(ISC)² CISSP Practice Exam

What the (ISC)² CISSP exam covers

• Security and Risk Management167 questions
• Asset Security91 questions
• Security Architecture and Engineering137 questions
• Communication and Network Security135 questions
• Identity and Access Management134 questions
• Security Assessment and Testing115 questions
• Security Operations154 questions
• Software Development Security129 questions

Free (ISC)² CISSP sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,062.

1. Question 1Security and Risk Management

   What does the CIA triad represent?

   • AConfidentiality, Identity, Authorization
   • BControl, Identity, Access
   • CConfidentiality, Integrity, AvailabilityCorrect
   • DCompliance, Integrity, Auditing
   ✓ Correct answer: C

   The CIA Triad defines three core security objectives: Confidentiality (ensuring data is not disclosed to unauthorized parties), Integrity (ensuring data is not altered without authorization), and Availability (ensuring data is accessible when needed). Different security controls address different CIA elements; encryption protects confidentiality while backups protect availability. Organizations must balance the three elements based on business requirements and data sensitivity. The appropriate level of each CIA element depends on the data classification.

   Why the other options are wrong

   • AConfidentiality, Identity, Authorization is incorrect because this option is incomplete and does not address the full requirement B.
   • BControl, Identity, Access is incorrect because this option is incomplete and does not address the full requirement D.
   • DCompliance, Integrity, Auditing is incorrect because this option is incomplete and does not address the full requirement
2. Question 2Communication and Network Security

   Which tcpdump command captures only DNS traffic (UDP port 53) on interface eth0 without resolving names?

   • Atcpdump -i eth0 tcp port 53 -resolve
   • Btcpdump -A eth0 icmp port 53
   • Ctcpdump -i eth0 -n udp port 53Correct
   • Dtcpdump -i eth0 -n arp port 53
   ✓ Correct answer: C

   This answer directly addresses the key concept tested in this security certification question. Understanding this topic is essential for compliance and effective risk management. Organizations must implement this practice as part of their overall security and governance program. Regular assessment and improvement of this area ensures alignment with industry standards and regulatory requirements. This represents a critical control point in the security architecture.

   Why the other options are wrong

   • Atcpdump -i eth0 tcp port 53 -resolve is incorrect because this option includes unnecessary or incorrect components not part of the required solution B.
   • Btcpdump -A eth0 icmp port 53 is incorrect because this option is incomplete and does not address the full requirement D.
   • Dtcpdump -i eth0 -n arp port 53 is incorrect because this option is incomplete and does not address the full requirement
3. Question 3Security and Risk ManagementSelect all that apply

   Before integrating a third-party SaaS application with your identity provider, which TWO governance activities best manage supply-chain and vendor risk? (Choose TWO)

   • ADefine data-handling and breach-notification terms in the contractCorrect
   • BSkip due diligence to accelerate the integration
   • CShare a global admin credential with the vendor
   • DPerform a vendor security/risk assessment of the SaaS providerCorrect
   ✓ Correct answer: A, D

   Vendor risk management identifies, assesses, and mitigates risks from third-party vendors and suppliers. Vendor risk includes technology risks (system failures, data breaches), financial risks (vendor insolvency), compliance risks (regulatory violations), and reputational risks. Vendor due diligence assesses security controls, certifications, incident history, and financial stability. Ongoing vendor monitoring tracks security posture, compliance status, and incident reports. Vendor contracts must address security responsibilities and liability.

   Why the other options are wrong

   • BSkip due diligence to accelerate the integration is incorrect because skipping this step introduces risk and non-compliance C.
   • CShare a global admin credential with the vendor is incorrect because this option is incomplete and does not address the full requirement
4. Question 4Security and Risk Management

   Which statement BEST describes the role of senior management in an organization's information security program?

   • AThey demonstrate due care by setting strategic direction, allocating resources, and being ultimately accountable for securityCorrect
   • BThey configure and tune the firewalls and intrusion detection systems used to enforce policy day to day
   • CThey act as data owners who classify every individual asset and assign each handling label
   • DThey author the detailed step-by-step technical procedures that administrators follow
   ✓ Correct answer: A

   Senior leadership owns the security program at the governance level: they approve policy, allocate budget and staff, and remain ultimately accountable even when execution is delegated. This accountability is the essence of due care. Tactical and operational tasks belong to other roles such as administrators, data owners, and custodians.

   Why the other options are wrong

   • BTuning firewalls and IDS is an operational administrator task, not the strategic and accountability role senior management holds.
   • CClassifying each individual asset is delegated to data owners and custodians, not performed directly by senior management.
   • DWriting detailed technical procedures is the work of administrators and analysts, not the governance responsibility of senior leaders.
5. Question 5Communication and Network Security

   A company isolates each workload so that even servers within the same data center subnet can only communicate over explicitly permitted flows enforced per workload, often by host-based or hypervisor-level policy. This approach is best described as:

   • AMicro-segmentationCorrect
   • BDefault-allow perimeter filtering
   • CPort mirroring
   • DBroadcast storm control
   ✓ Correct answer: A

   Micro-segmentation applies granular, identity- or workload-aware policy at the host, hypervisor, or fabric level, so east-west traffic between workloads is permitted only when explicitly allowed. This contains lateral movement far more tightly than coarse VLAN or perimeter controls, since traffic between two servers on the same subnet is still inspected and constrained. It is a core enabler of zero trust in data centers and clouds.

   Why the other options are wrong

   • BDefault-allow perimeter filtering inspects only north-south traffic at the edge and leaves intra-subnet traffic unrestricted.
   • CPort mirroring copies traffic to a monitoring tool; it observes but does not segment or restrict flows.
   • DBroadcast storm control limits excessive broadcast/multicast frames and is unrelated to per-workload policy.
6. Question 6Security Assessment and Testing

   An auditor needs to verify that a sample of user accounts was correctly disabled within the required time after employee terminations. Which audit technique provides the most reliable evidence?

   • AInterviewing the IT manager about how the offboarding process is supposed to work
   • BReperforming a sample by comparing HR termination dates against account-disable timestamps in system logsCorrect
   • CReviewing the documented offboarding procedure to confirm the required timeframe
   • DObserving the help desk disable a test account during a walkthrough
   ✓ Correct answer: B

   Substantive testing such as reperformance and inspection of system-generated records produces stronger audit evidence than inquiry alone. By matching authoritative HR termination records to log-confirmed disable times, the auditor demonstrates whether the control actually achieved its objective within the required window.

   Why the other options are wrong

   • AAn interview captures what management believes happens, not objective evidence that accounts were actually disabled in time.
   • CReviewing the written procedure confirms the policy exists but not whether it was followed for the sampled terminations.
   • DA single observed walkthrough shows the process can work but is not reliable evidence about the historical sample of terminations.
7. Question 7Software Development SecuritySelect all that apply

   A security team is establishing software supply-chain integrity for build artifacts. Which TWO controls best provide assurance that a deployed artifact is the genuine, untampered output of the trusted build process? (Choose TWO)

   • ACryptographically sign build artifacts and verify signatures before deploymentCorrect
   • BGenerate and maintain a software bill of materials (SBOM) with provenance/attestation for each buildCorrect
   • CAllow developers to upload artifacts manually to production from their workstations
   • DDisable logging on the artifact repository to reduce noise
   ✓ Correct answer: A, B

   Cryptographic signing lets the deployment pipeline verify that an artifact originated from the trusted build and was not modified in transit or at rest. An SBOM combined with provenance/attestation (for example, SLSA-style build metadata) documents exactly what went into the artifact and how it was produced, enabling integrity and traceability checks. Together they establish verifiable, tamper-evident supply-chain integrity.

   Why the other options are wrong

   • CManual uploads from developer workstations bypass the controlled build pipeline, breaking provenance and integrity guarantees.
   • DDisabling repository logging removes audit evidence needed to detect and investigate tampering, weakening assurance.
8. Question 8Asset Security

   An organization handles protected health information (PHI) and is selecting controls. A vendor proposes storing PHI in plaintext on an internal share, arguing the network firewall is sufficient. From an asset-security and regulatory standpoint, what is the BEST evaluation of this proposal?

   • AReject it; PHI is highly sensitive regulated data that requires layered safeguards including encryption at rest and in transit plus least-privilege access controls, not perimeter defense aloneCorrect
   • BAccept it, since a properly configured perimeter network firewall is a sufficient standalone control for any regulated PHI that remains stored inside the organization's internal network
   • CAccept it as long as the plaintext PHI share can only be reached from managed workstations physically located inside the organization's building during business hours
   • DAccept it provided the plaintext PHI written to the internal share is automatically deleted within thirty days of its creation to limit the window of exposure over time
   ✓ Correct answer: A

   PHI is highly sensitive regulated data, and frameworks such as HIPAA expect appropriate administrative, physical, and technical safeguards. Relying on a single perimeter firewall ignores insider threat, compromised internal hosts, and lateral movement, and leaves PHI exposed at rest. Proper control selection applies defense in depth: encryption of PHI at rest and in transit, strict least-privilege access, logging, and monitoring. The plaintext-on-a-share proposal should be rejected.

   Why the other options are wrong

   • BA single perimeter firewall provides no defense in depth and does not meet PHI safeguard requirements.
   • CBuilding-only access still leaves PHI unencrypted and exposed to insiders and lateral movement.
   • DA 30-day deletion window does not protect the PHI while it sits in plaintext during that period.
9. Question 9Security Assessment and Testing

   A security tester runs an automated tool that throws large volumes of malformed, random, and boundary-pushing inputs at a file-parsing service to see if any cause crashes, hangs, or memory corruption. Which technique is being used?

   • AFuzzingCorrect
   • BManual code review
   • CSynthetic transaction monitoring
   • DStatic application security testing
   ✓ Correct answer: A

   Fuzzing is a dynamic technique that supplies large quantities of malformed, unexpected, or boundary inputs to a running program to uncover crashes, hangs, and memory-safety defects. Targeting the file parser with random and malformed inputs to trigger faults is a classic fuzzing exercise.

   Why the other options are wrong

   • BManual code review reads source by hand; it does not feed inputs to a running program.
   • CSynthetic transaction monitoring runs well-formed scripted workflows to confirm availability, not malformed inputs to break the app.
   • DSAST inspects code at rest and does not execute the parser with random inputs.
10. Question 10Security and Risk ManagementSelect all that apply

    An organization is forming a security steering committee to strengthen governance. Which TWO characteristics BEST reflect an effective steering committee? (Choose TWO.)

    • AIt includes cross-functional business and IT leadershipCorrect
    • BIt aligns security priorities with business objectivesCorrect
    • CIt performs hands-on firewall rule changes each week
    • DIt is staffed solely by junior security analysts
    • EIt replaces the need for a formal risk register
    ✓ Correct answer: A, B

    Effective security governance uses a steering committee drawn from business and IT leadership so decisions reflect enterprise priorities, and its core purpose is aligning the security program with business objectives. This strategic, cross-functional composition is what distinguishes governance oversight from operational work.

    Why the other options are wrong

    • CMaking weekly firewall changes is operational execution, not the strategic governance role of a steering committee.
    • DA committee of only junior analysts lacks the leadership authority needed to set enterprise direction.
    • EA risk register is a distinct artifact for tracking risks and is not replaced by a committee.

Related Security resources

• (ISC)² CISSP study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated
• CompTIA PenTest+ (PT0-003) practice examRelated

(ISC)² CISSP practice exam FAQ