Free CISSP practice test

12 original questions written by our editors against the official ISC2 exam domains. They are not real exam questions. Pick an answer to see the explanation.

0 / 0 correct

1. Security and Risk Management

   A file server holding customer records is valued at $200,000. A ransomware incident would damage about 25% of its value, and the risk team expects such an incident once every two years. A vendor offers a control that would prevent it for $40,000 per year. Based only on these figures, what should the security manager conclude?

   ABuy the control, because the single loss expectancy is higher than its costBBuy the control, because any control that prevents ransomware is justifiedCDo not buy the control on cost grounds, because its annual cost is higher than the annualized loss expectancyDDo not buy the control, because the exposure factor is below 50%
   Show answer

   Answer: C. SLE is $200,000 x 0.25 = $50,000 and ALE is $50,000 x 0.5 = $25,000 per year. A $40,000 yearly control costs more than the expected loss it prevents. Comparing the control to the SLE uses the wrong time basis, and the exposure factor alone does not decide the question.

2. Security and Risk Management

   An audit finds that a company never approved or funded encryption for its customer database, and the database is later breached. Who holds ultimate accountability for the failure to protect the data?

   AThe information security analyst who ran the last scanBSenior managementCThe cloud provider hosting the databaseDThe database administrator
   Show answer

   Answer: B. Senior management owns the decision to accept, fund or treat risk, so accountability rests with them. Administrators and analysts carry out responsibilities but cannot be held ultimately accountable for decisions they were never authorised to make. A hosting provider does not take over the data owner's accountability.

3. Asset Security

   A company is retiring laptops with solid-state drives that held confidential data. The drives will leave the company's control and must not be recoverable. Which approach gives the highest assurance?

   AOverwrite each drive three times with random dataBDelete the partitions and reformat the drivesCPhysically destroy the drives, for example by shreddingDDegauss each drive with a certified degausser
   Show answer

   Answer: C. Physical destruction gives the highest assurance that no data remains. Degaussing does not work on SSDs because they do not store data magnetically, and overwriting is unreliable on SSDs because wear levelling can leave old blocks untouched. Reformatting only removes file system pointers.

4. Security Architecture and Engineering

   A system enforces the Bell-LaPadula model. A user cleared for Secret tries to save a report into a folder labelled Confidential. What happens and why?

   AThe write is allowed, because the user's clearance dominates the folder labelBThe write is blocked by the simple security property, which prevents reading upCThe write is allowed, but only if the report is first labelled SecretDThe write is blocked by the star (*) property, which prevents writing down
   Show answer

   Answer: D. Bell-LaPadula protects confidentiality, and its star property forbids subjects from writing to a lower classification, so Secret data cannot leak into a Confidential folder. The simple security property governs reading, not writing. Higher clearance does not permit writing down.

5. Security Architecture and Engineering

   A partner must be able to confirm that a contract file really came from your company and was not changed in transit. Confidentiality is not required. What should your company do before sending the file?

   AEncrypt the file with a shared symmetric keyBHash the file and send the hash in the same emailCEncrypt the file with the partner's public keyDHash the file and sign the hash with your company's private key
   Show answer

   Answer: D. A digital signature (hash signed with the sender's private key) lets the partner verify origin and integrity using your public key. Encrypting with the partner's public key gives confidentiality but proves nothing about who sent it. A symmetric key or an unsigned hash sent alongside the file can be replaced by an attacker.

6. Communication and Network Security

   Two offices are connected over the internet by IPsec gateways. The company wants the payload protected and the internal IP addresses of hosts hidden from anyone watching the internet link. Which configuration fits best?

   AESP in tunnel modeBAH in tunnel modeCESP in transport modeDAH in transport mode
   Show answer

   Answer: A. Tunnel mode wraps the whole original packet, including the internal IP header, inside a new packet between the gateways, and ESP encrypts it. Transport mode leaves the original IP header visible. AH provides integrity and authentication but no encryption, so the payload would not be confidential.

7. Communication and Network Security

   Users at a branch office are being sent to a fake banking site even though they type the correct address. Investigation shows the local caching DNS resolver is returning forged records. Which control most directly prevents this attack?

   ABlocking UDP port 53 at the perimeter firewallBEnforcing HTTPS on the internal web serversCMoving the DNS server into the DMZDDeploying DNSSEC validation on the resolver
   Show answer

   Answer: D. DNSSEC lets the resolver verify signatures on DNS records, so forged responses fail validation and are not cached. Moving the server changes its location, not its trust in answers. Internal HTTPS does not protect the external banking lookup, and blocking port 53 would break DNS.

8. Identity and Access Management (IAM)

   An employee has moved from finance to marketing to HR over four years. A review shows she still has access to finance and marketing systems she no longer needs. What is this problem called, and what control best prevents it?

   APrivilege creep; prevented by periodic access reviews and removing access on role changeBPrivilege escalation; prevented by patching the operating systemCAccount sharing; prevented by multifactor authenticationDSeparation of duties failure; prevented by mandatory vacations
   Show answer

   Answer: A. Access that piles up as people change roles is privilege creep, and regular access reviews with deprovisioning at each transfer stop it. Privilege escalation is an attacker gaining rights through a flaw. Mandatory vacations and MFA address fraud detection and authentication, not leftover entitlements.

9. Security Assessment and Testing

   Your company has hired an external firm to run a penetration test against its production web application next week. What must be in place before testing starts?

   AA completed business impact analysis for the applicationBA full vulnerability scan of the application by the internal teamCA signed non-disclosure agreement with each end user of the applicationDWritten authorization and agreed rules of engagement from someone with authority over the systems
   Show answer

   Answer: D. Without written permission and a defined scope, a penetration test can be unlawful and can disrupt production. A prior scan or BIA may be useful but is not a precondition. End users do not sign agreements for a test of the company's own system.

10. Security Operations

    An analyst suspects a workstation is running memory-resident malware and needs evidence for a possible prosecution. The machine is still running. What should the analyst do first?

    ARun an antivirus scan to identify the malwareBCapture a memory image using trusted tools, following order of volatilityCReboot into safe mode and copy the event logsDPull the power cord to preserve the disk exactly as it is
    Show answer

    Answer: B. Order of volatility says to collect the most volatile evidence first, and RAM is lost when power is cut. Pulling the plug or rebooting destroys memory contents. An antivirus scan changes the system and may remove the very evidence the analyst needs.

11. Security Operations

    A business impact analysis sets a recovery time objective of 4 hours and a recovery point objective of 15 minutes for the order system. Which recovery strategy meets both targets?

    AWeekly backups with a reciprocal agreement with another companyBA hot site receiving continuous or near-continuous data replicationCNightly full backups to tape, restored at a cold siteDDaily backups shipped to a warm site
    Show answer

    Answer: B. A 15-minute RPO means at most 15 minutes of data can be lost, which requires replication rather than daily or nightly backups. A 4-hour RTO needs a site that is ready to run, which is a hot site. Cold sites and reciprocal agreements take far longer to bring online.

12. Software Development Security

    A code review finds that a login page builds its SQL statement by joining the username field directly into the query string. Which fix best addresses the root cause?

    AAdd a web application firewall rule that blocks single quotesBLimit the username field to 20 charactersCHide database error messages from usersDUse parameterized queries (prepared statements) for all database calls
    Show answer

    Answer: D. Parameterized queries keep user input separate from SQL code, which removes the injection flaw itself. A WAF rule, hidden error messages and length limits only make attacks harder or quieter; they leave the vulnerable code in place.