Free CISSP Practice Questions

Q1.A startup's board requires the security team to reduce a high-rated insider threat risk. The security team's options include implementing DLP software ($120,000 annually), purchasing insider threat insurance ($40,000 annually), or formally accepting the risk. The ALE for the insider threat is $60,000. What is the most defensible recommendation?

• A.Transfer the risk through $40,000 insurance because it costs less than ALE and satisfies the board's requirement to reduce risk
• B.Implement DLP controls because technical controls always provide more durable protection than insurance transfer
• C.Accept the risk because ALE is low enough to be within normal operating loss expectations
• D.Implement DLP controls and purchase insurance simultaneously to achieve maximum risk reduction

Domain: Security and Risk Management

Q2.A red team discovers that a web server's service account has unconstrained Kerberos delegation enabled. The red team compromises the web server and extracts TGTs for every user who has authenticated to that server in the past hour. They then use these TGTs to access the organization's internal file server and email system as those users. What is the specific Active Directory misconfiguration that enabled this attack?

• A.Unconstrained Kerberos delegation on the service account, which causes user TGTs to be forwarded to and cached on the delegating host, where they can be extracted and replayed
• B.Constrained Kerberos delegation misconfiguration that inadvertently allows the service to delegate to all services rather than only the specified allowed services
• C.Missing SPN registration on the service account, which forces the system to fall back to NTLM authentication and expose password hashes instead of Kerberos tickets
• D.AdminSDHolder ACL misconfiguration that allowed the service account to modify the protected users group and grant itself delegation rights

Domain: Identity and Access Management

Q3.A national electric utility performs a security review of its energy management system (EMS). The security consultant recommends implementing an air gap between the EMS and the corporate network. The utility argues that a full air gap prevents necessary remote diagnostics. Which approach BEST balances the operational requirement for remote access with the security requirement to minimize IT/OT connectivity?

• A.A data diode combined with a DMZ-hosted jump server, allowing one-way data flow from OT to IT and restricting remote access to a controlled authenticated session boundary
• B.A site-to-site VPN between the corporate network and the OT network, encrypted with AES-256-GCM to prevent eavesdropping on diagnostic traffic
• C.SNMP read-only polling from the IT network directly to OT devices, because read-only access cannot be used to modify PLC configurations
• D.TLS-encrypted sessions between IT and OT networks, because encryption eliminates the confidentiality risk of direct IT/OT connectivity

Domain: Security Architecture and Engineering

Q4.A vulnerability scanner reports 200 vulnerabilities. A security analyst sorts by CVSS Base Score and begins remediating from the top. A week later the most critical vulnerability — a 9.8 in a server with no internet exposure on an isolated research network — has been remediated first, while a 7.2 in an internet-facing authentication system remains open. A senior analyst challenges this prioritization approach. What is the core limitation of relying solely on CVSS Base Score for prioritization?

• A.CVSS Base Scores measure intrinsic vulnerability severity independent of deployment context; they do not account for asset exposure, criticality, or compensating controls in the actual environment
• B.CVSS Base Scores are inaccurate for server vulnerabilities because the scoring formula was designed for workstation and endpoint environments
• C.CVSS scores are only reliable for the first 30 days after publication because vendors update scores as new exploit code is released
• D.Sorting by CVSS Base Score is the correct primary approach; the senior analyst is wrong to challenge a recognized industry standard

Domain: Security Assessment and Testing

Q5.A sophisticated threat actor compromised a widely used build tool in the software supply chain of a major security vendor. The attacker modified the build tool so that during the compilation process it injected malicious code into the vendor's software binaries. The resulting trojanized software was digitally signed with the vendor's legitimate certificate and distributed to thousands of customers. This attack pattern is an example of which supply chain attack type?

• A.Build pipeline poisoning, in which the build toolchain itself is compromised to inject malicious code into artifacts before they are signed and distributed
• B.Dependency confusion, in which an attacker publishes a higher-versioned package under a name that shadows an internal package, causing the build system to fetch the malicious public package
• C.Package registry compromise, in which the attacker gains administrative access to the package registry and replaces legitimate published packages with malicious versions
• D.Typosquatting, in which the attacker registers a package with a name visually similar to a popular library to trick developers into accidentally importing the malicious package

Domain: Software Development Security

Q6.A security architect is evaluating whether to place a WAF, a NGFW, and a stateful inspection firewall in a three-tier web application architecture. The WAF must protect the web tier from application attacks, the NGFW must perform application-layer inspection between tiers, and the stateful firewall must handle perimeter filtering. Which placement order from internet to internal is correct?

• A.Stateful inspection firewall at the perimeter, WAF protecting the web tier in the DMZ, NGFW between the DMZ and the application tier
• B.WAF at the internet perimeter, stateful firewall between the DMZ and web servers, NGFW protecting the internal database tier
• C.NGFW at the internet perimeter replacing both the WAF and stateful firewall, with the WAF only deployed internally between application tiers
• D.Stateful firewall at the perimeter, NGFW in the DMZ protecting the web servers, WAF between the application and database tiers

Domain: Communication and Network Security

Q7.An organization implements DRM on all intellectual property documents shared with contract manufacturers in three countries. Six months later, a contract manufacturer reports that documents become permanently inaccessible after 90 days even when the contract is still active. The DRM administrator reviews the policy and finds the expiration was set globally. What does this scenario highlight about DRM policy governance?

• A.DRM expiration policies must be aligned to the specific lifecycle requirements of each document type and recipient relationship, not applied globally without business process analysis
• B.The DRM platform has a software defect that incorrectly applies expiration dates to documents distributed to international recipients
• C.Contract manufacturers in foreign countries require separate DRM licensing agreements that override the organization's global policy settings
• D.The administrator failed to provision the contract manufacturers correctly, and re-provisioning their accounts will reset the expiration timers

Domain: Asset Security

Q8.A multinational e-commerce company transfers EU customer order histories to a data analytics firm based in a country with no EU adequacy decision. The legal team suggests using Binding Corporate Rules (BCRs) instead of Standard Contractual Clauses because the analytics firm is not part of the same corporate group. What is the most accurate legal guidance?

• A.Standard Contractual Clauses are the correct mechanism because BCRs are only available for intra-group transfers within a corporate family
• B.BCRs are acceptable here because they provide stronger protections than Standard Contractual Clauses for any transfer
• C.Neither mechanism is valid; the transfer must stop immediately until an adequacy decision is issued
• D.The company may self-certify the adequacy of the recipient country's protections to authorize the transfer

Domain: Security and Risk Management

Q9.A security analyst receives three concurrent alerts. Alert A: single failed SSH login from an external IP on a non-critical server. Alert B: the same source IP attempting authentication across 40 systems in 30 minutes. Alert C: successful admin login from that IP outside business hours on a domain controller. Which TWO actions are MOST immediately required based on NIST SP 800-61 triage principles? (Select TWO)

• A.Escalate Alert C to the incident response team immediately due to a confirmed privileged access event on a domain controller
• B.Block the source IP at the perimeter to contain the active brute-force campaign identified in Alert B
• C.Document Alert A in the ticketing system and close it as a low-severity event pending further context
• D.Wait for management approval before taking any containment action on the domain controller login event in Alert C
• E.Reassign all three alerts to tier-2 analysts without initial triage because the events may be related and require senior analysis

Domain: Security Operations

Q10.An organization's current password policy requires 8-character passwords with uppercase, lowercase, number, and symbol requirements, and mandates a 90-day expiration. A security architect proposes updating the policy to align with NIST SP 800-63B. Which changes should the updated policy include?

• A.Remove mandatory 90-day expiration and require password changes only when compromise evidence exists
• B.Screen new passwords against known breached credential databases and reject passwords found in breach lists
• C.Increase the minimum password length requirement while removing mandatory character complexity composition rules
• D.Add a requirement for at least two special characters and one uppercase letter to compensate for removing the expiration policy
• E.Implement a password history requirement of at least 24 previous passwords to prevent rotation cycling

Domain: Identity and Access Management