10 free ISC2 CISSP-ISSAP practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 237 questions. Work through them, then open each answer to check your reasoning.
Get all 237 questions (US$39) · Download these 10 as a PDF
Question 1
Which of the following elements of planning gap measures the gap between the total potential for the market and the actual current usage by all the consumers in the market?
Show answer and explanation
Correct answer: D. Usage gap
The usage gap specifically measures the difference between the total potential market size (what could theoretically be consumed) and the actual current consumption by all consumers in that market. This identifies untapped market opportunity due to underutilization of products or services that exist.
Why the other options are wrong
- A. Project gap refers to the difference between forecasted and actual results, not market potential versus actual usage.
- B. Product gap measures the difference between existing products and desired products, not market potential.
- C. Competitive gap refers to the difference between competitors' performance and a company's own performance.
Question 2
Which of the following terms refers to the method that allows or restricts specific types of packets from crossing over the firewall?
Show answer and explanation
Correct answer: B. Packet filtering
Packet filtering is the core firewall technique that examines individual packets and allows or blocks them based on predefined rules (source/destination IP, port numbers, protocols). It operates at the network layer to control traffic crossing the firewall.
Why the other options are wrong
- A. Hacking is unauthorized access to systems, not a firewall security method.
- C. Web caching improves performance by storing web content locally, unrelated to firewall packet control.
- D. Spoofing is a type of attack where attackers falsify source addresses, not a firewall filtering method.
Question 3
You work as a Network Administrator for NetTech Inc. The company wants to encrypt its e-mails.
Which of the following will you use to accomplish this?
Show answer and explanation
Correct answer: A. PGP
PGP (Pretty Good Privacy) is specifically designed for encrypting emails and is the standard choice for email encryption. It provides both encryption and digital signatures for email messages.
Why the other options are wrong
- B. PPTP is a tunneling protocol for VPN connections, not email encryption.
- C. IPSec operates at the network layer for VPN tunnels, not at the application layer for email.
- D. NTFS is a file system format, completely unrelated to email encryption.
Question 4
Peter works as a Network Administrator for Net World Inc. The company wants to allow remote users to connect and access its private network through a dial-up connection via the Internet. All the data will be sent across a public network. For security reasons, the management wants the data sent through the Internet to be encrypted. The company plans to use a Layer 2 Tunneling Protocol (L2TP) connection.
Which communication protocol will Peter use to accomplish the task?
Show answer and explanation
Correct answer: A. IP Security (IPSec)
IPSec is the standard encryption protocol used with L2TP to provide security for VPN connections over the Internet. L2TP handles tunneling while IPSec encrypts the data traveling through that tunnel.
Why the other options are wrong
- B. MPPE is associated with PPTP, not L2TP, though it provides encryption.
- C. PGP is for email encryption, not for VPN tunnel encryption.
- D. DES is an encryption algorithm but not a protocol; IPSec is the proper protocol choice for L2TP security.
Question 5
Which of the following protocols multicasts messages and information among all member devices in an IP multicast group?
Show answer and explanation
Correct answer: D. IGMP
IGMP (Internet Group Management Protocol) is specifically designed to manage IP multicast group membership. It allows devices to join and leave multicast groups and enables routers to identify which devices want to receive multicast traffic.
Why the other options are wrong
- A. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses, not related to multicast.
- B. ICMP is for error reporting and diagnostics (ping, tracert), not multicast messaging.
- C. TCP is a unicast protocol providing reliable point-to-point communication, not multicast.
Question 6
Which of the following security devices is presented to indicate some feat of service, a special accomplishment, a symbol of authority granted by taking an oath, a sign of legitimate employment or student status, or as a simple means of identification?
Show answer and explanation
Correct answer: D. Badge
A badge is a physical security device that serves multiple purposes: it demonstrates authorization, indicates status or accomplishment, symbolizes legitimate employment or student status, and provides a means of identification. It is presented visibly to grant or deny access.
Why the other options are wrong
- A. A sensor detects physical phenomena like motion or temperature, not a credential device.
- B. An alarm alerts to security events but does not serve as a credential or identification device.
- C. A motion detector senses movement but does not function as identification or authorization credential.
Question 7
Which of the following is a method for transforming a message into a masked form, together with a way of undoing the transformation to recover the message?
Show answer and explanation
Correct answer: A. Cipher
A cipher is precisely defined as a method for transforming plaintext into masked/encrypted form and then reversing that transformation to recover the original message. This is the fundamental definition of encryption and decryption.
Why the other options are wrong
- B. CrypTool is a software application for cryptography education and analysis, not the method itself.
- C. Steganography hides information within other data (like images) rather than transforming messages through encryption.
- D. MIME is a standard for encoding email messages and attachments, not for message transformation via encryption.
Question 8
Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them.
Which of the following access control models will he use?
Show answer and explanation
Correct answer: D. Role-Based Access Control
Role-Based Access Control (RBAC) is designed to grant users access only to resources required for their specific role or job function. It restricts access based on assigned roles, ensuring users have only necessary permissions.
Why the other options are wrong
- A. Policy Access Control is not a standard access control model terminology.
- B. Mandatory Access Control enforces system-wide policies set by administrators with no user discretion.
- C. Discretionary Access Control allows resource owners to decide who gets access, not restricting to role-required resources.
Question 9
Which of the following is used to authenticate asymmetric keys?
Show answer and explanation
Correct answer: A. Digital signature
Digital signatures are the primary mechanism for authenticating asymmetric keys. A digital signature proves that a message or key was signed by the holder of a private key, establishing authenticity and non-repudiation. The signature is created using the private key and verified using the corresponding public key, making it the standard authentication method for asymmetric cryptography.
Why the other options are wrong
- B. MAC addresses are hardware identifiers used for local network communication and have no role in asymmetric key authentication.
- C. A demilitarized zone is a network architecture component for security segmentation, not a key authentication method.
- D. Passwords are symmetric secrets used for simple authentication but cannot authenticate asymmetric keys, which require cryptographic proof.
Question 10
IPsec VPN provides a high degree of data privacy by establishing trust points between communicating devices and data encryption.
Which of the following encryption methods does IPsec VPN use? Each correct answer represents a complete solution.
Choose two.
Show answer and explanation
Correct answer: C, D
C. AES D. 3DES IPsec VPN uses AES (Advanced Encryption Standard) and 3DES (Triple Data Encryption Standard) as its primary encryption methods. Both are symmetric block ciphers approved for encrypting IPsec traffic. AES is the modern standard offering superior security and performance, while 3DES is a legacy algorithm still supported for backward compatibility.
Why the other options are wrong
- A. MD5 is a hashing algorithm, not an encryption algorithm; it cannot encrypt data for IPsec.
- B. LEAP is a wireless authentication protocol, not an encryption method used by IPsec.
That was 10 of 237.
The full ISC2 CISSP-ISSAP pack has all 237 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.