20 free ISC2 CISSP practice questions

Correct answer: D · The ALE is $20,000, so the control costs more than it saves

Quantitative risk analysis takes three steps. Single loss expectancy is asset value times exposure factor: $400,000 × 0.25 = $100,000. The annualized rate of occurrence for a flood once every 5 years is 1 ÷ 5 = 0.2. Annualized loss expectancy is SLE × ARO: $100,000 × 0.2 = $20,000. A control that removes the risk is worth at most the $20,000 of expected loss it prevents each year, so spending $35,000 a year costs $15,000 more than it saves; on cost alone, management would look for a cheaper control or accept or transfer the risk. $100,000 is the SLE, not the ALE. $80,000 multiplies the asset value by the ARO and skips the exposure factor. The $15,000 saving gets the comparison backward: the control costs $15,000 more than the loss it removes.

Look for this next time: SLE is asset value times exposure factor, ALE is SLE times ARO, and a control should cost less than the ALE it removes.

Correct answer: B · RTO of 48 hours and RPO of 4 hours

NIST SP 800-34 Rev. 1 defines maximum tolerable downtime (MTD) as how long a mission or business process can be disrupted without significant harm, the recovery time objective (RTO) as how long a system can stay in recovery before it harms the mission, and the recovery point objective (RPO) as the point in time to which data must be recovered. Here the MTD is 72 hours, so the system's RTO must fit within it, and the 4-hour data-loss limit sets an RPO of 4 hours, which means backups or replication at least every 4 hours. An RTO of 48 hours with an RPO of 4 hours satisfies both. An RTO of 96 hours exceeds the 72-hour MTD. An RPO of 24 hours could lose six times the tolerated data. The last pair swaps the two numbers.

Look for this next time: Keep the RTO within the MTD, and set the RPO from how much data loss the business can tolerate.

Correct answer: A · A guideline

In a security policy framework, a policy is management's high-level, mandatory statement of intent; standards set mandatory, specific requirements, such as minimum password rules; procedures give mandatory step-by-step instructions for a task; and guidelines offer recommendations that people may adapt. A document that recommends rather than requires, and lets teams choose other approaches that still meet the standard, is a guideline. It cannot be a policy, because a policy states what must be true, not optional advice. It is not a standard, because standards are compulsory, and the scenario says the password standard exists separately. It is not a procedure, because it gives no required sequence of steps. Both CISSP outlines list all four document types under developing and implementing security policy.

Look for this next time: Policies, standards, and procedures are mandatory; guidelines are recommendations that allow discretion.

Correct answer: C · The billing department head, as the data owner

The data owner is the senior business person accountable for a data set. The owner decides its classification, approves who may access it and why, and answers for its protection; here that is the head of the billing department. Data custodians, such as the database administrators, carry out the owner's decisions by running backups, applying permissions, and maintaining the controls, and applying permissions is not the same as deciding them. The help desk may take requests, but routing a request gives it no authority over the data. Employees who enter records are users: they must follow the rules for handling the data, but they do not set its classification. Both CISSP outlines list data roles, including owners and custodians, under managing the data lifecycle.

Look for this next time: Data owners classify data and approve access; custodians, such as administrators, carry out those decisions.

Correct answer: D · A purge technique, such as the drive's sanitize command or cryptographic erase

NIST SP 800-88 Rev. 2 (September 2025) defines three sanitization methods. Clear protects against simple recovery through the normal interface; purge makes recovery infeasible even with state-of-the-art laboratory techniques while leaving the media potentially reusable; destroy also defeats laboratory recovery but leaves the media unusable. The drives must stay usable and resist laboratory recovery, so purge fits, using techniques such as the device's dedicated sanitize commands or cryptographic erase, with the result verified. NIST says multi-pass overwrite patterns give very little protection on SSDs with overprovisioning, and wear leveling keeps some old data out of reach of normal writes. NIST also says degaussing should not be used on flash media such as SSDs. Deleting partitions and formatting removes pointers, not the data.

Look for this next time: Media that must stay usable after sanitization needs purge, such as cryptographic erase; overwriting and degaussing are poor choices for SSDs.

Correct answer: A · Bell-LaPadula's star property: no write down

The Bell-LaPadula model protects confidentiality. Its simple security property stops a subject from reading objects above its clearance (no read up), and its star (*) property stops a subject from writing to objects below its level (no write down), so Secret information cannot leak into an Unclassified file. Blocking the Secret-cleared user from writing to an Unclassified file is the star property at work. The simple security property explains why she could not read a Top Secret file, not this write block. Biba is an integrity model; its simple integrity property (no read down) keeps a subject from reading less trustworthy data, which has nothing to do with this confidentiality leak. Clark-Wilson protects integrity through well-formed transactions and separation of duties, not through classification labels.

Look for this next time: Bell-LaPadula guards confidentiality with no read up and no write down; Biba guards integrity with no read down and no write up.

Correct answer: B · Alice signs a hash with her private key; Bob verifies with her public key

In a digital signature scheme such as those in FIPS 186-5 (2023), the signer hashes the message and signs it with the signer's own private key, and anyone can verify the signature with the signer's public key. A valid signature shows that the message is unchanged since signing (integrity) and that the holder of Alice's private key signed it (origin authentication), which supports non-repudiation because only Alice should hold that key. Using Bob's public key is how Alice would encrypt a message so only Bob can read it, not how she signs. A shared secret key gives integrity and authentication between the two of them, as a message authentication code does, but either party could have produced it, so it cannot support non-repudiation. Verifying with Alice's private key would require Bob to hold her secret, which defeats the scheme.

Look for this next time: Sign with your own private key; others verify with your public key. Shared secret keys cannot provide non-repudiation.

Correct answer: C · Symmetric: 1,225 keys; asymmetric: 100 keys

With symmetric keys, every pair of people needs its own shared secret. The number of pairs among n people is n(n − 1) ÷ 2, so for 50 people that is 50 × 49 ÷ 2 = 2,450 ÷ 2 = 1,225 keys. With asymmetric cryptography, each person needs one key pair, a public key and a private key, so the total is 2n = 2 × 50 = 100 keys, and the public halves can be shared openly. The 2,450 figure is 50 × 49 without dividing by 2, so it counts every pair twice. Fifty asymmetric keys counts one key per person instead of a pair. The first option swaps the two totals. This growth is one reason large systems use asymmetric cryptography to exchange or protect symmetric session keys.

Look for this next time: Symmetric keys for n users grow as n(n − 1)/2; asymmetric keys grow as 2n.

Correct answer: A · ESP in tunnel mode between the two gateways

RFC 4301, the IPsec architecture, says transport mode protects mainly the next-layer protocols and leaves the original IP header exposed, while tunnel mode protects a whole tunneled IP packet behind a new outer header. It also says that, apart from narrow exceptions, an association with a security gateway at either end must use tunnel mode. Encapsulating Security Payload (ESP) provides confidentiality, and in tunnel mode it encrypts the entire inner packet, including the internal addresses, so observers see only the gateways' outer addresses. Authentication Header (AH) provides integrity and authentication but no encryption, so neither AH option meets the confidentiality requirement. ESP in transport mode on each host would encrypt payloads, but the original IP headers, with their addresses, would remain visible.

Look for this next time: Gateway-to-gateway IPsec uses tunnel mode; ESP adds encryption, while AH authenticates but does not encrypt.

Correct answer: D · Authenticator

IEEE 802.1X defines three roles. The supplicant is the device requesting access, here the laptop. The authenticator is the network device that controls the port, here the switch: it keeps the port closed to normal traffic, relays EAP messages between the supplicant and the authentication server, and opens the port only after a successful result. The authentication server, usually a RADIUS server, checks the credentials and makes the decision. So the switch is neither the supplicant, which is the laptop, nor the authentication server, which is the RADIUS server. Identity provider is a federation term, from SAML or OpenID Connect, for the party that issues identity assertions to applications; it is not an 802.1X role.

Look for this next time: In 802.1X, the supplicant requests access, the authenticator (switch or access point) controls the port, and the authentication server decides.

Correct answer: B · Micro-segmentation with policy enforced at each workload

Micro-segmentation places policy enforcement close to each workload, for example with host-based or distributed firewalls, so that traffic between servers in the same subnet is allowed only where a rule permits it. NIST SP 800-207 (2020), Zero Trust Architecture, describes micro-segmentation as placing individual resources or groups of resources on their own segments protected by gateway security components. That directly limits east-west movement. A stronger perimeter firewall inspects north-south traffic entering and leaving the network, so it does not see server-to-server traffic inside the VLAN. More bandwidth speeds traffic up but filters nothing. Moving management interfaces to their own VLAN is good practice, but the attacker moved between the servers' production interfaces, which would still be unfiltered.

Look for this next time: Perimeter firewalls watch north-south traffic; micro-segmentation controls east-west traffic between workloads, even within one subnet.

Correct answer: C · The company's identity provider

In OASIS SAML 2.0 federation, the identity provider (IdP) authenticates the user and issues a signed assertion about the user's identity and attributes. The service provider (SP), here the SaaS expense application, trusts the IdP, validates the assertion's signature, and grants access according to it, so the user signs in once at the company and needs no separate password for the SaaS application. The SaaS application consumes assertions; it does not authenticate the employee in this setup. The browser only carries the SAML messages between the two parties, typically through redirects or form posts, and it cannot vouch for anyone. A certificate authority issues certificates, which can be used to sign assertions, but it does not authenticate users or issue SAML assertions.

Look for this next time: In SAML federation, the identity provider authenticates users and issues assertions; the service provider validates them and grants access.

Correct answer: A · Attribute-based access control (ABAC)

NIST SP 800-162 describes attribute-based access control as a method in which a subject's requests to perform operations on objects are granted or denied by evaluating attributes of the subject and object, environment conditions, and a set of policies. The user's department, the device's state, and the project dates are all attributes, so a policy that combines them per request is ABAC. In DAC, the data owner grants access at their own discretion, for example through access control lists, with no central policy over device state or dates. MAC uses centrally assigned classification labels and clearances, which do not capture patch level or project dates. RBAC grants permissions by job role, and the scenario states that roles alone cannot express these combinations.

Look for this next time: When access depends on combinations of user, resource, and environment attributes evaluated per request, use attribute-based access control.

Correct answer: D · Remove old-role access at each transfer, then confirm in periodic reviews

This is privilege creep: people collect access as they change roles because the provisioning lifecycle adds new rights at a transfer but never removes the old ones. Both CISSP outlines list provisioning and deprovisioning, including transfers, and account access reviews under the identity and access provisioning lifecycle. The fix is to make every transfer a deprovisioning event as well: remove old-role access as part of the move, grant only what the new role needs, and use periodic access reviews to catch anything missed. Longer passwords protect against guessing but do not remove excess rights. Disabling accounts until someone complains blocks legitimate work and still leaves the process broken. Reviewing every five years instead of every year would let creep build up even longer.

Look for this next time: Treat every transfer as both provisioning and deprovisioning, and use periodic access reviews to catch privilege creep.

Correct answer: B · Written authorization, such as a signed plan or rules of engagement

NIST SP 800-115 (2008), the federal technical guide to security testing, says external assessors must ensure that proper authority is granted and keep a signed copy of the assessment plan; by signing the plan, all parties acknowledge and approve the assessment. It adds that rules of engagement provide authorization for activities, such as attacking systems, that policy would otherwise prohibit, and that legal concerns should be addressed before the assessment begins. Without written authorization from someone who can grant it, a penetration test is hard to tell apart from an attack, and a phone call with one IT manager neither documents the scope nor proves that the manager can approve it. An internal scan can inform the test but is not a precondition. Telling all staff can spoil a test of detection. A report template can wait.

Look for this next time: Never start a penetration test without written authorization, such as a signed plan or rules of engagement, from someone who can approve it.

Correct answer: C · Synthetic transaction monitoring

Synthetic transactions are scripted actions that imitate what a user does, run on a schedule against a live system, so problems show up even when no real users are active. Logging in as test users and making a small transfer every five minutes from three locations is exactly that, and it checks both availability and function. Both CISSP outlines list synthetic transactions under security control testing. Real user monitoring observes actual customer sessions, so at 3 a.m. it would have almost nothing to observe. Static application security testing analyzes source code for weaknesses without running the application, so it cannot tell whether the live login page works. A tabletop exercise is a discussion-based review of a plan, not a test of a running system.

Look for this next time: Synthetic transactions test a live system with scripted user actions on a schedule; real user monitoring needs real traffic.

Correct answer: A · The contents of system memory and the running processes

RFC 3227 (2002), Guidelines for Evidence Collection and Archiving, says to proceed from the volatile to the less volatile and lists the order: registers and cache; routing table, ARP cache, process table, kernel statistics, and memory; temporary file systems; disk; remote logging and monitoring data; physical configuration and network topology; and archival media. Memory and running processes come before the disk because they disappear when the server shuts down, and malware that lives only in memory would leave little trace on disk. A disk image comes later, since disk contents survive a shutdown. Remote logs sit lower on the list and will still be there afterward. Backup tapes are archival media, the least volatile category, and they predate the suspected activity.

Look for this next time: Collect evidence from most to least volatile: memory and running processes before disk, and disk before remote logs and archives.

Correct answer: D · Parallel test

In a parallel test, the recovery site's systems are brought up and process real work alongside production while the primary site keeps operating, so results can be compared without risking an outage. That is this plan. Read-through and tabletop tests review and discuss the plan, and a walkthrough has teams step through their recovery tasks; none of these runs a day of real transactions at the hot site. A full interruption test actually shuts down or disconnects the primary site and moves operations to the recovery site. It gives the strongest evidence but carries the most risk, and the scenario says the primary keeps serving customers. Both CISSP outlines list these test types under testing disaster recovery plans.

Look for this next time: A parallel test runs real work at the recovery site while production continues; a full interruption test shuts the primary down.

Correct answer: C · Software composition analysis (SCA) in the build pipeline

Software composition analysis inventories the third-party and open-source components an application includes, including indirect dependencies, and compares them with vulnerability and license information, so running it in the build pipeline flags known-vulnerable libraries before release. The 2024 CISSP outline names software composition analysis under application security testing, and the 2027 outline lists it with open-source software. DAST tests a running application from the outside by sending requests, so it may find some symptoms but does not list which library versions are inside. A manual review of the team's own files skips the libraries, which are the concern here. Fuzz testing feeds malformed input to find crashes and unexpected behavior, not known vulnerabilities in specific component versions.

Look for this next time: Software composition analysis finds known-vulnerable or problematically licensed open-source components; DAST and fuzzing test how the running code behaves.

Correct answer: B · Use prepared statements with parameterized queries

The OWASP SQL Injection Prevention Cheat Sheet lists prepared statements with parameterized queries as the first primary defense: the query structure is defined first and user input is bound as parameters, so the database always distinguishes code from data, whatever the user types. OWASP labels escaping all user-supplied input as strongly discouraged, because it is fragile and cannot be guaranteed to stop every injection. Hiding error messages makes attacks harder to tune, but the query stays injectable. Moving the database to another subnet changes network exposure, not how the application builds queries, and the application still connects to it. Allow-list input validation remains a recommended second layer alongside parameterized queries.

Look for this next time: Defend against SQL injection with parameterized queries; treat escaping as a last resort and input validation as a second layer.