CISSP - Certified Information Systems Security Professional
CISSP - Certified Information Systems Security Professional practice questions
17 free questions with explanations across 7 exam domains. Pick an answer to see if you got it right.
These are original practice questions based on the official exam outline, not real exam questions.
An organization wants to ensure that a departed employee's access to all systems is revoked within one hour of termination. Which control category does this MOST directly address?
Answer: B. Timely deprovisioning of access is a core Identity and Access Management (IAM) control — one of the eight CBK domains — specifically addressing account lifecycle management.
Which of the following BEST describes the principle of 'least privilege'?
Answer: B. Least privilege is a foundational Security and Risk Management concept — the heaviest-weighted CISSP domain — and is tested repeatedly across multiple domains, not just access management.
A company is evaluating a new cloud vendor. Which document would provide the MOST relevant information about the vendor's security controls for a third-party audit?
Answer: B. An SOC 2 Type II report specifically documents the operating effectiveness of a vendor's security controls over a period of time — directly relevant to Security Assessment and Testing and third-party risk evaluation.
An organization implements a policy requiring two different authentication factors before granting access to sensitive systems. This is an example of:
Answer: B. Requiring two distinct factor types (something you know, have, or are) is the textbook definition of multi-factor authentication, a core IAM domain concept.
Which of the following BEST describes the purpose of a Business Impact Analysis (BIA)?
Answer: B. A BIA specifically quantifies the impact of disruptions on business functions, forming the foundation for business continuity and disaster recovery planning within Security and Risk Management.
A company wants to ensure that data remains confidential even if a storage device is physically stolen. Which control is MOST directly relevant?
Answer: B. Full-disk encryption specifically protects data confidentiality when physical media is lost or stolen, since the data remains unreadable without the decryption key — a core Asset Security concept.
Which testing method involves attempting to exploit vulnerabilities in a system with explicit authorization, simulating a real attacker?
Answer: B. Penetration testing is specifically defined as authorized, adversarial simulation to validate real-world exploitability — distinct from passive code review or compliance-focused audits.
An organization's incident response plan should PRIMARILY define:
Answer: B. Incident response plans exist specifically to structure the technical and organizational response to security events — this is core to the Security Operations domain.
Which principle states that a system should remain secure even if its design and implementation details are publicly known, as long as the key remains secret?
Answer: B. Kerckhoffs's principle is the foundational cryptographic concept that a system's security should rest on key secrecy, not algorithm secrecy — the opposite of security through obscurity.
A developer embeds input validation directly into an application to prevent SQL injection attacks. This is an example of addressing security during which phase?
Answer: B. Input validation is a defensive coding practice built into the SDLC domain, specifically addressing injection vulnerabilities before code reaches production.
About these practice questions
Are these real CISSP - Certified Information Systems Security Professional exam questions?
No. They are original practice questions written to test the topics in the official exam outline. Real exam questions are confidential, and sites claiming to have them break the vendor's rules.
How should I use these CISSP - Certified Information Systems Security Professional practice questions?
Answer each one before reading the explanation, note the topics you get wrong, and go back to those parts of your study plan.