8140.study

CISSP practice questions

By 8140.study · Published 2026-09-15 · Last updated 2026-09-15

Ten practice questions for the ISC2 CISSP exam, spread across all eight domains. Several test the manager mindset the CISSP rewards, where process, accountability, and risk come before the technical fix.

These are original questions written by 8140.study to help you practice. They are not real exam questions. For every exam detail and renewal rule, see our CISSP certification page.

  1. Question 1 · Security and risk management

    Who is ultimately accountable for the protection of an organization’s information assets?

    1. A.The chief information security officer
    2. B.Senior management
    3. C.The data custodians
    4. D.The IT administrators
    Show answer

    Answer: B. Senior management

    Senior management holds ultimate accountability for protecting the organization’s assets. Security leaders, custodians, and administrators carry out responsibilities that are delegated to them, but accountability itself cannot be delegated.

  2. Question 2 · Security and risk management

    Before expanding into a new country, an organization researches the privacy laws and regulations it will be subject to there. Which concept does this research best demonstrate?

    1. A.Due care
    2. B.Due diligence
    3. C.Separation of duties
    4. D.Least privilege
    Show answer

    Answer: B. Due diligence

    Due diligence is the investigation and research that identifies obligations and risks. Due care is acting on that knowledge, for example by putting the required controls in place. The research comes first, so this is due diligence.

  3. Question 3 · Asset security

    Who is responsible for assigning a classification level to a data set?

    1. A.The data custodian
    2. B.The data owner
    3. C.The data user
    4. D.The auditor
    Show answer

    Answer: B. The data owner

    The data owner decides how data is classified and who may access it. The custodian implements and maintains the protections the owner specifies, such as backups and access controls, but does not set the classification.

  4. Question 4 · Security architecture and engineering

    Which security model is focused on confidentiality and enforces the rules no read up and no write down?

    1. A.Biba
    2. B.Clark-Wilson
    3. C.Bell-LaPadula
    4. D.Brewer-Nash
    Show answer

    Answer: C. Bell-LaPadula

    Bell-LaPadula protects confidentiality by stopping subjects from reading data above their clearance or writing data down to a lower level. Biba is the integrity model and reverses those rules. Clark-Wilson enforces integrity through well-formed transactions, and Brewer-Nash prevents conflicts of interest.

  5. Question 5 · Communication and network security

    Two offices need a site-to-site connection that provides confidentiality, integrity, and authentication for all traffic at the network layer. Which option fits best?

    1. A.IPsec using Encapsulating Security Payload (ESP)
    2. B.IPsec using Authentication Header (AH) only
    3. C.TLS on each web application
    4. D.SNMPv3
    Show answer

    Answer: A. IPsec using Encapsulating Security Payload (ESP)

    IPsec operates at the network layer, and ESP provides confidentiality as well as integrity and authentication. AH alone authenticates and protects integrity but does not encrypt. TLS protects individual application sessions rather than all traffic between the sites.

  6. Question 6 · Identity and access management (IAM)

    An employee moved from finance to marketing a year ago and still has full access to the finance systems. Which problem does this describe, and what control best addresses it?

    1. A.Privilege creep, addressed by periodic access reviews
    2. B.A separation of duties violation, addressed by encryption
    3. C.Account sharing, addressed by stronger passwords
    4. D.Excessive least privilege, addressed by single sign-on
    Show answer

    Answer: A. Privilege creep, addressed by periodic access reviews

    Privilege creep happens when access granted for an old role is never removed as people change jobs. Periodic access reviews, with managers recertifying who needs what, catch and remove the leftover access. Encryption, stronger passwords, and single sign-on do not remove permissions a user should no longer have.

  7. Question 7 · Security assessment and testing

    Before an external penetration test begins, what must the tester obtain first?

    1. A.A complete vulnerability scan of the target network
    2. B.Written authorization from someone with authority over the systems
    3. C.Administrator credentials for the target systems
    4. D.The source code of the applications in scope
    Show answer

    Answer: B. Written authorization from someone with authority over the systems

    Testing without written permission can be illegal, no matter how well intentioned. Written authorization, together with an agreed scope and rules of engagement, must be in place before any testing starts. Scans, credentials, and source code may or may not be part of the test, but none of them come first.

  8. Question 8 · Security operations

    A fire breaks out in the data center during business hours. What is the first priority?

    1. A.Protect the backup media
    2. B.Shut down the servers gracefully
    3. C.Ensure everyone gets out safely
    4. D.Notify customers of a possible outage
    Show answer

    Answer: C. Ensure everyone gets out safely

    Human safety always comes first on the CISSP, ahead of data, systems, or business continuity. Equipment and data can be replaced or recovered, people cannot.

  9. Question 9 · Security operations

    A recovery site has hardware and network connectivity in place, but current data must be restored from backups before operations can resume. Which type of site is this?

    1. A.Hot site
    2. B.Warm site
    3. C.Cold site
    4. D.Mirrored site
    Show answer

    Answer: B. Warm site

    A warm site has equipment and connectivity ready but needs data restored and some setup before it can take over. A hot site is fully configured with current data and can take over very quickly, and a cold site offers little more than space and power.

  10. Question 10 · Software development security

    At which stage of the software development life cycle is it least expensive to address a security flaw?

    1. A.Requirements and design
    2. B.Testing
    3. C.Deployment
    4. D.Operations and maintenance
    Show answer

    Answer: A. Requirements and design

    The cost of fixing a flaw rises the later it is found, because more work has to be redone. Building security into requirements and design avoids the flaw altogether, while a flaw found in production can mean emergency patches, rework, and possible breach costs.

Want more than ten? The first module of our CISSP course, Security and Risk Management, is free.