CISSP Practice Exam.
Free practice test — 37 verified questions, instant feedback.

Answer: B
RTO is the targeted duration within which a business process must be restored after a disruption to avoid unacceptable consequences, which matches the 4-hour figure derived during BIA. RPO instead measures acceptable data loss in time (how much data, not downtime, can be lost). MTTR is an operational/technical repair-time metric, not a business-impact-derived target. MTD is the absolute outer limit of tolerable downtime and is typically larger than or equal to the RTO, not the target itself the question describes.

Answer: B
Single Loss Expectancy (SLE) = AV x EF = $500,000 x 0.40 = $200,000. ARO for an event occurring once every 4 years is 1/4 = 0.25. ALE = SLE x ARO = $200,000 x 0.25 = $50,000, matching option B. Option A inverts the ARO (using 4 instead of 0.25) and incorrectly reports SLE as if it were the ALE. Option C misstates both values entirely. Option D miscalculates SLE and pairs it with the wrong (inverted) ARO.

Answer: B
A candidate who passes the exam without the full experience requirement becomes an Associate of ISC2 and is given 6 years to earn the required five years of qualifying experience before being awarded the full CISSP credential. The exam can be taken before experience is completed, so option A is false. There is no requirement to retake the exam once experience is completed. Full CISSP status requires both passing the exam and verifying the experience, so it is not granted immediately without experience.

Answer: B
Minimizing retention of sensitive data to only what is legally and operationally required, followed by secure destruction, reduces the attack surface and liability exposure—this is a core asset security and data lifecycle principle. Indefinite or permanent retention increases breach impact and often violates data minimization requirements under privacy law. Distributing sensitive data to every workstation for 'redundancy' dramatically increases exposure and violates least-privilege and data-minimization principles rather than protecting the data.

Answer: B
The data owner (often a business-unit executive) has ultimate accountability for a dataset, including assigning its classification level and approving access decisions, because they best understand its business value and sensitivity. The data custodian implements technical controls (backups, access provisioning) on the owner's behalf but does not decide classification. System administrators perform operational tasks per established policy. End users merely consume data according to granted permissions and have no classification authority.

Answer: C
Physical destruction, such as shredding or degaussing a drive to the point it is no longer usable, provides the highest assurance against recovery, including forensic techniques, which is appropriate when media cannot be reused. Deleting files or emptying the recycle bin only removes directory pointers, leaving data recoverable with common tools. Quick-formatting similarly leaves most data intact and recoverable. Moving files to another folder does not remove or sanitize the underlying data at all.

Answer: B
Need to know further restricts access within an already-authorized role so that a subject can only access the specific information required to perform their current task, which is why the accounts-payable employee is denied payroll data despite having general financial-system access. Separation of duties splits a sensitive process across multiple people to prevent fraud, which is a different control from restricting information access scope. 'Mandatory vesting' is not a security access-control concept. Due diligence refers to the reasonable care an organization exercises in managing risk, not an access-restriction mechanism.

Answer: A
Bell-LaPadula is a confidentiality-focused model (no read up, no write down) designed to prevent unauthorized disclosure, while Biba is an integrity-focused model (no read down, no write up) designed to prevent unauthorized or improper modification of data. Reversing these goals (option B) describes the models backward. Neither model addresses availability as its primary goal. The two models use opposite rule structures and are not interchangeable, since they protect different security properties.

Answer: B
The ring model enforces process isolation by assigning privilege levels, ensuring that less-trusted code (Ring 3 applications) cannot directly execute privileged instructions or access kernel memory reserved for Ring 0, reducing the impact of a compromised application. Rings have nothing to do with network throughput, encryption of transmitted data, or storage redundancy—those are unrelated architectural concerns handled by other mechanisms entirely.

Answer: A
A TPM is a dedicated, tamper-resistant hardware chip that securely generates and stores cryptographic keys and can measure and attest to the integrity of the boot process, matching the scenario exactly. A software-based key file lacks hardware tamper resistance and can be copied or exfiltrated more easily. A generic USB drive provides no cryptographic attestation or tamper protection. An unencrypted configuration file offers no protection for keys at all and is the opposite of a secure solution.

Answer: B
Clean-agent gaseous systems (e.g., FM-200, Novec 1230) suppress fire without leaving conductive residue or causing the water damage that would destroy live electrical equipment, making them the preferred choice for server rooms. Water sprinklers can cause severe additional damage to energized equipment and are not preferred despite lower cost. Redundant power supplies address power failure, not fire risk, so suppression is still necessary. CO2 systems displace oxygen and pose asphyxiation risk, requiring evacuation procedures before discharge, not safe discharge with staff present.

Answer: C
Stateful firewalls primarily track connection state using Transport-layer (Layer 4) information such as TCP sequence numbers, flags (SYN/ACK/FIN), and port pairs to determine whether a packet belongs to an established session. Layer 1 deals with physical signaling and has no session concept. Layer 2 deals with MAC addressing and frames, not session state. While some stateful and next-gen firewalls incorporate application-layer awareness, classic stateful inspection is defined by its Layer 4 state-tracking, not exclusive Layer 7 operation.

Answer: B
WPA3 provides stronger encryption (e.g., SAE replacing the vulnerable 4-way handshake exploited under WPA2/WPA) and, in enterprise mode, integrates with 802.1X authentication, making it the current best-practice choice over deprecated protocols. WEP has well-known cryptographic weaknesses (weak IV usage, RC4 flaws) and should never be used. Disabling encryption entirely removes confidentiality and integrity protection completely. SSID hiding is a weak, easily bypassed obscurity measure, not a real access control, and should not be relied upon as a primary defense.

Answer: B
Hybrid cryptosystems exploit the strengths of each algorithm type: symmetric ciphers like AES are computationally efficient for encrypting large volumes of data, while asymmetric RSA—though much slower for bulk data—solves the key-distribution problem by letting the session key be exchanged securely without a pre-shared secret, since only Party B's private key can decrypt it. Option A reverses reality: RSA is significantly slower than AES for bulk encryption, not faster, which is precisely why it's reserved for the small key exchange. Party B still must securely manage their RSA private key, so key management is not eliminated. RSA can mathematically encrypt data blocks larger than one bit (up to its modulus size), so that claim is false; the real constraint is RSA's poor performance and message-size limits relative to symmetric ciphers for bulk data, not an inability to exceed one bit.

Answer: A
DNS amplification/reflection attacks spoof the victim's IP address in queries sent to open resolvers, causing large responses to flood the victim, which matches the described bandwidth-overwhelming behavior from unsolicited DNS responses. A man-in-the-middle attack involves intercepting and possibly altering communications between two parties, not flooding via spoofed queries. SQL injection targets database-backed applications with malicious input, unrelated to DNS traffic floods. Cross-site scripting targets web application users via injected scripts, also unrelated to network-layer DDoS traffic.

Answer: B
VLANs logically segment a physical switch into separate broadcast domains, and combined with access control (e.g., ACLs or a firewall between VLANs), they prevent devices on a guest VLAN from directly reaching internal servers on a finance VLAN, even on shared physical infrastructure. Port speed affects throughput, not logical segmentation. MAC address table size affects switch capacity/performance, not access separation between segments. Cable length is a purely physical consideration with no bearing on logical network segmentation or security.

Answer: C
True multifactor authentication requires factors from distinct categories—something you know, something you have, or something you are—so a password combined with a hardware token satisfies this by pairing 'know' with 'have.' A password plus a security question are both 'something you know,' making that combination single-factor despite using two credentials. A password plus PIN is likewise two 'something you know' factors. Two passwords in sequence is still only the knowledge factor repeated, not multifactor authentication.

Answer: B
In SAML federation, the identity provider authenticates the user against corporate credentials and issues a digitally signed assertion that the service provider (the SaaS app) trusts and uses to grant access, which is the core mechanism enabling single sign-on across domains. The SaaS application, not the IdP, is the relying party/service provider consuming the assertion. The IdP does not store the SaaS vendor's business data—that remains within the SaaS provider's own systems. The IdP's role is essential up front (issuing the assertion) even though it typically isn't involved in every subsequent in-session action.

Answer: C
ABAC evaluates multiple contextual attributes—user, resource, environment (time, device state), and action—through policy rules to make dynamic access decisions, matching the scenario's combination of department, classification, time, and device compliance. DAC lets resource owners grant access at their discretion, without this rule-based attribute evaluation. RBAC assigns permissions based on fixed roles rather than combining multiple dynamic attributes. Pure MAC relies on classification labels and clearance levels alone, not the broader attribute set (time, device compliance) described here.

Answer: B
RBAC's core administrative benefit is that permissions are bundled into roles tied to job functions, so provisioning and de-provisioning access at scale means assigning or removing a role rather than managing dozens of individual permissions per person, which directly reduces review overhead in large organizations. DAC would push permission decisions to individual data owners, not standardized bundles, and doesn't address the scaling problem described. Rule-based access control applies global if-then rules (e.g., firewall ACLs) rather than job-function bundles. MAC relies on clearance/label comparisons for every request, which is a different mechanism than grouping permissions by role and doesn't inherently reduce the described per-user administrative burden.

Answer: B
Time-limited, checked-out credentials minimize how long privileged access exists and how widely it can be exploited if compromised, directly supporting least-privilege and just-in-time access principles. Logging is still necessary and typically enhanced, not eliminated, under PAM solutions—it's a separate control. No access control model can guarantee human error is eliminated. Authentication is still required to check out and use the credentials; PAM does not remove authentication requirements.

Answer: B
Black-box testing simulates an external attacker who has no prior internal knowledge of the target system's architecture, source code, or credentials, matching the scenario exactly. White-box testing provides the tester full internal knowledge, including architecture and source code, which contradicts the 'no prior system knowledge' condition. Gray-box testing gives partial knowledge, and explicitly having 'full source code access' would actually make it white-box, not gray-box. Static code analysis examines source code without executing it and is a different technique from a simulated external attack.

Answer: B
A false positive occurs when a scanner flags a vulnerability that does not actually pose exploitable risk in the real deployed environment, exactly as described when manual verification shows the code path is unreachable. A true positive would mean the vulnerability is confirmed as genuinely exploitable, which is the opposite of what verification found. A false negative is a missed vulnerability that actually exists but wasn't detected, not a finding that was detected but doesn't apply. A true negative would mean no vulnerability was reported and none exists, which doesn't match this scenario where a finding WAS reported.

Answer: B
SOC 2 Type II specifically evaluates operating effectiveness of controls by sampling evidence across an extended review period, which is exactly what's needed to confirm sustained, real-world control performance rather than mere existence. Reviewing only written policy verifies design, not operation. A single employee interview provides limited, subjective, and non-representative evidence. Confirming design at a single point in time describes a Type I assessment, which addresses design suitability but not sustained operating effectiveness.

Answer: A
A SIEM platform is purpose-built to aggregate, normalize, and correlate log data from diverse sources (authentication systems, firewalls, endpoints) in near real time to detect patterns indicative of multi-stage attacks, matching the described requirement. A single antivirus console only reports on its own host-based detections, not enterprise-wide correlation. A manually updated spreadsheet cannot provide near-real-time correlation and doesn't scale to enterprise log volumes. A badge reader log viewer covers only physical access events, a narrow subset of the required data sources.

Answer: C
Containment is the phase focused on limiting the scope and impact of an incident, such as isolating a compromised server from the network to stop ongoing exfiltration, which is exactly what's described. Preparation involves proactive readiness activities (plans, tooling, training) performed before an incident occurs. Detection and analysis involves identifying and scoping the incident, which has already occurred by the time isolation is triggered. Lessons learned is the post-incident review phase used to improve future response, not an active response action.

Answer: C
A hot site is a fully operational, continuously synchronized duplicate environment capable of near-immediate failover, matching the minutes-long recovery described. A cold site provides only basic infrastructure (power, space, cooling) with no pre-installed systems or data, requiring days to weeks to become operational. A warm site has some equipment and partial data replication but requires additional setup and typically takes hours, not minutes, to fully activate. A mobile trailer with no pre-installed equipment is essentially a portable cold site and would not support minutes-long recovery.

Answer: A
SOAR platforms are designed to orchestrate and automate response playbooks—such as isolating a host or disabling an account—triggered by specific alert conditions, directly reducing analyst workload for well-understood, repeatable incidents. A packet sniffer only captures and displays traffic; it has no automation or orchestration capability. A manual paper runbook still requires a human to read and execute each step, which does not reduce triage burden through automation. An offline vulnerability scanner report is a static assessment output, not an active response automation tool.

Answer: B
The order of volatility principle dictates collecting the most transient evidence first: CPU registers and cache change constantly and are lost the instant power/process state shifts, followed by RAM (lost on reboot/power-off), then network connection state (changes as sessions open/close), with disk contents being comparatively persistent and collected last. Option A reverses the entire order, starting with the most persistent artifact (disk) and ending with the most volatile (registers), which risks losing the most fragile evidence first. Option C and D scramble the sequence in ways that place persistent disk data ahead of more volatile network or register state, violating OOV and risking loss of transient evidence during collection.

Answer: B
A well-designed change management program includes an expedited emergency-change path that still requires documented (even if abbreviated) approval and a post-implementation review, balancing the need for speed against accountability and rollback planning. Skipping all documentation removes accountability and traceability, increasing risk of undetected failures. Waiting for a routine monthly window ignores the active-exploitation urgency and leaves systems exposed unnecessarily. Patching only an executive's workstation does not address the organization-wide risk posed by active exploitation.

Answer: B
Parameterized queries separate SQL code from user-supplied data by binding input as parameters rather than concatenating it into the query string, which is the most effective and industry-standard defense against SQL injection. Client-side validation can be bypassed entirely since it runs in the untrusted browser and provides no server-side protection. Blacklisting specific keywords is easily evaded through encoding, case variation, or alternate syntax and is widely considered an unreliable defense. Connection timeout settings affect performance/availability handling, not injection prevention.

Answer: B
Threat modeling performed during the design phase identifies potential attack vectors and required countermeasures before code is written, making remediation far cheaper than fixing issues discovered later; this reflects the well-established principle that security defects cost progressively more to fix the later they're found. Waiting until incident response means a real compromise may have already occurred. Relying solely on a final penetration test misses the opportunity to influence architecture and catches only a subset of design-level flaws late in the cycle. Decommissioning is the end of the lifecycle and offers no opportunity to prevent flaws in the now-retired system.

Answer: B
Client-side code, including JavaScript delivered to the browser, is fully visible and extractable by any user via view-source or developer tools, so embedding plaintext database credentials there exposes them to anyone who loads the page—a critical confidentiality failure enabling direct unauthorized database access. Page load time is a negligible, unrelated performance concern compared to full credential exposure. This is a substantive security defect, not merely a cosmetic style issue. The JavaScript sandbox restricts what a script can do to the browser/OS, but it does not hide the script's own source code from the user, so the sandbox claim doesn't mitigate this exposure.

Answer: A
The CISSP exam outline is organized into 8 domains, and Domain 1, Security and Risk Management, carries the largest individual weighting at 16%, making it the highest-priority study area by exam weight. There are not 6 or 10 domains, ruling out those options. Asset Security is weighted at 10%, not 25%, and is not the largest domain, so that option misstates both the count context and the specific weight.

Answer: A
The standard CISSP examination registration fee is U.S. $749, and separately, rescheduling an appointment carries a $50 fee, distinct from the $100 fee that applies specifically to cancellations. The $549 figure and 'free' rescheduling in option B are incorrect. Option C incorrectly substitutes the $100 cancellation fee for the reschedule fee. Option D's $999 registration figure does not match the published standard fee.

Answer: B
The English CISSP exam uses Computerized Adaptive Testing, which contains 100 to 150 questions per attempt, with a passing threshold of 700 out of 1000 scaled points. It is not a fixed-form paper exam, so option A is wrong on format and scoring scale. Option C is wrong because CAT delivers a variable, not always-150, question count, and there is a defined passing score, not an absence of one. It is administered at proctored test centers, not as an untimed take-home exam.

Answer: A
After registering with ISC2, candidates are redirected to the Pearson VUE website to finalize their exam appointment, and the exam itself is administered at Pearson VUE test centers, making this the accurate description of the process. There is no university testing office intermediary in this process. The CISSP exam is proctored at physical test centers rather than delivered as an unproctored at-home exam. Scheduling is done online via Pearson VUE, not by mail.