seven years, and then securely destroyed. A legal hold later applies to one mailbox. Which approach best satisfies both requirements?

    1. ASuspend the disposal process for the held mailbox, keep it under the hold, and apply normal destruction once the hold is released
    2. BDestroy the mailbox at seven years regardless of the hold, since the schedule is the more specific of the two rules
    3. CKeep every mailbox forever, so that no disposal decision is ever needed and the legal hold never conflicts with it
    4. DExport the mailbox to a personal drive and delete the original, which removes it from both the schedule and the hold
    Show answer and explanation
    Correct answer: A

    A legal hold overrides routine disposal, so the held mailbox is preserved until the hold ends, then the normal schedule applies. Destroying it during the hold breaches the hold, keeping everything forever breaks the retention schedule, and copying to a personal drive loses control of the records.

  3. Question 23

    A database contains payment card data. The security team wants to reduce the exposure of card numbers in non-production environments used by developers. Which technique is most appropriate?

    1. AUse the production database directly in development, restricted to a read-only account for the developers
    2. BCopy the production data to development and delete only the table names so that the values are hard to identify
    3. CEncrypt the card numbers in the test copies and give every developer the decryption key for debugging purposes
    4. DReplace the card numbers with realistic but fictitious values, such as tokenized or masked data, in the test copies
    Show answer and explanation
    Correct answer: D

    Masking or tokenizing card data in test copies removes real card numbers from non-production environments while keeping realistic formats for testing. Read-only production access still exposes real data, renaming tables does not protect values, and giving all developers the key defeats the protection.

  4. Question 24

    Which TWO practices are appropriate when media holding sensitive data is leaving the organization? (Choose two.)

    1. ASanitize or destroy the media using a method suited to its classification
    2. BHand it to a courier without a record of its contents or its destination
    3. CTrack the media with a chain-of-custody record until it is disposed of or returned
    4. DKeep a copy of the data on the device after it has been wiped, as a backup for the courier
    5. ELeave the media in an unlocked car while the courier collects other items from the office
    Show answer and explanation
    Correct answer: A, C

    Sanitizing media to its classification and keeping a chain-of-custody record protect the data and show accountability. Unrecorded handovers, retained copies after wiping and unsecured transport all expose sensitive data.

Security Assessment and Testing (3 questions)

  1. Question 25

    A company wants to know whether its external web application can be broken into by a determined attacker, using realistic techniques with the attacker's goals in mind. Which assessment is most appropriate?

    1. AA penetration test performed by an authorized tester with a defined scope and rules of engagement
    2. BA review of the application's design document by a manager who has not seen the code or the running system
    3. CA vulnerability scan run automatically each night, with the results emailed to the development team as a list
    4. DA survey of developers asking whether they believe the application is secure against common attacks
    Show answer and explanation
    Correct answer: A

    A penetration test by an authorized tester with defined scope tests whether an attacker can achieve goals using realistic techniques. Automated scans find known issues but do not chain them into attacks, a design review does not test the running system, and a developer survey measures belief rather than security.

  2. Question 26

    A security team needs to verify that a set of firewall rules matches the approved standard. The verification must be repeatable and produce evidence that auditors can review. Which activity fits best?

    1. AA manual check where an engineer glances at the firewall console once a year and signs a note that says it looks fine
    2. BA documented configuration review that compares the live rules against the approved baseline and records the results
    3. CAsking the vendor's sales representative whether the firewall is configured correctly, based on their knowledge of the product
    4. DRemoving every rule and rebuilding the firewall from scratch each time someone wonders whether it is correct
    Show answer and explanation
    Correct answer: B

    A documented comparison of live rules against the approved baseline is repeatable and leaves evidence for auditors. A yearly glance is not repeatable or specific, asking a sales representative is not verification, and rebuilding from scratch is disruptive and produces no comparison.

  3. Question 27

    A security team is monitoring a control that is supposed to log every administrator login. The logs show fewer entries than the number of logins recorded by the authentication server. What should the team do first?

    1. AAssume the authentication server is wrong and ignore the difference, since the log is the authoritative record
    2. BDelete the logs that are present so that the record matches the authentication server's count exactly
    3. CInvestigate why logging is incomplete, checking whether events are dropped, filtered or not forwarded before drawing conclusions
    4. DTurn off the authentication server so that no further logins can cause the mismatch between the two sources
    Show answer and explanation
    Correct answer: C

    Investigating why logging is incomplete finds whether events are dropped, filtered or not forwarded, which determines whether the control works. Assuming one source is wrong without checking, deleting evidence, and shutting down authentication all skip the investigation.

Software Development Security (3 questions)

  1. Question 28

    A development team builds a web service that calls an internal API. The team wants to make sure that a bug in one component cannot give attackers access to the whole service. Which design principle applies?

    1. ALeast privilege for each component, with separate accounts and minimal permissions for each service it calls
    2. BA single administrator account shared by all components, so that every component can reach every resource it needs
    3. CRunning every component as the root user, so that no permission problems block the development team's testing
    4. DDisabling all authentication between components, since they are all inside the same network and trusted by default
    Show answer and explanation
    Correct answer: A

    Least privilege per component limits what a compromised component can reach. A shared administrator account, root for all components and disabled authentication each let one bug reach everything.

  2. Question 29

    A team must choose how to manage third-party libraries in its application. The security lead wants to reduce the risk of vulnerable components entering production. Which practice is most effective?

    1. ADownload the latest version of every library each time the application is built, without recording what changed between builds
    2. BTrack each library and its version in an inventory, scan for known vulnerabilities, and update or replace components on a schedule
    3. CUse any library that a developer finds on a public forum, since popular code is assumed to have been reviewed by others
    4. DCopy each library's source code into the project once and never update it, so that the team controls every line of code
    Show answer and explanation
    Correct answer: B

    Inventorying components, scanning them for known vulnerabilities and updating on a schedule addresses the risk directly. Unrecorded updates lose traceability, unvetted forum code carries unknown risk, and freezing copies locks in known flaws.

  3. Question 30

    A web application lets users upload profile images. The team wants to reduce the risk of malicious files being accepted. Which combination of controls is most effective?

    1. AAccept any file type the browser sends, since the browser already checks the file before it is uploaded to the server
    2. BCheck the file type, size and content on the server, and store uploads outside the web root
    3. CTrust the file extension in the name, so that a file called image.jpg is always treated as an image by the application
    4. DStore each upload in the web root with its original name, so that users can find their files by typing the address
    Show answer and explanation
    Correct answer: B

    Server-side validation of type, size and content, storage outside the web root and safe serving headers together limit what a malicious upload can do. Browser checks are bypassed by any client, file extensions are easy to fake, and storing uploads in the web root can make them executable.