CISSP - Certified Information Systems Security Professional
CISSP - Certified Information Systems Security Professional practice questions
17 free questions with explanations across 7 exam domains. Pick an answer to see if you got it right.
These are original practice questions based on the official exam outline, not real exam questions.
Which access control model assigns permissions based on job function rather than individual identity?
Answer: B. RBAC specifically maps permissions to roles (job functions), simplifying access management compared to per-user assignment in DAC.
An organization wants to ensure that no single employee can both initiate and approve a financial transaction. This control is called:
Answer: B. Separation of duties specifically prevents any one individual from having end-to-end control over a sensitive process, reducing fraud and error risk.
Which of the following BEST describes the purpose of data classification?
Answer: B. Data classification exists to tier information by sensitivity so proportionate controls (encryption, access restriction) can be applied — a core Asset Security concept.
A company's disaster recovery plan specifies a Recovery Time Objective (RTO) of 4 hours. This means:
Answer: B. RTO specifically measures the maximum acceptable downtime before systems must be restored — distinct from RPO, which measures acceptable data loss.
Which cryptographic concept ensures that a sender cannot later deny having sent a message?
Answer: B. Non-repudiation, typically achieved via digital signatures, is specifically the property that prevents a sender from denying authorship of a message.
A company monitors network traffic in real time and automatically blocks traffic matching known attack signatures. This describes:
Answer: B. The key distinction is action: IDS detects and alerts, while IPS actively blocks matching traffic in real time — this is a core Security Operations concept.
Which of the following is the MOST appropriate control to prevent unauthorized changes to production code without proper review?
Answer: B. Code review combined with formal change management specifically addresses unauthorized or unreviewed changes reaching production — core to Software Development Security.
About these practice questions
Are these real CISSP - Certified Information Systems Security Professional exam questions?
No. They are original practice questions written to test the topics in the official exam outline. Real exam questions are confidential, and sites claiming to have them break the vendor's rules.
How should I use these CISSP - Certified Information Systems Security Professional practice questions?
Answer each one before reading the explanation, note the topics you get wrong, and go back to those parts of your study plan.