logo

CISSP Practice Exam: Free Online Sample Questions

Get Ready for the CISSP Exam with a Free Online Quiz

The CISSP is a globally recognized certification granted by the International Information System Security Certification Consortium, also known as (ISC)². This certification has become a prerequisite for many careers in information security. The CISSP covers eight broad domains, so it’s no surprise that preparing to take it can be a stressful and time-consuming experience.

To help you assess your readiness, we’ve developed a set of CISSP test questions and assembled them into a free online test exam. These CISSP sample questions cover key concepts in each of eight domains included in the CISSP exam:

  • Security and Risk Management
  • Asset Security
  • Security Engineering
  • Communications and Network Security
  • Identity and Access Management
  • Security and Assessment Testing
  • Security Operations
  • Software Development Security

After you answer each question, you’ll see the correct answer and the reasoning behind it, so you can improve your knowledge and be better prepared to answer the actual CISSP exam questions.

Taking this CISSP practice exam is a great opportunity to identify any knowledge gaps you have in each domain so you can refine your study strategy and show up on test day ready to answer the real CISSP exam questions with confidence.

Domain 1. Security and Risk Management

This section covers confidentiality, integrity, and availability concepts, security governance principles, compliance, legal and regulatory issues, professional ethic, security policies, standards, procedures and guidelines.

1 / 3

You are a security consultant. A large enterprise customer hires you to ensure that their security operations are following industry standard control frameworks. For this project, the customer wants you to focus on technology solutions that will discourage malicious activities. Which type of control framework should you focus on?

2 / 3

You are performing a risk analysis for an internet service provider (ISP) that has thousands of customers on its broadband network. Over the past 5 years, some customers have been compromised or experienced data breaches. The ISP has a large amount of monitoring and log data for all customers. You need to figure out the chances of additional customers experiencing a security incident based on that data. Which type of approach should you use for the risk analysis?

3 / 3

You are working on a business continuity project for a company that generates a large amount of content each day for use in social networks. Your team establishes 4 hours as the maximum tolerable data loss in a disaster recovery or business continuity event. In which part of the business continuity plan should you document this?

Your score is

Domain 2. Asset Security

When we think about assets, some people consider only physical assets, such as buildings, land and computers. But asset security for the CISSP exam focuses on virtual assets such as intellectual property and data.

1 / 3

You are performing a security audit for a customer. During the audit, you find several instances of users gaining access to data without going through a formal access approval process. As part of the remediation, you recommend establishing a formal access approval process. Which role should you list to approve policies that dictate which users can gain access to data?

2 / 3

Your organization has a goal to maximize the protection of organizational data. You need to recommend 3 methods to minimize data remanence in the organization. Which 3 of the following methods should you recommend?

3 / 3

You are preparing to build a hybrid cloud environment for your organization. Three vendors present their proposed solution. Which methodology should your team use to select the best solution?

Your score is

Domain 3. Security Engineering

This domain is more technical than some of the others. If you already work in a security engineering role, then you have an advantage in this domain. If you don’t, allocate extra time to be sure you have a firm understanding of the topics. Note that some of the concepts in this domain are foundational in nature, so you’ll find aspects of them throughout the other domains.

1 / 3

You are a security consultant tasked with reviewing a company’s security model. The current model has the following characteristics:
- It establishes confidentiality such that people cannot read access classified at a higher level than their clearance.
- It forbids users with a specific clearance from writing data to a document with a lower clearance level.
You note that the current model does not account for somebody with a low clearance level from writing data to a document classified at a higher level than their clearance. You need to implement a model to mitigate this. Which of the following security tenets should the new model focus on?

2 / 3

You are documenting the attempted attacks on your organization’s IT systems. The top type of attack was injection attacks. Which definition should you use to describe an injection attack?

3 / 3

You are designing a public key infrastructure for your organization. The organization has issued the following requirements for the PKI:
- Maximize security of the PKI architecture
- Maximize the flexibility of the PKI architecture
You need to choose a PKI design to meet the requirements. Which design should you choose?

Your score is

Domain 4. Communications and Network Security

Networking can be one of the most complex topics on the CISSP exam. If you are lucky enough to have a network background, then you won’t find this domain difficult. However, if your background doesn’t have much networking, spend extra time in this section and consider diving deep into topics that still don’t make sense after you go through this section.

1 / 3

You are troubleshooting some anomalies with network communication on your network. You notice that some communication isn’t taking the expected or most efficient route to the destination. Which layer of the OSI model you should troubleshoot?

2 / 3

A wireless network has a single access point and two clients. One client is on the south side of the building toward the edge of the network. The other client is on the north side of the building, also toward the edge of the network. The clients are too far from each other to see each other. In this scenario, which technology can be used to avoid collisions?

3 / 3

Your company uses VoIP for internal telephone calls. You are deploying a new intrusion detection system and need to capture traffic related to internal telephone calls only. Which protocol should you capture?

Your score is

Domain 5. Identity and Access Management

This section covers technologies and concepts related to authentication and authorization, for example, usernames, passwords and directories. While it isn’t a huge domain, it is technical and there are many important details related to the design and implementation of the technologies.

1 / 3

You are implementing a multi-factor authentication solution. As part of the design, you are capturing the three authentication factors. What are they?

2 / 3

Your company is rapidly expanding its public cloud footprint, especially with Infrastructure as a Service (IaaS), and wants to update its authentication solution to enable users to be authenticated to services in the cloud that are yet to be specified. The company issues the following requirements:
- Minimize the infrastructure required for the authentication.
- Rapidly deploy the solution.
- Minimize the overhead of managing the solution.
You need to choose the authentication solution for the company. Which solution should you choose?

3 / 3

A user reports that they cannot gain access to a shared folder. You investigate and find the following information:
- Neither the user nor any groups the user is a member of have been granted permissions to the folder.
- Other users and groups have been granted permissions to the folder.
- Another IT person on your team reports that he updated the permissions on the folder recently.
Based on the information in this scenario, which type of access control is in use?

Your score is

Domain 6. Security Assessment and Testing

This section covers assessments and audits, along with all the technologies and techniques you will be expected to know to perform them.

1 / 3

Your company recently implemented a pre-release version of a new email application. The company wants to perform testing against the application and has issued the following requirements:
- Testers must test all aspects of the email application.
- Testers must not have any knowledge of the new e-mail environment.
Which type of testing should you use to meet the company requirements?

2 / 3

You are working with your company to validate assessment and audit strategies. The immediate goal is to ensure that all auditors are following the processes and procedures defined by the company's audit policies. Which type of audit should you use for this scenario?

3 / 3

Your company is planning to perform some security control testing. The following requirements have been established:
- The team must try to bypass controls in the systems.
- The team can use technical methods or non-technical methods in attempting to bypass controls.
Which type of testing should you perform to meet the requirements?

Your score is

Domain 7. Security Operations

This domain is focused on the day-to-day tasks of securing your environment. If you are in a role outside of operations (such as in engineering or architecture), you should spend extra time in this section to ensure familiarity with the information. You’ll notice more “hands on” sections in this domain, specifically focused on how to do things instead of the design or planning considerations found in previous domains.

1 / 3

You are conducting an analysis of a compromised computer. You figure out that the computer had all known security patches applied prior to the computer being compromised. Which two of the following statements are probably true about this incident?

2 / 3

You are investigating poor performance of a company’s telephone system. The company uses IP-based phones and reports that in some scenarios, such as when there is heavy use, the call quality drops and there are sometimes lags or muffling. You need to maximize the performance of the telephone system. Which technology should you use?

3 / 3

You are preparing your company for disaster recovery. The company issues the following requirements for disaster recovery testing:
- The company must have the ability to restore and recover to an alternate data center.
- Restore and recovery operations must not impact your data center.
- IT teams must perform recovery steps during testing.
Which type of recovery should you use to meet the company’s requirements?

Your score is

Domain 8. Software Development Security

This domain focuses on managing the risk and security of software development. Security should be a focus of the development lifecycle, and not an add-on or afterthought to the process. The development methodology and lifecycle can have a big effect on how security is thought of and implemented in your organization. The methodology also ties into the environment that the software is being developed for. Organizations should ensure that access to code repositories is limited to protect their investment in software development. Access and protection should be audited on a regular basis. You must also take into consideration the process of acquiring a development lifecycle, whether from another company, or picking up a development project that is already in progress.

1 / 3

You are a software development manager starting a new development project. You want to focus the development process around user stories. The development process must be efficient and have multiple iterations as changes and requirements are discovered. Which development methodology should you use?

2 / 3

You are in the early stages of the development lifecycle and creating design requirements. The application will contain several forms that allow users to enter information to be saved in a database. The forms should require users to submit up to 200 alphanumeric characters, but should prevent certain strings. What should you perform on the text fields?

3 / 3

You plan on creating an artificial intelligence application that is based on constraints and an end goal. What generation language should you use for the development process?

Your score is

We hope our free practice questions have helped you on your way toward getting your CISSP certification.

If you’re still worried you won’t ace the test, check out the seven tips from Matt Middleton-Leal, a CISSP-certified pro, for how to pass the CISSP exam on your first attempt. And don’t forget to explore other resources: take a look at our list of top 10 study guides and training materials for CISSP certification. But is CISSP worth it? Take a look at the list of benefits that the CISSP credential has brought to three cybersecurity experts

Feel free to share your feedback and suggestions in the comments section below. Best wishes on the exam!

Please note: Passing these practice exams does not guarantee success in passing the actual CISSP certification exam, which contains 100-150 questions and takes 3 hours, but it should give you a good indication of your readiness to take that exam.

Ryan Brooks
Product Evangelist at Netwrix Corporation, writer, and presenter. Ryan specializes in evangelizing cybersecurity and promoting the importance of visibility into IT changes and data access. As an author, Ryan focuses on IT security trends, surveys, and industry insights.
More great reading
Featured tags
Active Directory CISSP Cyber attack Data classification Data governance Data security GDPR Insider threat IT compliance IT security Office 365 Risk assessment SharePoint Windows Server
...