50 Free CISSP Practice Questions — All 8 Domains
Preparing for the CISSP certification? These 50 free practice questions cover all eight domains of the CISSP Common Body of Knowledge (CBK).
Domain 1: Security and Risk Management (Questions 1–8)
Question 1
What is the primary difference between qualitative and quantitative risk analysis?
a) Qualitative uses numerical values; quantitative uses subjective rankings
b) Quantitative uses numerical values; qualitative uses subjective rankings
c) Both use the same methodology
d) Qualitative is always more accurate
Show Answer
Answer: b) Quantitative uses numerical values; qualitative uses subjective rankings
Explanation: Quantitative risk analysis assigns numerical values (dollar amounts, percentages) to risk components. Qualitative uses subjective rankings (High, Medium, Low). Both approaches complement each other.
Question 2
Which of the following is the correct order of the risk management process?
a) Identify → Analyze → Evaluate → Treat → Monitor
b) Treat → Identify → Analyze → Evaluate → Monitor
c) Analyze → Identify → Evaluate → Treat → Monitor
d) Identify → Treat → Analyze → Evaluate → Monitor
Show Answer
Answer: a) Identify → Analyze → Evaluate → Treat → Monitor
Explanation: The risk management process follows: Identify risks → Analyze risks (determine likelihood/impact) → Evaluate risks (compare to criteria) → Treat risks (select response) → Monitor and review.
Question 3
In the ISC2 Code of Ethics, which canon takes precedence over all others?
a) Protect society, the common good, necessary public trust and confidence, and the infrastructure
b) Act honorably, honestly, justly, responsibly, and legally
c) Provide diligent and competent service to principles
d) Advance and protect the profession
Show Answer
Answer: a) Protect society, the common good, necessary public trust and confidence, and the infrastructure
Explanation: The first canon (protect society) takes highest precedence. The four canons in order: 1) Protect society, 2) Act honorably, 3) Provide diligent service, 4) Advance the profession.
Question 4
What is the definition of a vulnerability?
a) A potential danger that could exploit a weakness
b) A weakness in a system that could be exploited
c) The likelihood that a threat will exploit a weakness
d) The impact of a security incident
Show Answer
Answer: b) A weakness in a system that could be exploited
Explanation: A vulnerability is a weakness in a system, design, or process. A threat is a potential danger that could exploit a vulnerability. Risk is the likelihood × impact of exploitation.
Question 5
Which of the following is an example of risk avoidance?
a) Purchasing cyber insurance
b) Implementing firewalls and encryption
c) Deciding not to implement a new system due to identified risks
d) Accepting the risk and continuing operations
Show Answer
Answer: c) Deciding not to implement a new system due to identified risks
Explanation: Risk avoidance eliminates the risk by choosing not to engage in the risky activity. Insurance is risk transfer, controls are risk mitigation, and acceptance is acknowledging the risk.
Question 6
What does due care mean in a security context?
a) Implementing the most expensive security solutions
b) Taking reasonable steps to protect assets and prevent harm
c) Following every security regulation to the letter
d) Outsourcing security to a third party
Show Answer
Answer: b) Taking reasonable steps to protect assets and prevent harm
Explanation: Due care means exercising reasonable caution and taking appropriate security measures that a prudent organization would take. Failure to exercise due care can lead to legal liability.
Question 7
What is the primary purpose of a Business Impact Analysis (BIA)?
a) Calculating the cost of security controls
b) Identifying critical business functions and their recovery priorities
c) Testing disaster recovery procedures
d) Auditing financial records
Show Answer
Answer: b) Identifying critical business functions and their recovery priorities
Explanation: A BIA identifies critical business processes, determines their RTO/RPO requirements, and establishes recovery priorities. It's a prerequisite for BCP and DRP development.
Question 8
Which of the following is an example of a privacy law?
a) PCI DSS
b) GDPR
c) ISO 27001
d) NIST SP 800-53
Show Answer
Answer: b) GDPR
Explanation: The General Data Protection Regulation (GDPR) is a European privacy law. PCI DSS is for payment card security, ISO 27001 is a management standard, and NIST 800-53 is a US government security controls catalog.
Domain 2: Asset Security (Questions 9–13)
Question 9
Which of the following is the correct order of the data lifecycle?
a) Create → Store → Use → Share → Archive → Destroy
b) Store → Create → Use → Share → Destroy → Archive
c) Create → Use → Store → Share → Destroy → Archive
d) Store → Use → Create → Share → Archive → Destroy
Show Answer
Answer: a) Create → Store → Use → Share → Archive → Destroy
Explanation: The data lifecycle: Create (data is generated) → Store (saved) → Use (processed) → Share (distributed) → Archive (long-term retention) → Destroy (secure disposal).
Question 10
Who is ultimately responsible for classifying data?
a) Data custodian
b) Data owner
c) Data user
d) System administrator
Show Answer
Answer: b) Data owner
Explanation: The data owner (usually a senior manager) is accountable for data classification. The data custodian (IT/admin) implements the controls. Data users follow policies.
Question 11
Which data destruction method is most appropriate for TOP SECRET paper documents?
a) Recycling bin
b) Cross-cut shredding or incineration
c) Tearing in half
d) Trash disposal
Show Answer
Answer: b) Cross-cut shredding or incineration
Explanation: Sensitive documents require cross-cut shredding (not strip-cut which can be reassembled) or incineration. The level of destruction should match the classification level.
Question 12
What is data remanence?
a) The process of backing up data
b) Residual data remaining on media after deletion
c) The speed of data transfer
d) Data stored in memory
Show Answer
Answer: b) Residual data remaining on media after deletion
Explanation: Data remanence is the residual representation of data that remains after attempts to erase it. Countermeasures include overwriting, degaussing, and physical destruction.
Question 13
Which data classification label would you apply to public marketing materials?
a) Restricted
b) Confidential
c) Public
d) Internal
Show Answer
Answer: c) Public
Explanation: Public classification is for information that can be freely disclosed without causing harm. Marketing materials, press releases, and public reports typically fall under this classification.
Domain 3: Security Architecture and Engineering (Questions 14–19)
Question 14
Which security model enforces the * property (no write-down)?
a) Bell-LaPadula
b) Biba
c) Clark-Wilson
d) Brewer-Nash
Show Answer
Answer: a) Bell-LaPadula
Explanation: Bell-LaPadula enforces confidentiality with two properties: SS (no read-up) and * (no write-down). Biba enforces integrity with no read-down and no write-up.
Question 15
Which encryption algorithm is currently recommended for symmetric encryption?
a) DES
b) 3DES
c) AES-256
d) RC4
Show Answer
Answer: c) AES-256
Explanation: AES-256 is the current standard for symmetric encryption. DES and 3DES are deprecated due to small key sizes. RC4 is broken.
Question 16
What is the difference between a TPM and an HSM?
a) TPM is a hardware chip on the motherboard; HSM is a removable/networked device
b) TPM is faster than HSM
c) HSM is a chip on the motherboard; TPM is removable
d) There is no difference
Show Answer
Answer: a) TPM is a hardware chip on the motherboard; HSM is a removable/networked device
Explanation: TPM (Trusted Platform Module) is a chip soldered to the motherboard for platform integrity. HSM (Hardware Security Module) is a dedicated device for cryptographic operations, often removable or network-attached.
Question 17
What is the reference monitor concept?
a) A physical security guard
b) An access control concept that mediates all access between subjects and objects
c) A monitoring tool for network traffic
d) A security policy document
Show Answer
Answer: b) An access control concept that mediates all access between subjects and objects
Explanation: The reference monitor is a concept where all access decisions are mediated through a secure control point. The security kernel is its implementation in the OS.
Question 18
Which ring is the most privileged in the x86 protection ring model?
a) Ring 0
b) Ring 1
c) Ring 2
d) Ring 3
Show Answer
Answer: a) Ring 0
Explanation: Ring 0 (kernel mode) is the most privileged, where the OS kernel and device drivers run. Ring 3 (user mode) is the least privileged, where applications run.
Question 19
What is the primary purpose of a mantrap in physical security?
a) Detecting metal objects
b) Preventing tailgating by requiring authentication before entering
c) Recording video footage
d) Detecting fire
Show Answer
Answer: b) Preventing tailgating by requiring authentication before entering
Explanation: A mantrap uses two interlocking doors — one must close before the other opens — preventing unauthorized individuals from following authorized personnel through a secured entrance.
Domain 4: Communication and Network Security (Questions 20–24)
Question 20
Which OSI layer is responsible for routing and forwarding?
a) Layer 2 — Data Link
b) Layer 3 — Network
c) Layer 4 — Transport
d) Layer 7 — Application
Show Answer
Answer: b) Layer 3 — Network
Explanation: The Network layer (Layer 3) is responsible for logical addressing (IP addresses), routing packets between networks, and path determination.
Question 21
Which protocol provides secure remote terminal access?
a) Telnet
b) SSH
c) FTP
d) HTTP
Show Answer
Answer: b) SSH
Explanation: SSH (Secure Shell) provides encrypted remote terminal access and file transfer. Telnet is unencrypted and should be avoided.
Question 22
What is a VLAN?
a) A virtual private network
b) A logical network segment on a physical switch
c) A load balancing technique
d) A firewall rule
Show Answer
Answer: b) A logical network segment on a physical switch
Explanation: VLANs (Virtual Local Area Networks) create logically separate networks on the same physical switch, isolating traffic and improving security.
Question 23
What is the difference between IDS and IPS?
a) IDS detects and blocks; IPS only detects
b) IDS detects and alerts; IPS detects and blocks
c) IDS is network-based; IPS is host-based
d) There is no difference
Show Answer
Answer: b) IDS detects and alerts; IPS detects and blocks
Explanation: IDS (Intrusion Detection System) monitors and alerts. IPS (Intrusion Prevention System) detects, alerts, and actively blocks threats inline.
Question 24
Which protocol provides encryption for email transmission?
a) SMTP
b) SMTPS (SMTP over TLS)
c) POP3
d) IMAP
Show Answer
Answer: b) SMTPS (SMTP over TLS)
Explanation: SMTPS uses TLS encryption to secure email transmission. Unencrypted SMTP sends emails in plaintext.
Domain 5: Identity and Access Management (Questions 25–30)
Question 25
Which authentication protocol uses tickets and is commonly used in Windows domains?
a) LDAP
b) Kerberos
c) RADIUS
d) SAML
Show Answer
Answer: b) Kerberos
Explanation: Kerberos uses a ticket-based system with a Key Distribution Center (KDC). It's the default authentication protocol in Active Directory and provides mutual authentication.
Question 26
Which access control model uses security labels and clearances?
a) Discretionary Access Control (DAC)
b) Mandatory Access Control (MAC)
c) Role-Based Access Control (RBAC)
d) Attribute-Based Access Control (ABAC)
Show Answer
Answer: b) Mandatory Access Control (MAC)
Explanation: MAC uses labels (Top Secret, Secret, Confidential) assigned to subjects and objects. Access decisions are based on comparing labels, and users cannot override them.
Question 27
What is a key difference between SAML and OAuth?
a) SAML is for authentication; OAuth is primarily for authorization
b) SAML is for authorization; OAuth is for authentication
c) They are the same protocol
d) SAML is newer than OAuth
Show Answer
Answer: a) SAML is for authentication; OAuth is primarily for authorization
Explanation: SAML (Security Assertion Markup Language) handles authentication (who you are). OAuth 2.0 handles authorization (what you can access). OpenID Connect sits on top of OAuth 2.0 for authentication.
Question 28
What is privilege creep?
a) Gaining unauthorized privileges through hacking
b) Accumulation of excessive permissions over time as roles change
c) A type of privilege escalation attack
d) Granting temporary elevated privileges
Show Answer
Answer: b) Accumulation of excessive permissions over time as roles change
Explanation: Privilege creep occurs when employees accumulate permissions as they change roles or take on new responsibilities, but old permissions are never removed.
Question 29
Which authentication factor is a hardware token?
a) Something you know
b) Something you have
c) Something you are
d) Something you do
Show Answer
Answer: b) Something you have
Explanation: "Something you have" factors include physical devices: hardware tokens, smart cards, mobile phones (for SMS or authenticator apps).
Question 30
What is the purpose of session management in IAM?
a) Creating user accounts
b) Managing user sessions after authentication (timeout, termination)
c) Encrypting passwords
d) Auditing logs
Show Answer
Answer: b) Managing user sessions after authentication (timeout, termination)
Explanation: Session management controls user sessions after login: session timeout, idle timeout, concurrent session limits, and forced termination when no longer needed.
Domain 6: Security Assessment and Testing (Questions 31–35)
Question 31
What is the difference between vulnerability scanning and penetration testing?
a) Vulnerability scanning identifies potential vulnerabilities; penetration testing exploits them
b) Penetration testing identifies vulnerabilities; vulnerability scanning exploits them
c) They are the same
d) Vulnerability scanning is manual; penetration testing is automated
Show Answer
Answer: a) Vulnerability scanning identifies potential vulnerabilities; penetration testing exploits them
Explanation: Vulnerability scanning is automated identification of known vulnerabilities. Penetration testing actively attempts to exploit vulnerabilities to determine real-world impact.
Question 32
What is a black box penetration test?
a) The tester has full knowledge of the system
b) The tester has no prior knowledge of the system
c) The tester has partial knowledge
d) The testing is done automatically
Show Answer
Answer: b) The tester has no prior knowledge of the system
Explanation: Black box testing simulates an external attacker with zero knowledge. White box provides full knowledge. Gray box provides partial knowledge.
Question 33
Which testing method analyzes source code without executing it?
a) DAST (Dynamic Application Security Testing)
b) SAST (Static Application Security Testing)
c) IAST (Interactive Application Security Testing)
d) RASP (Runtime Application Self-Protection)
Show Answer
Answer: b) SAST (Static Application Security Testing)
Explanation: SAST analyzes source code, bytecode, or binaries without executing the application. It finds vulnerabilities early in the SDLC (shift-left).
Question 34
What is the order of volatility in digital forensics?
a) Data that exists on the hardest drive
b) The sequence in which evidence should be collected based on how quickly it can change
c) The priority of files to examine
d) The importance of evidence
Show Answer
Answer: b) The sequence in which evidence should be collected based on how quickly it can change
Explanation: Order of volatility prioritizes collecting the most volatile data first (CPU registers → RAM → network connections → swap → disk). Volatile data disappears quickly if power is lost.
Question 35
What is the purpose of a chain of custody?
a) Tracking evidence handling from collection to court presentation
b) Database management
c) Network monitoring
d) Incident response plan
Show Answer
Answer: a) Tracking evidence handling from collection to court presentation
Explanation: Chain of custody documents who collected, handled, transferred, and stored evidence at all times. It ensures evidence integrity and admissibility in legal proceedings.
Domain 7: Security Operations (Questions 36–44)
Question 36
What is the first phase of the NIST incident response lifecycle?
a) Detection
b) Preparation
c) Containment
d) Recovery
Show Answer
Answer: b) Preparation
Explanation: The NIST SP 800-61 incident response lifecycle is: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.
Question 37
Which backup method copies only data changed since the last full backup?
a) Full backup
b) Incremental backup
c) Differential backup
d) Snapshot
Show Answer
Answer: b) Incremental backup
Explanation: Incremental backups copy only data changed since the last backup (full or incremental). Differential backups copy data changed since the last full backup.
Question 38
What is a cold site in disaster recovery?
a) A fully operational redundant data center
b) A backup facility with power, cooling, and cabling but no equipment
c) A partially configured backup facility
d) A cloud-based recovery solution
Show Answer
Answer: b) A backup facility with power, cooling, and cabling but no equipment
Explanation: A cold site has basic infrastructure (power, cooling, space) but no servers or networking. It requires the longest time to become operational (days to weeks).
Question 39
What is the purpose of a SIEM system?
a) Managing user accounts
b) Aggregating and analyzing security logs from multiple sources
c) Encrypting network traffic
d) Blocking malware
Show Answer
Answer: b) Aggregating and analyzing security logs from multiple sources
Explanation: SIEM collects, normalizes, correlates, and analyzes security data from multiple sources (firewalls, servers, IDS, applications) to detect and respond to incidents.
Question 40
What is the 3-2-1 backup rule?
a) 3 copies, 2 different media types, 1 offsite
b) 3 copies, 2 locations, 1 day
c) 3 backups, 2 servers, 1 tape
d) 3 different formats, 2 types of encryption, 1 test
Show Answer
Answer: a) 3 copies, 2 different media types, 1 offsite
Explanation: The 3-2-1 rule: Keep 3 copies of data, on 2 different storage media types, with 1 copy stored offsite to protect against site-level disasters.
Question 41
What is the difference between RTO and RPO?
a) RTO is recovery time; RPO is data loss tolerance
b) RTO is data loss; RPO is recovery time
c) They are the same
d) RTO is for databases; RPO is for files
Show Answer
Answer: a) RTO is recovery time; RPO is data loss tolerance
Explanation: RTO (Recovery Time Objective) is the maximum acceptable downtime. RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time (e.g., 1 hour of lost data).
Question 42
Which of the following is a detective control?
a) Firewall
b) Security awareness training
c) CCTV cameras
d) Backup generator
Show Answer
Answer: c) CCTV cameras
Explanation: Detective controls detect and alert on security events after they occur. CCTV, IDS, and log monitoring are detective. Firewalls are preventive; training is administrative; generators are corrective.
Question 43
Which type of forensics analysis focuses on network traffic?
a) Disk forensics
b) Network forensics
c) Memory forensics
d) Mobile forensics
Show Answer
Answer: b) Network forensics
Explanation: Network forensics captures and analyzes network traffic (packet captures, netflow logs, firewall logs) to investigate security incidents.
Question 44
What is a playbook in incident response?
a) A training manual for new employees
b) A step-by-step guide for handling specific types of incidents
c) A list of network devices
d) A security policy document
Show Answer
Answer: b) A step-by-step guide for handling specific types of incidents
Explanation: Playbooks document standardized procedures for responding to specific incident types (ransomware, phishing, DDoS) ensuring consistent, effective response.
Domain 8: Software Development Security (Questions 45–50)
Question 45
Which SDLC model delivers features in fixed-length iterations?
a) Waterfall
b) Agile (Scrum)
c) Spiral
d) V-Model
Show Answer
Answer: b) Agile (Scrum)
Explanation: Scrum delivers working software in fixed-length iterations called Sprints (typically 2 weeks). Each Sprint produces a potentially releasable increment.
Question 46
What is SQL injection?
a) Injecting malicious SQL statements through input fields
b) A configuration error in SQL databases
c) A type of denial of service attack
d) A network attack
Show Answer
Answer: a) Injecting malicious SQL statements through input fields
Explanation: SQL injection inserts malicious SQL code into input fields to manipulate database queries. Prevention: parameterized queries, prepared statements, input validation.
Question 47
What is the OWASP Top 10?
a) A list of the top 10 web application security risks
b) A programming language ranking
c) A network security framework
d) A database security standard
Show Answer
Answer: a) A list of the top 10 web application security risks
Explanation: The OWASP Top 10 is an awareness document listing the most critical web application security risks (broken access control, cryptographic failures, injection, etc.).
Question 48
What is the purpose of a database activity monitor (DAM)?
a) Monitoring database performance
b) Monitoring and auditing database access and activities
c) Managing database users
d) Backing up databases
Show Answer
Answer: b) Monitoring and auditing database access and activities
Explanation: DAM monitors database activity in real-time, detecting unauthorized access, SQL injection, or policy violations. It provides audit trails and alerts.
Question 49
Which environment should match production as closely as possible for testing?
a) Development
b) Staging
c) Test
d) Integration
Show Answer
Answer: b) Staging
Explanation: The staging environment should mirror production (configuration, data scale, infrastructure) to identify environment-specific issues before deployment.
Question 50
What is DevSecOps?
a) A separate security team that reviews code
b) Integrating security practices into the DevOps pipeline
c) A security tool
d) A programming methodology
Show Answer
Answer: b) Integrating security practices into the DevOps pipeline
Explanation: DevSecOps (shift-left security) integrates automated security testing (SAST, DAST, dependency scanning) into the CI/CD pipeline, making security a shared responsibility.
How Did You Score?
- 0–25 correct: Review the CISSP Exam Guide.
- 26–40 correct: Good foundation. Focus on weak domains.
- 41–50 correct: Ready for the exam!
Access all CISSP practice questions →
Related Articles
Bereit, dein Wissen zu testen?
Probiere unsere Übungsprüfungen mit Hunderten von realistischen Fragen aus.
Üben starten →