CISSP Practice Questions: 20 Exam-Style Examples With Answers and Explanations (2026)

Most CISSP practice questions you find free online test whether you remember a definition. The real exam rarely does. It gives you a plausible scenario, four defensible options, and asks which one a security manager would choose first. That gap is why experienced engineers walk out of a three-hour computerised adaptive test having failed a body of knowledge they genuinely know.

The twenty CISSP practice questions below are written in that style. Each one carries a full explanation of why the correct answer wins and, more usefully, why the tempting wrong answer is tempting. Work through them with a pen and no clock, then read every explanation, including the ones you got right.

How These CISSP Practice Questions Are Weighted

The CISSP exam uses Computerised Adaptive Testing. You will see between 100 and 150 items in a maximum of three hours, and you need 700 out of 1000 points to pass. The current exam outline took effect on 15 April 2024 and is still the outline in force for 2026, so the domain split below is the one your exam will follow.

Exam Tip: Because the exam is adaptive, there is no fixed number of questions per domain and no way to skip ahead or go back. Every item is scored as you answer it, so a rushed guess in the first twenty minutes costs you as much as one in the last.

How to Use These CISSP Practice Questions

Answer the question before you look at the options where you can. If your instinct matches one of the four, that option is more likely to be the distractor than the answer, because the exam writers build distractors from what a technical practitioner would say by reflex.

Then apply three filters to the remaining options:

1. Read the qualifier. BEST, FIRST, MOST and PRIMARY change the answer. Two options can both be correct with only one being first.
2. Ask who you are in the scenario. The CISSP assumes you are advising or managing, not configuring. Policy and process usually beat a technical fix.
3. Discount options that solve a different problem. A control that is genuinely good practice but does not address the stated risk is the most common trap in the whole exam.

Domain 1: Security and Risk Management (16%)

Question 1. A risk assessment identifies an unpatchable vulnerability in a legacy billing application. The application cannot be retired for eighteen months and the business wants to keep it running. Who has the authority to formally accept this risk?

A. The information security manager B. The system administrator who maintains the application C. Senior management D. The internal audit function

Answer: C. Risk acceptance is a business decision and sits with senior management, who carry ultimate accountability for the organisation. Security recommends and quantifies, audit assesses independently, and the administrator implements. Option A catches out candidates from technical security roles who assume that because they own the risk register, they own the risk.

Question 2. Following a ransomware incident, an organisation determines that it can tolerate losing at most fifteen minutes of transaction data. Which metric does the fifteen minutes describe?

A. Recovery Time Objective (RTO) B. Recovery Point Objective (RPO) C. Maximum Tolerable Downtime (MTD) D. Work Recovery Time (WRT)

Answer: B. RPO measures backwards from the incident and defines acceptable data loss, which drives backup frequency. RTO measures forwards and defines how quickly the service must be restored. MTD is the total outage the business survives, and RTO plus WRT must fit inside it.

Question 3. An organisation thoroughly researches the privacy laws that apply to it and documents a control framework, but never implements the controls. Which has it demonstrated?

A. Due care but not due diligence B. Due diligence but not due care C. Both due care and due diligence D. Neither

Answer: B. Due diligence is the investigation, the work of finding out what is required. Due care is acting on it, the prudent person actually doing the thing. Research without implementation is diligence without care, and it is the position that most often loses a negligence claim.

Domain 2: Asset Security (10%)

Question 4. Who is responsible for assigning a classification level to a newly created dataset?

A. The data custodian B. The data owner C. The data processor D. The security administrator

Answer: B. The data owner understands the business value and sensitivity of the information and therefore sets the classification. The custodian implements the protections the classification demands, such as backups and access lists, but has no authority to decide what the label should be.

Question 5. An organisation is decommissioning a batch of solid-state drives that contained confidential data. The drives are still under warranty and will be resold. Which method BEST ensures the data cannot be recovered?

A. Degaussing B. A single-pass overwrite of every addressable block C. Cryptographic erasure of the drive encryption key D. Physical shredding

Answer: C. Degaussing does nothing to flash memory, which stores no magnetic domains. Overwriting is unreliable on SSDs because wear levelling and over-provisioning keep spare blocks the operating system cannot address. Shredding works but destroys the resale value the scenario explicitly requires, which makes it the wrong answer to this question rather than a bad practice.

Domain 3: Security Architecture and Engineering (13%)

Question 6. A multilevel secure system must prevent a user holding Secret clearance from writing information into a file labelled Unclassified. Which property enforces this?

A. The Bell-LaPadula simple security property B. The Bell-LaPadula star property C. The Biba simple integrity axiom D. The Biba star integrity axiom

Answer: B. The requirement protects confidentiality, so the model is Bell-LaPadula, which rules out both Biba options immediately. The star property is no write down, preventing classified content leaking into a lower label. The simple security property is no read up, which is a different control.

Question 7. What is the primary function of a Trusted Platform Module in a full-disk encryption deployment?

A. To encrypt and decrypt bulk disk data at line rate B. To store the volume key and release it only when boot measurements match known values C. To maintain a tamper-evident audit log of file access D. To generate one-time passwords for pre-boot authentication

Answer: B. The TPM seals the key against platform configuration register values taken during boot, so a tampered bootloader or a drive moved to another machine will not unseal it. Option A is the reflex answer for hardware crypto, but a TPM is far too slow for bulk encryption. The CPU handles that with AES-NI.

Question 8. An attacker repeatedly measures how long a smart card takes to complete RSA operations and uses the variance to recover bits of the private key. Which attack is this?

A. Fault injection B. Differential power analysis C. A timing attack D. A known-plaintext attack

Answer: C. Timing attacks are side-channel attacks that exploit the implementation rather than the algorithm, so the underlying maths of RSA remains sound. Differential power analysis is the closely related side channel that measures current draw instead of elapsed time. The countermeasure for both is constant-time implementation with blinding.

Domain 4: Communication and Network Security (13%)

Question 9. An attacker sends frames carrying two 802.1Q tags in order to reach a VLAN they are not assigned to. Which control BEST prevents this?

A. Enabling DHCP snooping on access ports B. Disabling DTP and moving the native VLAN to a dedicated, unused VLAN C. Enabling port security to limit MAC addresses per port D. Enabling BPDU guard on access ports

Answer: B. Double tagging works because the first switch strips the outer tag when the frame belongs to the native VLAN, then forwards the frame carrying the attacker's inner tag. Taking the native VLAN out of use removes the mechanism. The other three options are all sound hardening for different attacks, which is exactly why they are here.

Question 10. Two branch office firewalls establish a permanent tunnel across the public internet. The design requires that the original source and destination IP addresses are hidden from anyone observing the traffic. Which configuration meets this?

A. AH in transport mode B. AH in tunnel mode C. ESP in transport mode D. ESP in tunnel mode

Answer: D. Authentication Header provides integrity and authentication but no confidentiality, so neither AH option can hide anything. Transport mode leaves the original IP header exposed. Only ESP in tunnel mode encrypts the entire original packet and wraps it in a new outer header.

Question 11. Which change in WPA3-Personal most directly addresses the weakness that allowed attackers to capture a WPA2 handshake and crack the passphrase offline?

A. Replacing AES with ChaCha20 B. Replacing the pre-shared key handshake with Simultaneous Authentication of Equals C. Requiring a RADIUS server for personal mode D. Increasing the maximum passphrase length

Answer: B. SAE is a password-authenticated key exchange, so a captured handshake yields nothing an attacker can grind against a wordlist offline. It also provides forward secrecy, meaning a later passphrase compromise does not decrypt previously captured traffic. Option C describes enterprise mode, not personal.

Domain 5: Identity and Access Management (13%)

Question 12. An organisation is comparing two biometric systems for a general office deployment. Which single metric BEST indicates overall accuracy for that comparison?

A. False Acceptance Rate B. False Rejection Rate C. Crossover Error Rate D. Average enrolment time

Answer: C. The Crossover Error Rate is the point where FAR and FRR meet, so a lower CER means a fundamentally more accurate sensor. Note the qualifier though. CER compares systems, but once you deploy into a high-security area you deliberately tune FAR down and accept a higher FRR, because a wrongly admitted intruder costs more than an inconvenienced employee.

Question 13. In a SAML 2.0 single sign-on exchange, which party generates the assertion that vouches for the user's identity?

A. The service provider B. The identity provider C. The relying party D. The principal

Answer: B. The identity provider authenticates the user and issues the signed assertion. The service provider, also called the relying party, consumes that assertion and makes an access decision. The principal is the user themselves, who is the subject of the assertion rather than its author.

Question 14. A hospital grants system permissions according to job title, so every nurse assigned to cardiology automatically receives the cardiology nursing permission set. Which access control model is in use?

A. Discretionary access control B. Mandatory access control C. Role-based access control D. Attribute-based access control

Answer: C. Permissions attach to the role and users inherit them by holding the role, which is the defining characteristic of RBAC and the reason it scales in large organisations. Option D is the strongest distractor, but ABAC evaluates attributes such as time of day, device posture or location at the moment of the request, and nothing in the scenario describes that.

Domain 6: Security Assessment and Testing (12%)

Question 15. An organisation needs independent assurance that a cloud provider's security controls were not only designed appropriately but operated effectively across a six-month window. Which report should it request?

A. SOC 1 Type I B. SOC 2 Type I C. SOC 2 Type II D. SOC 3

Answer: C. Type I reports on the design of controls at a single point in time. Type II tests operating effectiveness over a period, which is what the six-month window demands. SOC 1 covers controls relevant to financial reporting rather than security, and SOC 3 is a public summary with none of the detail an assessor needs.

Question 16. Management wants to know whether an attacker could chain several known findings together to reach the cardholder data environment. Which activity is MOST appropriate?

A. An authenticated vulnerability scan B. A penetration test C. A secure code review D. A compliance audit

Answer: B. A scan enumerates weaknesses individually and reports them without proving any of them are reachable or chainable in your environment. A penetration test demonstrates exploitability and the path an attacker would take. The question asks about chaining and reachability, which only a test can answer.

Domain 7: Security Operations (13%)

Question 17. Investigators arrive at a compromised server that is still powered on and connected to the network. What should they do FIRST?

A. Create a forensic image of the hard disk B. Capture the contents of volatile memory C. Contact law enforcement D. Interview the system administrator

Answer: B. The order of volatility dictates that the most transient evidence is collected first, and memory holds running processes, network connections, injected code and encryption keys that vanish the moment power is lost. Imaging the disk is essential, but the disk is still there in an hour. RAM is not.

Question 18. Which administrative control is MOST likely to reveal fraud committed by a privileged administrator whose scheme depends on their continuous presence to conceal it?

A. Separation of duties B. Least privilege C. Mandatory vacation D. Dual control

Answer: C. Mandatory vacation is a detective control precisely because it forces the individual away from the system while someone else performs their duties, at which point ongoing concealment breaks down. Separation of duties, least privilege and dual control are all preventive. Read the qualifier: the question asks what reveals fraud, not what stops it.

Domain 8: Software Development Security (10%)

Question 19. At which point in the software development lifecycle is it MOST cost-effective to address a security requirement?

A. Requirements and design B. Implementation C. Testing D. After release, through a patch

Answer: A. Defects found in requirements and design cost a fraction of what the same defect costs once it is embedded in shipped code, and an architectural flaw such as a missing trust boundary often cannot be patched at all without a rewrite. This is the reasoning behind threat modelling during design rather than penetration testing at the end.

Question 20. An application verifies that a user is authorised to open a file, then opens the file a fraction of a second later. In that window an attacker replaces the file with a symbolic link to a privileged file. Which vulnerability class is this?

A. Buffer overflow B. Time of check to time of use race condition C. SQL injection D. DLL hijacking

Answer: B. TOCTOU exploits the gap between validating a condition and acting on it, and file paths are the classic target because a name can be re-pointed between the two operations. The mitigation is to make the check and the use atomic, typically by operating on a file handle obtained once rather than re-resolving the path.

What These CISSP Practice Questions Reveal About the Exam

Look back at the ones you missed and check which of these three patterns caught you.

You answered as an engineer. Questions 1 and 19 both punish the technical instinct. The exam expects you to think about accountability, cost and process before configuration. Very few security professionals work across all eight domains day to day, so most candidates arrive with three or four domains they are studying from scratch and one or two where their hands-on habits actively mislead them. That combination, rather than any single knowledge gap, is what sends most retakes back for a second attempt.

You ignored the qualifier. Question 18 has four legitimate controls and only one detective control. Question 5 has two methods that genuinely destroy data and only one that respects the stated constraint. Underline the qualifier before you read the options.

You picked a good control for the wrong problem. Question 9 lists three excellent hardening measures alongside the one that addresses double tagging. Distractors are rarely wrong in isolation. They are wrong here.

If you found Domain 1 harder than the technical domains, that is the expected result for most candidates and it deserves attention, because at 16% it is the heaviest domain on the exam. Our CISSP difficulty breakdown goes deeper into where candidates lose points, and the 12-week CISSP study plan sequences the domains so the governance material gets studied properly rather than skimmed at the end.

Exam Tip: Twenty questions is a diagnostic, not preparation. Candidates who pass typically work through several thousand practice questions and, more importantly, read the explanation on every single one. The explanation is where the learning happens, not the score.

Frequently Asked Questions

Is the CISSP exam hard?

It is hard in a specific way. The individual facts are rarely obscure, but the exam presents scenarios where several options are defensible and asks for the best or first action from a manager's perspective. Candidates with deep technical backgrounds often find Domain 1 and Domain 6 harder than the network and architecture domains, because those domains reward governance thinking rather than hands-on instinct.

What are the common practice questions asked in the CISSP exam?

The exam does not reuse public questions, and any site claiming to sell real ones is selling a braindump that will get your certification revoked. What repeats is the question shape: a short scenario, a qualifier such as BEST or FIRST, and four options where two or three are plausible. Risk ownership, order of volatility, the difference between due care and due diligence, and choosing between preventive and detective controls all appear in some form on nearly every candidate's exam.

Can I pass CISSP in 30 days?

Only if you already have most of the five years of required experience across several domains and can commit to full-time study. For a candidate with a narrow technical background, thirty days is not enough to build competence in the three or four domains they have never worked in. Twelve weeks is a far more realistic target for most working professionals.

What is the best practice exam for the CISSP certification?

The best practice exam is the one whose explanations teach you the reasoning, not the one with the largest question count or the one that flatters your score. Look for questions that are scenario-based, weighted to the current domain split, and explained in a way that tells you why each distractor is wrong. A bank of 2,000 definition-recall questions will not prepare you for an adaptive exam built on judgement.

How many questions are on the CISSP exam?

The English CAT exam delivers between 100 and 150 items within a maximum of three hours, and the passing standard is 700 out of 1000 points. Because the test is adaptive, it ends as soon as it can determine with statistical confidence that you are above or below the standard, which is why finishing at 100 questions tells you nothing about whether you passed.

Ready to Start Practising?

Twenty questions will show you where your gaps are. Closing them takes volume, and it takes questions written to the current outline with explanations that argue the reasoning rather than assert the answer.

CertCrush's CISSP practice questions and study materials cover all eight domains at the April 2024 weightings, with a full explanation on every item and domain-level scoring so you can see exactly which areas are dragging your average down.

Create a free account and start practising today.