(ISC)² CISSP Practice Exam

What the (ISC)² CISSP exam covers

• Security and Risk Management172 questions
• Asset Security109 questions
• Security Architecture and Engineering141 questions
• Communication and Network Security138 questions
• Identity and Access Management138 questions
• Security Assessment and Testing130 questions
• Security Operations157 questions
• Software Development Security132 questions

Free (ISC)² CISSP practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,117.

1. Question 1Security and Risk Management

   What does the CIA triad represent?

   • AConfidentiality, Identity, Authorization
   • BControl, Identity, Access
   • CConfidentiality, Integrity, AvailabilityCorrect
   • DCompliance, Integrity, Auditing
   ✓ Correct answer: C

   The CIA Triad defines three core security objectives: Confidentiality (ensuring data is not disclosed to unauthorized parties), Integrity (ensuring data is not altered without authorization), and Availability (ensuring data is accessible when needed). Different security controls address different CIA elements; encryption protects confidentiality while backups protect availability. Organizations must balance the three elements based on business requirements and data sensitivity. The appropriate level of each CIA element depends on the data classification.

   Why the other options are wrong

   • AConfidentiality, Identity, Authorization is incorrect because this option is incomplete and does not address the full requirement B.
   • BControl, Identity, Access is incorrect because this option is incomplete and does not address the full requirement D.
   • DCompliance, Integrity, Auditing is incorrect because this option is incomplete and does not address the full requirement
2. Question 2Identity and Access Management

   Which PowerShell command disables an Active Directory user account named jsmith?

   • AStop-ADAccount -Name jsmith
   • BDisable-Computer -Identity jsmith
   • CSet-ADUser -Remove jsmith
   • DDisable-ADAccount -Identity jsmithCorrect
   ✓ Correct answer: D

   An Interconnection Security Agreement (ISA) governs secure data exchange between organizations' systems and networks. ISA specifies data classification, encryption requirements, access controls, authentication, and monitoring. ISA is required when connecting systems to external networks or cloud providers. ISA should define data retention, deletion, and audit rights. ISA violations may result in system disconnection and remediation requirements.

   Why the other options are wrong

   • Astop-ADAccount -Name jsmith is incorrect because this option is incomplete and does not address the full requirement B.
   • Bdisable-Computer -Identity jsmith is incorrect because this option is incomplete and does not address the full requirement C.
   • Cset-ADUser -Remove jsmith is incorrect because this option is incomplete and does not address the full requirement
3. Question 3Identity and Access ManagementSelect all that apply

   When integrating a new HR system as an authoritative source for accounts, which TWO automation practices strengthen the joiner-mover-leaver process? (Choose TWO)

   • AImmediate automated disablement of accounts upon termination eventsCorrect
   • BManual quarterly cleanup as the only deprovisioning method
   • CAutomated provisioning/deprovisioning via SCIM from the authoritative sourceCorrect
   • DLeaving terminated users' accounts active indefinitely
   ✓ Correct answer: A, C

   An Interconnection Security Agreement (ISA) governs secure data exchange between organizations' systems and networks. ISA specifies data classification, encryption requirements, access controls, authentication, and monitoring. ISA is required when connecting systems to external networks or cloud providers. ISA should define data retention, deletion, and audit rights. ISA violations may result in system disconnection and remediation requirements.

   Why the other options are wrong

   • BManual quarterly cleanup as the only deprovisioning method is incorrect because this option is incomplete and does not address the full requirement D.
   • DLeaving terminated users' accounts active indefinitely is incorrect because this option is incomplete and does not address the full requirement
4. Question 4Security and Risk ManagementSelect all that apply

   Which TWO administrative controls are specifically designed to detect or deter fraud by ensuring no single individual has unchecked control over a critical process? (Choose TWO)

   • ASeparation of dutiesCorrect
   • BMandatory vacationCorrect
   • CSingle sign-on (SSO)
   • DDefense in depth
   ✓ Correct answer: A, B

   Separation of duties splits a sensitive task so that completing it requires collusion between two or more people, reducing the chance any one person can commit and conceal fraud. Mandatory vacation forces an employee away from their duties so a substitute performs the work, often surfacing fraudulent activity that depends on the perpetrator's continuous presence. Both are classic anti-fraud personnel controls.

   Why the other options are wrong

   • CSSO is a technical authentication convenience that lets users access multiple systems with one login; it does not address fraud through duty separation.
   • DDefense in depth is a layered technical and physical control strategy against external attack, not a personnel anti-fraud measure.
5. Question 5Identity and Access Management

   In a Kerberos authentication exchange, which component issues the Ticket Granting Ticket (TGT) that a client presents later to obtain service tickets?

   • AThe Authentication Server (AS) within the Key Distribution CenterCorrect
   • BThe Ticket Granting Service (TGS) within the Key Distribution Center
   • CThe target application server hosting the requested resource
   • DThe client's local Security Account Manager (SAM) database
   ✓ Correct answer: A

   In Kerberos, the KDC contains two logical services: the Authentication Server (AS) and the Ticket Granting Service (TGS). The AS authenticates the user at logon and returns a TGT encrypted with the TGS's key. The client later presents that TGT to the TGS to obtain individual service tickets, so the TGT itself originates from the AS.

   Why the other options are wrong

   • BThe TGS issues service tickets for specific resources; it consumes the TGT but does not create it.
   • CThe application server validates a service ticket; it never issues TGTs and shares no long-term key with the client.
   • DThe SAM is a local Windows account store unrelated to Kerberos ticket issuance, which is handled by the domain KDC.
6. Question 6Security Operations

   An organization runs untrusted email attachments inside an isolated, instrumented environment to observe their behavior before allowing them to reach users. What is this technique called?

   • ASandboxing (detonation)Correct
   • BDynamic fuzz testing
   • CData tokenization service
   • DFile-based steganography
   ✓ Correct answer: A

   A sandbox (often called a detonation chamber) runs potentially malicious code in a contained, monitored space so its actions cannot affect production systems. Analysts and automated tools watch for malicious behavior such as file modification, persistence, or network callbacks. This detects malware that evades signature scanning by judging behavior rather than known patterns.

   Why the other options are wrong

   • BFuzzing sends malformed input to an application to find vulnerabilities, not to safely observe malware.
   • CTokenization substitutes sensitive data with non-sensitive tokens; it is a data-protection technique.
   • DSteganography hides data within other files and is unrelated to analyzing attachments.
7. Question 7Software Development Security

   A development team adopts a maturity model to systematically measure and improve the security of its software development practices across the organization. Which model is specifically designed for this purpose?

   • ABSIMM (Building Security In Maturity Model)Correct
   • BCMMI (Capability Maturity Model Integration) for Acquisition
   • CITIL Service Strategy
   • DCOBIT 2019 Governance Framework
   ✓ Correct answer: A

   BSIMM is a descriptive maturity model derived from observing real-world software security initiatives; organizations use it to benchmark their secure SDLC activities and identify gaps. It complements OWASP SAMM as a way to gauge how mature an application security program is. Because it directly targets software security activities, it is the right fit for measuring and improving secure development.

   Why the other options are wrong

   • BCMMI for Acquisition focuses on process maturity for acquiring products and services, not specifically on software security activities.
   • CITIL Service Strategy addresses IT service management lifecycle, not secure software development maturity.
   • DCOBIT 2019 is an enterprise IT governance framework and is not purpose-built to measure secure-coding maturity.
8. Question 8Communication and Network Security

   A company must connect a branch office to headquarters over the internet. Security policy requires that the original IP headers be hidden from any observer on the path, that all payloads be encrypted, and that the tunnel terminate on the two gateways rather than on the end hosts. Which IPsec design meets every requirement?

   • AESP in tunnel mode between the two security gatewaysCorrect
   • BAH in tunnel mode between the two security gateways
   • CESP in transport mode between the end hosts
   • DAH in transport mode between the two security gateways
   ✓ Correct answer: A

   Tunnel mode wraps the entire original packet, including its IP header, inside a new packet between gateways, so the inner header is concealed. ESP provides confidentiality by encrypting the payload (and the encapsulated header). This is the classic site-to-site VPN design.

   Why the other options are wrong

   • BAH provides integrity and authentication but no encryption, so payloads and headers would be visible in cleartext.
   • CTransport mode preserves and exposes the original IP header and terminates on the hosts, not the gateways.
   • DAH offers no confidentiality and transport mode does not hide the original header or terminate on the gateways.
9. Question 9Security Operations

   A critical vulnerability is announced for software widely used in production. The security manager must decide how to deploy the vendor patch quickly while avoiding production outages. Which practice best balances these concerns?

   • ATest the patch in a representative non-production environment, then deploy through the change management processCorrect
   • BDeploy the patch straight to every production system at once with no prior testing to close the exposure fastest
   • CDefer the patch to the next scheduled quarterly maintenance window regardless of the announced severity level
   • DRely only on perimeter firewall rules to block the exploit path and leave the vulnerable software fully unpatched
   ✓ Correct answer: A

   Patch management for critical fixes should be expedited but still validated against a representative environment to catch regressions, then rolled out under change control with rollback plans. This minimizes both exposure time and the risk of self-inflicted outages.

   Why the other options are wrong

   • BUntested mass deployment risks widespread outages from a faulty or incompatible patch.
   • CWaiting for a routine window ignores the severity and prolongs exposure unacceptably.
   • DA firewall rule is a temporary compensating control, not a substitute for remediating the underlying vulnerability.
10. Question 10Communication and Network Security

    Two IPsec gateways must mutually authenticate and negotiate the symmetric keys and security associations before any protected traffic flows. Which protocol performs this negotiation?

    • AInternet Key Exchange (IKE)Correct
    • BEncapsulating Security Payload (ESP)
    • CAuthentication Header (AH)
    • DGeneric Routing Encapsulation (GRE)
    ✓ Correct answer: A

    IKE (typically IKEv2) authenticates the peers and negotiates the security associations and keying material that ESP or AH then use to protect traffic. ESP and AH carry the protected data but rely on IKE to establish the keys, which is why an IKE phase-1 failure prevents any tunnel from forming.

    Why the other options are wrong

    • BESP protects data once keys exist but does not negotiate them.
    • CAH authenticates packets but performs no key exchange or SA negotiation.
    • DGRE is an unencrypted tunneling protocol and provides no key negotiation or IPsec services.

Who this (ISC)² CISSP practice exam is for

This practice set is for anyone preparing for the (ISC)² CISSP exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this (ISC)² CISSP practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real (ISC)² CISSP exam.

Related Security resources

• (ISC)² CISSP study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Security and Risk Management practice questions172 questions
• Asset Security practice questions109 questions
• Security Architecture and Engineering practice questions141 questions
• Communication and Network Security practice questions138 questions
• Identity and Access Management practice questions138 questions
• Security Assessment and Testing practice questions130 questions
• Security Operations practice questions157 questions
• Software Development Security practice questions132 questions
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• (ISC)² CSSLP practice examRelated
• (ISC)² SSCP (Systems Security Certified Practitioner) practice examRelated
• Splunk Core Certified Power User (SPLK-1002) practice examRelated

(ISC)² CISSP practice exam FAQ