100 Free CISSP Practice Questions and Answers

Why B is right

When outsourcing network management, strong access controls are the most effective technical measure for protecting critical data assets. Access controls directly prevent unauthorized access by third-party personnel and limit what each user can do, following the principle of least privilege. While confidentiality agreements (A) and activity logging (C) are important, they are preventive/detective after the fact rather than preventive at the point of access. Policies (D) are guidance documents without enforcement mechanisms. Access controls actively restrict who can access what data, making them the most effective protective measure.

Why B is right

Threat modeling is the testing technique that explicitly enables designers to identify potential vulnerabilities and develop mitigation strategies before implementation. It systematically analyzes possible attack vectors and threats, allowing architects to design countermeasures proactively. This forward-looking approach is distinct from testing techniques that identify existing flaws.

Why C is right

Navigating the dark web during a penetration test adds value by providing access to information about related breaches, hacking techniques, and emerging threats that may be relevant to the tested organization. Security researchers and penetration testers can find evidence of previous compromises, exploit kits, and threat actor discussions that inform the assessment of vulnerabilities and risk. This threat intelligence helps identify which vulnerabilities are actively exploited and what techniques attackers are using against similar organizations.

Why D is right

The main purpose of a BIA is to determine how failures of critical information systems impact core business processes and operations. This establishes the importance and urgency of recovery priorities. While BIA may inform restoration costs, control selection, and resource requirements, the PRIMARY purpose is understanding the business consequences of system failures. This impact assessment drives all subsequent recovery planning decisions.

Why A is right

Process is the key trait of crisis management in a DR test context, as crisis management requires following structured, documented processes and procedures to respond effectively to incidents during the disaster recovery exercise. Crisis management depends on predetermined, well-defined processes rather than anticipation alone. Strategic (C) and wide focus (D) relate more to planning phases, while anticipate (B) is preparatory rather than a crisis management trait.

Why B is right

The security team must first get involved when the need for a system is expressed and the purpose of the system is documented. This early involvement ensures that security requirements are defined from the outset, incorporated into procurement specifications, and influence vendor selection and system design, rather than attempting to retrofit security controls after acquisition decisions are made.

Why B is right

Fail-Closed is the security-prioritizing failure mode for firewalls. When a firewall fails in a closed state, all traffic is blocked by default, denying access until the firewall is restored. This conservative approach ensures that no unauthorized traffic can pass through during the failure, maintaining the security posture even at the cost of availability. This is the opposite of fail-open, which would allow all traffic through during failure, a dangerous scenario for security.

Why D is right

Public key-based authentication is most suited for scripted SSH functions because it allows automated authentication without requiring interactive password entry or MFA responses. Scripts can use passwordless key-based authentication to run unattended, while maintaining strong security through key management. This approach enables automation while avoiding the friction of interactive authentication methods.

Why D is right

802.1X is an IEEE standard that provides the framework for Network Access Control (NAC). It implements port-based network access control by requiring devices to authenticate before gaining access to network resources. It works with an authenticator (switch), authentication server (RADIUS), and supplicant (client device) to control who can connect to the network.

Why B is right

Pivoting is a technique where attackers use a compromised or obsolete system as a launching point to traverse further into the network and access other systems. The compromised system acts as a pivot point to reach otherwise unreachable targets, allowing lateral movement through the network infrastructure.

Why C is right

IM clients using random or non-standard port numbers pose the most significant challenge to network perimeter security because traditional port-based filtering and detection mechanisms become ineffective. When IM applications dynamically negotiate ports or use random port assignment to bypass firewall rules, the organization loses visibility and control at the network boundary. This technical evasion capability directly undermines security policy enforcement at the perimeter.

Why C is right

The Improvement stage of an ISMS (as defined in ISO 27001 and the Plan-Do-Check-Act cycle) is where nonconformities identified during audits and assessments are reviewed, analyzed, and corrected. This stage focuses on taking corrective actions and implementing improvements based on findings.

Why B is right

Under Extended Identity principles, the clothing retailer acts as an identity provider (IdP) that authenticates its own users using industry-standard protocols and then sends security assertions or credentials to partner businesses, which act as service providers. This federated identity model allows the IdP to vouch for user identity to multiple service providers without those providers needing to authenticate the user directly. User Self Service is not a valid IAM role, and the clothing retailer cannot be the Service Provider for its own employees accessing partner resources.

Why A is right

SOC 2 is specifically designed to evaluate a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. It provides the most comprehensive assessment of a vendor's information systems across all three dimensions mentioned (confidentiality, integrity, and availability). SOC 2 reports are the industry standard for understanding vendor security postures and are widely requested by organizations evaluating cloud and managed service providers.

Why A is right

An Owner must be assigned first in the information governance lifecycle because the owner has ultimate responsibility and accountability for the information asset. Only after an owner is designated can proper classification, custodianship, and retention policies be effectively established and managed. The owner drives all subsequent governance decisions.

Why C is right

A Protection Profile (PP) in Common Criteria is a formal, implementation-independent document that specifies security requirements and evaluation criteria for a class of products. It describes what security properties a product should have without dictating how to implement them, making it reusable across different implementations.

Why A is right

The Sales Director lacked technical security expertise to conduct a meaningful internal audit, resulting in an overly optimistic assessment that missed critical control failures. The subsequent penetration test by external security professionals, who possessed the technical depth to identify vulnerabilities and undocumented processes, revealed significant gaps. The disparity directly results from the internal auditor's insufficient technical knowledge and training to objectively assess security controls, rather than scope differences or intentional deception.

Why D is right

Key Risk Indicators (KRIs) are metrics that provide early warning signals of increasing risk within an organization and directly measure factors affecting organizational success. KRIs track whether risk levels are moving toward or away from acceptable thresholds and inform strategic decisions about risk tolerance. They are forward-looking measures embedded in strategic risk assessment that monitor conditions affecting the organization's ability to achieve objectives.

Why C is right

The principle being demonstrated is that biometric data must be protected from disclosure. The team is using biometric data from production in a secure testing environment rather than using uncontrolled or unsecured test data. This shows acknowledgment that biometric data is sensitive and must be handled with care even during development and testing phases. The use of a secure environment demonstrates the principle that such data requires protection throughout its lifecycle.

Why A is right

Planning is a recognized high-level phase in SDLC auditing that forms the foundation for all subsequent audit activities. It involves defining audit scope, objectives, timelines, and resources. While risk assessment, due diligence, and requirements are important activities, Planning is the primary high-level phase that initiates the audit process in SDLC.

Why C is right

Human Resources (HR) initiates the request, approval, and provisioning business process for user access. HR is responsible for onboarding new employees, managing employment changes, and terminations, which triggers the formal access request process. HR initiates these requests based on job requirements, and the requests flow through approval workflows to IT for actual provisioning of systems and accounts.

Why D is right

Clear provisioning policies are essential for automated account reconciliation to work with minimal errors. When policies are well-defined and documented, the automated system can accurately match accounts to authorized roles and responsibilities, identify inconsistencies, and validate access without manual interpretation. This foundation ensures accuracy and consistency in the audit process.

Why A is right

Using a salted cryptographic hash of the password protects confidentiality of stored credentials by ensuring passwords are never stored in plaintext or reversibly encrypted form. Even if the database is compromised, attackers cannot retrieve the original password from the hash.

Why D is right

Data Quality is the OECD fair information practice principle that specifies PII should be accurate, complete, up-to-date, and relevant to the purposes for which it is used. This principle directly addresses the maintenance of current and pertinent information throughout its lifecycle.

Why C is right

Infrastructure as a Service (IaaS) is the correct model when an organization provides only data while the third-party supplier provides the security controls and manages the underlying infrastructure, platforms, and services. In IaaS, the cloud provider manages security controls, availability, and infrastructure while the customer manages data and applications. This matches the described scenario where the supplier provides security controls and the organization provides data.

Why A is right

The Trusted Platform Module (TPM) is a hardware security module that provides cryptographic capabilities including secure digital signature verification and validation before system access. TPM ensures that the application and system integrity can be verified through trusted hardware mechanisms before allowing access to a user's laptop.

Why D is right

Isolating different classes of information and segregating by user jurisdiction allows an organization to apply different system policies and compliance controls to meet varying legal requirements of different jurisdictions. When an organization operates across multiple countries or regions with conflicting data protection and retention laws, segregating information enables compliance with each jurisdiction's specific requirements without the entire system being bound by the most restrictive rule.

Why D is right

Federated Identity Management is the best approach for SSO because it allows users to use their credentials across multiple applications and organizations through trust relationships between identity providers. It enables seamless credential sharing across different security domains while maintaining security controls. Federated Identity Management specifically addresses the cross-application and cross-organizational authentication needs of SSO.

Why B is right

A Configuration Management Database (CMDB) is specifically designed as a centralized, relational repository that stores comprehensive information about IT infrastructure including all software and hardware assets, their configurations, and their relationships. It is the standard tool for asset inventory and management.

Why A is right

MDM with device wipe capability is the most effective mitigation against data theft on a stolen device. When a device is confirmed stolen, remote wipe removes all data from the device, making the data inaccessible to the thief. This directly eliminates the primary threat to data on the stolen device, whereas the other options only protect data in transit or help locate the device.

Why B is right

Access Control Lists (ACLs) determine which users and systems are authorized to access the application and send data to it. ACLs enforce authentication and authorization policies at the network or application level, ensuring that only authorized entities can interact with the cloud-based application.

Why B is right

SOC 2, Type 2 reports specifically evaluate the operating effectiveness of controls over security, availability, confidentiality, processing integrity, and privacy (the trust service criteria). Type 2 reports cover a period of time and provide evidence of effective control implementation, making them ideal for confirming that a supplier's controls are actually working. SOC 1 focuses on financial reporting controls, and ISO standards are frameworks rather than attestation reports.

Why B is right

Cross-Site Request Forgery (CSRF) is the correct answer because it specifically describes an attack where an attacker uses a malicious URL and social engineering to exploit a victim's existing authenticated browser session with a web application without their knowledge or consent. The attack leverages the fact that the user is already logged in. Clickjacking (A) involves UI overlay tricks, XSS (C) involves script injection, and Injection (D) is a broad category affecting databases.

Why B is right

The fundamental principle of security budgeting is that allocated funds must be sufficient to manage and mitigate the organization's identified risks to an acceptable level. The budget should directly correspond to the risk assessment findings and ensure that critical risks are addressed with appropriate resources. This risk-based approach ensures that security investments are proportional to actual business risks.

Why A is right

The Control Plane is the network layer responsible for determining how traffic should be routed and managed based on the current state of the infrastructure. It manages routing decisions, network topology information, and infrastructure status to dictate traffic flow patterns across the network.

Why B is right

Data validation is the best preventive control against tampering because it ensures that only properly formatted and legitimate data can be entered or modified in the database. By validating data at entry points and during processing, unauthorized or malicious modifications are detected and rejected. This acts as a gatekeeper, preventing tampering at the source.

Why A is right

Threat modeling is the best method for assessing security impact of acquired software because it systematically identifies potential threats, vulnerabilities, and attack vectors specific to the software's architecture and data flows. It provides a comprehensive view of security risks before deployment, which is essential when evaluating third-party or acquired software.

Why B is right

When deploying wireless infrastructure, the most important factors are performance, geographic location, and radio signal interference. These factors directly impact the effectiveness and reliability of the wireless network. Geographic location determines available spectrum regulations, performance requirements must meet business needs, and interference management is critical for maintaining signal quality and coverage.

Why B is right

A Trusted Platform Module (TPM) is a hardware-based security module specifically designed to securely generate, store, and protect cryptographic keys. TPMs provide tamper-resistant storage and are the industry standard for protecting sensitive key material in certificate authorities and other security-critical applications.

Why B is right

Circular dependencies should be avoided in secure design principles because they create complex interdependencies that are difficult to manage, test, and secure. Circular dependencies can lead to unintended security vulnerabilities, make the system harder to maintain, and complicate the enforcement of security policies in SDN architectures. They prevent clear separation of concerns and make it difficult to trace data flow and security boundaries.

Why B is right

Trusted Platform Module (TPM) is a secure hardware component on endpoints that includes a root key (endorsement key) used for cryptographic operations and key storage. TPM provides secure key management for endpoint encryption solutions like BitLocker integration and meets the requirement of including a root key for secure encryption.

Why C is right

Memory collection is the appropriate technique when a rootkit is suspected and quick analysis is needed. Rootkits operate in kernel memory and may not be visible on disk; capturing memory preserves volatile evidence of the rootkit's presence and behavior before it is lost. This enables rapid analysis of the running malware. Live response (B) is broader but less specific; forensic disk imaging (A) focuses on disk artifacts that rootkits often hide; malware analysis (D) is the downstream process using collected evidence.

Why D is right

The vulnerability involved sensitive data being sent unencrypted to external tax processing systems. This is a classic interface/integration testing issue where the connection between the payroll system and external systems was not properly tested for security. Internal application testing alone would not catch weaknesses in how systems communicate with external third parties, which is specifically the domain of interface testing.

Why B is right

An Access Control List (ACL) on a router operates at Layer 3 (Network layer) by examining individual packet headers and making allow/deny decisions based on source IP, destination IP, protocol type, and ports. This packet-by-packet inspection without maintaining connection state is the fundamental characteristic of a packet filtering firewall, making ACLs the router-based equivalent of packet filtering functionality.

Why B is right

Chain-of-custody is the analyst's first consideration when performing an investigation with potential legal action. Establishing and maintaining proper chain-of-custody documentation from the moment evidence is collected ensures that evidence remains admissible in court and that its integrity is preserved. Without proper chain-of-custody, all subsequent analysis may be deemed inadmissible regardless of technical quality.

Why B is right

Pass the ticket is the attack method that best explains lateral movement using authenticated credentials in a Kerberos environment. This technique allows attackers who have obtained a valid Kerberos ticket to move laterally through the network by reusing that ticket for authentication to other systems, exactly matching the scenario described of moving laterally with authenticated credentials.

Why A is right

A security audit provides the most comprehensive understanding of a startup's overall security posture by systematically examining policies, procedures, controls, configurations, and compliance with standards across the organization. An audit evaluates the entire security program holistically, making it ideal for due diligence during an acquisition to identify strengths, weaknesses, and gaps in the security program.

Why D is right

The BEST way to prevent and correct software security weaknesses in COTS applications is to examine the software updating and patching process. This addresses the root cause by ensuring the organization understands how patches are delivered, tested, and deployed in their cloud environment. A robust patching process directly prevents and corrects security weaknesses. While a sandbox environment (B) provides testing capability, it does not inherently prevent or correct weaknesses; examining the patching process is the primary control that addresses both prevention and correction.

Why C is right

Taking photos of the damage at a disaster site before any items are removed, repaired, or replaced is a critical first step. This documentation preserves evidence, supports insurance claims, validates the disaster recovery plan, and provides a record for post-incident analysis.

Why B is right

Cross-Site Request Forgery (CSRF) occurs when an attacker sends a well-crafted malicious request to an authenticated user without their knowledge or realization. The attacker exploits the user's existing authenticated session to perform unwanted actions on their behalf against a target application.

Why A is right

A full interruption test (also called a cutover test) is the most comprehensive BC test because it actually shuts down production systems and switches to backup/recovery systems in a real operating scenario. This provides the most complete validation that business continuity plans actually work under realistic conditions.

Why C is right

Transport Layer Security (TLS) protocol provides encryption and authentication for VoIP communications, preventing man-in-the-middle attackers from intercepting, eavesdropping on, or altering VoIP traffic. TLS secures the signaling channel and ensures that communications are encrypted and authenticated between endpoints, directly mitigating MITM attacks.

Why B is right

Regardless of whether a SOC is built in-house, fully outsourced, or hybrid, the primary consideration must be scope and service catalog, defining what services the SOC will provide, what threats it will monitor, what incident response capabilities it will have, and what systems it will cover. This scope definition must be established first before evaluating any operational model. Headcount, skill sets, and tools are all dependent on first determining what the SOC's scope and service offerings will be.

Why C is right

High availability requires eliminating single points of failure through redundancy and failover capabilities. Multiple geographically dispersed web servers configured for failover ensures that if one server or location becomes unavailable, traffic automatically switches to another operational server, maintaining service availability. This approach provides both redundancy and geographic distribution for resilience.

Why C is right

Cross-Site Scripting (XSS) is the correct answer because it specifically involves injecting malicious scripts that execute in a user's browser when visiting a compromised website, allowing attackers to steal session cookies and other sensitive data. SQLi (A) targets databases, XML (B) attacks XML parsers, and CSRF (D) exploits authenticated sessions but doesn't necessarily involve script execution on compromised sites.

Why B is right

To accomplish both scheduled security posture analysis and continuous monitoring of core applications on personal cellular phones, strict integration of application management, configuration management, and phone management is required. This integrated approach enables centralized visibility, control, and monitoring across all three domains simultaneously, supporting both periodic assessments and real-time visibility.

Why A is right

Proxied federation is the identity model that best blinds identity providers and relying parties from each other by using an intermediary proxy. This prevents direct communication between the IdP and RP, ensuring that subscriber lists and sensitive relationship information are not disclosed between parties. The proxy acts as a trusted intermediary that decouples the parties, maintaining confidentiality of their identities and relationships.

Why D is right

For an organization providing only VoIP services, availability of network services is the MOST important SLA metric. VoIP is entirely dependent on network connectivity; any unavailability directly prevents the company from delivering its core product and generates immediate revenue loss. While other metrics matter, guaranteed service availability is the foundation that must be prioritized in the SLA negotiation.

Why C is right

For high-volume audit logs with a 3-month retention requirement, the optimal strategy balances accessibility with cost-efficiency. Online storage for recent logs (last week) ensures quick access for active monitoring and incident investigation, while near-line storage for older logs provides reasonable access times at lower cost than online storage. This tiered approach avoids the cost inefficiency of keeping all logs online while maintaining better accessibility than offline storage for compliance audits.

Why D is right

Data ownership best describes the legal responsibilities associated with data. Data owners hold accountability for ensuring data is properly managed, protected, classified, and used in compliance with organizational policies and legal requirements. This encompasses liability for data breaches, regulatory compliance, data quality, and decision-making authority over data use, making legal responsibility the defining characteristic of ownership.

Why D is right

Security assessments of mobile device brands would most likely occur during the development phase when the architecture and design are being evaluated, before deployment. Assessing security at this stage allows for vulnerabilities to be identified early and design changes to be made before implementation and operational deployment.

Why D is right

MAC (Mandatory Access Control) is based on security labels assigned to objects that represent their sensitivity level. Access decisions are enforced by the system based on comparing user clearances to object labels, allowing for granular control over what information can be accessed based on sensitivity classifications.

Why D is right

The key distinction of a stateful packet inspection (SPI) firewall is that it maintains awareness of connection states and inspects traffic within the context of established sessions. This allows it to understand whether packets belong to legitimate connections. Stateless packet filters examine each packet in isolation without context. Options A and C describe capabilities both types possess. Option B about TCP/UDP flags is superficial and doesn't capture the fundamental difference.

Why B is right

Session hijacking directly compromises data integrity during transmission by allowing an attacker to intercept, modify, and manipulate the communication session. The attacker can alter data in-flight, change transaction details, or inject malicious content. While packet sniffing can capture data, it is primarily a confidentiality threat and does not inherently modify data integrity in transit. Synchronization flooding and keylogging target availability and credential capture respectively, not transmission integrity.

Why C is right

To minimize financial risk, the manufacturing organization must quantify the potential impact before making the purchase decision. Calculating the possible revenue loss due to software bugs and vulnerabilities, then comparing it against the system's price, provides a concrete financial risk analysis that informs the purchase decision. This risk-benefit analysis is more comprehensive than testing alone and directly addresses the stated concern of high financial risk.

Why B is right

Peer-to-Peer (P2P) file sharing applications are considered high-risk because they enable direct sharing of files between users without centralized control or security inspection, providing a direct vector for malware and virus distribution. Users often unknowingly download infected files, and the decentralized nature makes it difficult to implement security controls.

Why D is right

Information Technology Asset Management (ITAM) maintains a comprehensive inventory of all devices on the network with their locations, configurations, and attributes. This enables security teams to quickly identify and locate infected devices by cross-referencing alerts with the asset database. While other options provide detection capabilities, ITAM is most effective for rapid device identification and location needed for quick remediation.

Why A is right

The SDN Controller is the component responsible for translating network requirements into actionable policies and forwarding rules that are then communicated to the datapath elements. It acts as the intelligence layer that interprets high-level network policies and converts them into low-level device configurations. While northbound interfaces facilitate communication between applications and the controller, the controller itself performs the actual translation of requirements.

Why A is right

Service Organization Control (SOC) 2 is the appropriate standard for assessing security, availability, and data protection of SaaS solutions across international boundaries. SOC 2 specifically addresses controls relevant to service providers and their handling of customer data, making it ideal for evaluating cloud-based service providers' security and privacy posture.

Why C is right

Defense-in-depth is a layered security approach using multiple overlapping controls to protect assets. The combination of physical barriers, card and PIN access systems, cameras, alarms, and security guards represents multiple defensive layers working together, if one fails, others remain active to prevent unauthorized access.

Why C is right

Customer identifiers should not resemble or be derived from government-issued ID numbers. Using government IDs or variants as identifiers increases the risk of identity theft, fraud, and regulatory compliance issues. Creating identifiers that are completely dissociated from government IDs (such as arbitrary alphanumeric strings) protects privacy, reduces fraud risk, and minimizes damage if the identifier is compromised. This approach separates sensitive PII from system identifiers.

Why D is right

A white-box penetration test is needed to simulate a former network administrator's attack because the administrator would have had full knowledge of the network infrastructure, systems, configurations, and security controls. White-box testing provides the penetration tester with complete information about the target systems (source code, architecture, credentials, system design), which mirrors the comprehensive knowledge a former administrator would possess, making it the appropriate methodology for this scenario.

Why D is right

Federated access enables seamless authentication across organizations through trust relationships, allowing users already authenticated in one system (the employee's company) to access resources at another organization (the travel service provider) without re-authentication. Federated identity management is the overarching framework that includes SSO functionality across organizational boundaries. While SAML and OAuth are protocols used in federation, 'federated access' is the comprehensive answer describing this cross-organizational seamless access pattern.

Why A is right

Developing clear evaluation criteria is the logical first step before executing any DR or BCP test. Without predetermined criteria for success, failure, and measurement, the test cannot be properly conducted, analyzed, or validated. Evaluation criteria establish the framework for the entire testing process.

Why D is right

Auditing and assessment is the BEST way to determine the success of a patch management process. Regular audits and assessments measure whether patches have been applied, systems are compliant, and vulnerabilities have been remediated. This provides objective evidence of process effectiveness and identifies gaps. While impact assessment (C) is part of the patching workflow, auditing and assessment is the overarching mechanism for evaluating overall process success.

Why C is right

Attribute-based access control (ABAC) uses encoded security-relevant properties (attributes) of subjects and objects to make access decisions. Attributes can include user role, department, resource classification, time of access, and other contextual properties. ABAC is the most flexible and granular approach, using sets of attributes to characterize both who is accessing and what is being accessed.

Why A is right

An effective information security strategy is primarily based on risk management practices, which identify, assess, and prioritize threats and vulnerabilities to determine where security controls should be implemented. Risk management provides the logical framework for all other security decisions, including budget allocation, control selection, and standards compliance.

Why C is right

The contract itself is the binding legal document that establishes vendor obligations. Updating the contract to obligate the vendor to provide security capabilities creates enforceable requirements with legal recourse, whereas SLAs typically address service levels and performance metrics rather than foundational security obligations.

Why A is right

After life safety, the protection of data and hardware represents the most critical priority in data center planning. The entire purpose of a data center is to store, process, and protect valuable organizational data and the infrastructure supporting it. Loss of data and hardware directly threatens business continuity and mission accomplishment.

Why D is right

Before deploying a security patch, the security practitioner must first evaluate it to assess compatibility, side effects, and whether it will actually mitigate the vulnerability as claimed. Deploying untested patches can cause system instability or operational disruption. Evaluation is a critical prerequisite step that must occur before any patch deployment decision.

Why A is right

Option A correctly describes how SDN supports cloud infrastructure by enabling high-level policy implementation to manage network traffic dynamically based on users, devices, and applications. This flexibility and programmability is essential for cloud environments where resources scale elastically and traffic patterns change rapidly. SDN's ability to apply policies without manual hardware reconfigurations makes it ideal for private cloud implementations.

Why B is right

Trust agreements establish formal contractual and policy-based relationships that define how organizations will handle and protect PII across the enterprise. These agreements specify obligations, responsibilities, and enforcement mechanisms for PII handling in compliance with regulations, which is essential for ABAC implementations involving multiple parties and systems.