10 free ISC2 CISSP-ISSEP practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 214 questions. Work through them, then open each answer to check your reasoning.
Get all 214 questions (US$39) · Download these 10 as a PDF
Question 1
FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems.
Which of the following FITSAF levels shows that the procedures and controls are tested and reviewed
Show answer and explanation
Correct answer: A. Level 4
FITSAF Level 4 is the stage at which procedures and controls are tested and reviewed, confirming that what was implemented actually works as intended. The five FITSAF levels progress from documented policy, to documented procedures, to implemented procedures and controls, to tested and reviewed procedures and controls, and finally to fully integrated procedures and controls. Testing and formal review are the defining activities of Level 4.
Why the other options are wrong
- B. Level 5 is where procedures and controls are fully integrated into a comprehensive program, which comes after testing and review.
- C. Level 1 means only that a security policy is documented.
- D. Level 2 means that procedures supporting the policy are documented, with no implementation or testing yet.
- E. Level 3 means the documented procedures and controls have been implemented, but not yet tested and reviewed.
Question 2
Which of the following is a type of security management for computers and networks in order to identify security breaches
Show answer and explanation
Correct answer: B. IDS
IDS (Intrusion Detection System) is a security management tool designed to identify and alert on security breaches by monitoring network traffic and system activity for suspicious patterns and signatures that indicate unauthorized access or attacks.
Why the other options are wrong
- A. IPS (Intrusion Prevention System) goes beyond detection to actively block threats, but the question specifically asks for identification of breaches.
- C. ASA (Adaptive Security Appliance) is a firewall and VPN device that provides perimeter security but is not primarily designed for breach detection.
- D. EAP (Extensible Authentication Protocol) is an authentication framework for network access control, not for identifying security breaches.
Question 3
Which of the following types of firewalls increases the security of data packets by remembering the state of connection at the network and the session layers as they pass through the filter
Show answer and explanation
Correct answer: C. Stateful packet filter firewall
A stateful packet filter firewall maintains awareness of the state of network connections and remembers the context of data flows passing through it at both the network and session layers. This allows it to make intelligent decisions about whether packets belong to legitimate established connections, providing enhanced security over simple packet filtering.
Why the other options are wrong
- A. Stateless packet filter firewalls do not track connection state; they examine each packet independently.
- B. PIX firewall is a specific Cisco appliance that can be stateful, but it is not the general category describing state-tracking firewalls.
- D. Virtual firewalls are deployed in virtualized environments but are not specifically defined by their ability to track connection state.
Question 4
Which of the following federal laws is designed to protect computer data from theft
Show answer and explanation
Correct answer: B. Computer Fraud and Abuse Act (CFAA)
The Computer Fraud and Abuse Act (CFAA) is a federal law specifically designed to protect computer data from theft, unauthorized access, and fraudulent activities. It criminalizes intentional access to computer systems without authorization and the theft or misuse of data.
Why the other options are wrong
- A. FISMA (Federal Information Security Management Act) establishes overall information security requirements for federal agencies but is not specifically focused on protecting data from theft.
- C. GISRA (Government Information Security Reform Act) is a precursor to FISMA and addresses security reform but is not primarily designed to protect against data theft.
- D. The Computer Security Act established the National Institute of Standards and Technology's role in security standards but is less specific to theft protection than the CFAA.
Question 5
Which of the following is used to indicate that the software has met a defined quality level and is ready for mass distribution either by electronic means or by physical media
Show answer and explanation
Correct answer: B. RTM
RTM (Release To Manufacturing) is the designation indicating that software has met defined quality standards and is approved for mass production and distribution through electronic or physical media channels. It represents the final stage of the software development cycle before general release.
Why the other options are wrong
- A. ATM (Asynchronous Transfer Mode) is a networking protocol for data transmission, not a software quality release milestone.
- C. CRO (Chief Risk Officer) is a personnel title, not a software release designation.
- D. DAA (Designated Approving Authority) is a role in the certification and accreditation process, not a software release quality indicator.
Question 6
Part of your change management plan details what should happen in the change control system for your project. Theresa, a junior project manager, asks what the configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which one
Show answer and explanation
Correct answer: A. Configuration Item Costing
Configuration Item Costing is not a standard configuration management activity. The four recognized configuration management activities are Configuration Identification, Configuration Status Accounting, Configuration Verification and Auditing, and Configuration Control. Costing relates to project financial management, not configuration management.
Why the other options are wrong
- B. Configuration Identification is a valid activity that establishes what items are under configuration management.
- C. Configuration Verification and Auditing is a valid activity that ensures configurations comply with requirements.
- D. Configuration Status Accounting is a valid activity that tracks and reports the status of configuration items.
Question 7
Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process
Show answer and explanation
Correct answer: B. Information system owner
The Information System Owner is responsible for initiating the Certification and Accreditation (C&A) process. The system owner has primary responsibility for the system and coordinates with other stakeholders to ensure the system is properly certified and accredited for operation.
Why the other options are wrong
- A. The Authorizing Official approves the certification and accreditation and accepts the risk, but does not start the process.
- C. The Chief Information Officer provides oversight but is not the individual responsible for starting the C&A process for specific systems.
- D. The Chief Risk Officer manages organizational risk but is not the designated starter of individual system C&A processes.
Question 8
Which of the following security controls is a set of layered security services that address communications and data security problems in the emerging Internet and intranet application space
Show answer and explanation
Correct answer: B. Common data security architecture (CDSA)
The Common Data Security Architecture (CDSA) is a set of layered security services that provide a comprehensive framework addressing communications and data security issues in Internet and intranet application environments. It integrates multiple security services into a cohesive architectural approach.
Why the other options are wrong
- A. IPSec (Internet Protocol Security) is a protocol suite for securing IP communications at the network layer, not a comprehensive layered security architecture.
- C. File encryptors are tools for encrypting individual files, not a comprehensive security architecture for communications and data security.
- D. API (Application Program Interface) is a programming interface specification, not a security control or layered security architecture.
Question 9
Which of the following protocols is used to establish a secure terminal to a remote network device
Show answer and explanation
Correct answer: C. SSH
SSH (Secure Shell) is the protocol designed to establish secure terminal sessions to remote network devices, replacing the insecure Telnet protocol. It encrypts all communications between the client and server, providing confidentiality and authentication for remote terminal access.
Why the other options are wrong
- A. WEP is a wireless encryption standard, not a terminal access protocol.
- B. SMTP is an email transmission protocol with no remote terminal functionality.
- D. IPSec is a network-layer security protocol suite, not specifically designed for terminal access like SSH.
Question 10
Which of the following elements of Registration task 4 defines the system's external interfaces as well as the purpose of each external interface, and the relationship between the interface and the system
Show answer and explanation
Correct answer: C. System interface
System interface documentation defines the external interfaces of a system, the purpose each interface serves, and how each interface relates to the overall system. This element is part of Registration task 4 and provides essential information about system boundaries and connection points.
Why the other options are wrong
- A. System firmware refers to the low-level software that controls hardware, not interface documentation.
- B. System software encompasses applications and operating systems, not external interface specifications.
- D. System hardware describes physical components, not the definition and relationships of external interfaces.
That was 10 of 214.
The full ISC2 CISSP-ISSEP pack has all 214 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.