Get Ready for the CISSP Exam with a Free Online Quiz
The CISSP is a globally recognized certification granted by the International Information System Security Certification Consortium, also known as (ISC)². This certification has become a prerequisite for many careers in information security. The CISSP covers eight broad domains, so it’s no surprise that preparing to take it can be a stressful and time-consuming experience.
To help you assess your readiness, we’ve developed a set of CISSP test questions and assembled them into a free online test exam. These CISSP sample questions cover key concepts in each of eight domains included in the CISSP exam:
- Security and Risk Management
- Asset Security
- Security Engineering
- Communications and Network Security
- Identity and Access Management
- Security and Assessment Testing
- Security Operations
- Software Development Security
After you answer each question, you’ll see the correct answer and the reasoning behind it, so you can improve your knowledge and be better prepared to answer the actual CISSP exam questions.
Taking this CISSP practice exam is a great opportunity to identify any knowledge gaps you have in each domain so you can refine your study strategy and show up on test day ready to answer the real CISSP exam questions with confidence.
Domain 1. Security and Risk Management
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
This section covers confidentiality, integrity, and availability concepts, security governance principles, compliance, legal and regulatory issues, professional ethic, security policies, standards, procedures and guidelines.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
You are a security consultant. A large enterprise customer hires you to ensure that their security operations are following industry standard control frameworks. For this project, the customer wants you to focus on technology solutions that will discourage malicious activities. Which type of control framework should you focus on?
Correct
Explanation: Deterrent frameworks are technology-related and used to discourage malicious activities. For
example, an intrusion prevention system or a firewall would be appropriate in this framework.
There are three other primary control frameworks. A preventative framework helps establish security policies and
security awareness training. A detective framework is focused on finding unauthorized activity in your environment
after a security incident. A corrective framework focuses on activities to get your environment back after a security
incident. There isn’t an assessment framework.Incorrect
Explanation: Deterrent frameworks are technology-related and used to discourage malicious activities. For
example, an intrusion prevention system or a firewall would be appropriate in this framework.
There are three other primary control frameworks. A preventative framework helps establish security policies and
security awareness training. A detective framework is focused on finding unauthorized activity in your environment
after a security incident. A corrective framework focuses on activities to get your environment back after a security
incident. There isn’t an assessment framework. -
Question 2 of 3
2. Question
You are performing a risk analysis for an internet service provider (ISP) that has thousands of customers on its broadband network. Over the past 5 years, some customers have been compromised or experienced data breaches. The ISP has a large amount of monitoring and log data for all customers. You need to figure out the chances of additional customers experiencing a security incident based on that data. Which type of approach should you use for the risk analysis?
Correct
Explanation: You have three risk analysis methods to choose from: qualitative (which uses a risk analysis matrix), quantitative (which uses money or metrics to compute), or hybrid (a combination of qualitative and quantitative but not an answer choice in this scenario). Because the ISP has monitoring and log data, you should use a quantitative approach; it will help quantify the chances of additional customers experiencing a security risk.
STRIDE is used for threat modeling. A market approach is used for asset valuation. A reduction analysis attempts to eliminate duplicate analysis and is tied to threat modeling.Incorrect
Explanation: You have three risk analysis methods to choose from: qualitative (which uses a risk analysis matrix), quantitative (which uses money or metrics to compute), or hybrid (a combination of qualitative and quantitative but not an answer choice in this scenario). Because the ISP has monitoring and log data, you should use a quantitative approach; it will help quantify the chances of additional customers experiencing a security risk.
STRIDE is used for threat modeling. A market approach is used for asset valuation. A reduction analysis attempts to eliminate duplicate analysis and is tied to threat modeling. -
Question 3 of 3
3. Question
You are working on a business continuity project for a company that generates a large amount of content each day for use in social networks. Your team establishes 4 hours as the maximum tolerable data loss in a disaster recovery or business continuity event. In which part of the business continuity plan should you document this?
Correct
Explanation: The RTO establishes the maximum amount of time the organization will be down (or how long it takes to recover), the RPO establishes the maximum data loss that is tolerable, the MTD covers the maximum tolerable downtime, and MDT is just a made-up phrase used as a distraction. In this scenario, with the focus on the data loss, the correct answer is RPO.
Incorrect
Explanation: The RTO establishes the maximum amount of time the organization will be down (or how long it takes to recover), the RPO establishes the maximum data loss that is tolerable, the MTD covers the maximum tolerable downtime, and MDT is just a made-up phrase used as a distraction. In this scenario, with the focus on the data loss, the correct answer is RPO.
Domain 2. Asset Security
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
When we think about assets, some people consider only physical assets, such as buildings, land and computers. But asset security for the CISSP exam focuses on virtual assets such as intellectual property and data.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
You are performing a security audit for a customer. During the audit, you find several instances of users gaining access to data without going through a formal access approval process. As part of the remediation, you recommend establishing a formal access approval process. Which role should you list to approve policies that dictate which users can gain access to data?
Correct
Explanation: Each data owner is responsible for approving access to data that they own. This is typically handled via approving data access policies that are then implemented by the operations team. As part of a formal access approval process, a data owner should be the ultimate person responsible for the data access.
Incorrect
Explanation: Each data owner is responsible for approving access to data that they own. This is typically handled via approving data access policies that are then implemented by the operations team. As part of a formal access approval process, a data owner should be the ultimate person responsible for the data access.
-
Question 2 of 3
2. Question
Your organization has a goal to maximize the protection of organizational data. You need to recommend 3 methods to minimize data remanence in the organization. Which 3 of the following methods should you recommend?
Correct
Explanation: When you perform a typical operating system deletion, the data remains on the media but the space on the media is marked as available. Thus, the data is often recoverable. There are 3 established methods for preventing data recovery: overwriting the data (sometimes referred to as a “secure deletion” or “wiping”), degaussing with magnets and physical destruction.
Formatting a volume does not render data unrecoverable, and neither does data encryption (if somebody had the decryption key, the data is at risk).Incorrect
Explanation: When you perform a typical operating system deletion, the data remains on the media but the space on the media is marked as available. Thus, the data is often recoverable. There are 3 established methods for preventing data recovery: overwriting the data (sometimes referred to as a “secure deletion” or “wiping”), degaussing with magnets and physical destruction.
Formatting a volume does not render data unrecoverable, and neither does data encryption (if somebody had the decryption key, the data is at risk). -
Question 3 of 3
3. Question
You are preparing to build a hybrid cloud environment for your organization. Three vendors present their proposed solution. Which methodology should your team use to select the best solution?
Correct
Explanation: In this scenario, your goal is to evaluate the solutions presented, not the vendors, so you should use a standards selection process. This will enable the team to select the solution that best fits the organization’s needs. While a vendor selection process is part of engaging with a vendor, this scenario specifically calls for the evaluation of the solutions.
Incorrect
Explanation: In this scenario, your goal is to evaluate the solutions presented, not the vendors, so you should use a standards selection process. This will enable the team to select the solution that best fits the organization’s needs. While a vendor selection process is part of engaging with a vendor, this scenario specifically calls for the evaluation of the solutions.
Domain 3. Security Engineering
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
This domain is more technical than some of the others. If you already work in a security engineering role, then you have an advantage in this domain. If you don’t, allocate extra time to be sure you have a firm understanding of the topics. Note that some of the concepts in this domain are foundational in nature, so you’ll find aspects of them throughout the other domains.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
You are a security consultant tasked with reviewing a company’s security model. The current model has the following characteristics:
– It establishes confidentiality such that people cannot read access classified at a higher level than their clearance.
– It forbids users with a specific clearance from writing data to a document with a lower clearance level.
You note that the current model does not account for somebody with a low clearance level from writing data to a document classified at a higher level than their clearance. You need to implement a model to mitigate this. Which of the following security tenets should the new model focus on?Correct
Explanation: In this scenario, the existing model focused on confidentiality. To round out the model and meet the goal of preventing “write up,” you need to supplement the existing model with a model that focuses on integrity (such as Biba). Focusing on integrity will ensure that you don’t have “write up” (or “read down” either, although that wasn’t a requirement in this scenario).
Incorrect
Explanation: In this scenario, the existing model focused on confidentiality. To round out the model and meet the goal of preventing “write up,” you need to supplement the existing model with a model that focuses on integrity (such as Biba). Focusing on integrity will ensure that you don’t have “write up” (or “read down” either, although that wasn’t a requirement in this scenario).
-
Question 2 of 3
2. Question
You are documenting the attempted attacks on your organization’s IT systems. The top type of attack was injection attacks. Which definition should you use to describe an injection attack?
Correct
Explanation: An injection attack provides invalid input to an application or web page. The goal is to craft that input so that a backend interpreter either performs an action not intended by the organization (such as running administrative commands) or crashes. Injection attacks are mature and routinely used, so it is important to be aware of them and how to protect against them.
Incorrect
Explanation: An injection attack provides invalid input to an application or web page. The goal is to craft that input so that a backend interpreter either performs an action not intended by the organization (such as running administrative commands) or crashes. Injection attacks are mature and routinely used, so it is important to be aware of them and how to protect against them.
-
Question 3 of 3
3. Question
You are designing a public key infrastructure for your organization. The organization has issued the following requirements for the PKI:
– Maximize security of the PKI architecture
– Maximize the flexibility of the PKI architecture
You need to choose a PKI design to meet the requirements. Which design should you choose?Correct
Explanation: When designing a PKI, keep in mind the basic security tenets — the more tiers, the more security, and the more flexibility. Of course, having more tiers also means more cost and complexity. In this scenario, to maximize security and flexibility, you need to use a three-tier hierarchy with the root CAs and the policy CAs being offline. Offline CAs enhance security. Multiple tiers, especially with the use of policy CAs, enhance flexibility because you can revoke one section of the hierarchy without impacting the other (for example, if one of the issuing CAs had a key compromised).
Incorrect
Explanation: When designing a PKI, keep in mind the basic security tenets — the more tiers, the more security, and the more flexibility. Of course, having more tiers also means more cost and complexity. In this scenario, to maximize security and flexibility, you need to use a three-tier hierarchy with the root CAs and the policy CAs being offline. Offline CAs enhance security. Multiple tiers, especially with the use of policy CAs, enhance flexibility because you can revoke one section of the hierarchy without impacting the other (for example, if one of the issuing CAs had a key compromised).
Domain 4. Communications and Network Security
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
Networking can be one of the most complex topics on the CISSP exam. If you are lucky enough to have a network background, then you won’t find this domain difficult. However, if your background doesn’t have much networking, spend extra time in this section and consider diving deep into topics that still don’t make sense after you go through this section.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
You are troubleshooting some anomalies with network communication on your network. You notice that some communication isn’t taking the expected or most efficient route to the destination. Which layer of the OSI model you should troubleshoot?
Correct
Explanation: In this scenario, the information indicates that the issue is with the routing of the network communication. Routing occurs at Layer 3 of the OSI model. Layer 3 is typically handled by a router or the routing component of a network device.
Incorrect
Explanation: In this scenario, the information indicates that the issue is with the routing of the network communication. Routing occurs at Layer 3 of the OSI model. Layer 3 is typically handled by a router or the routing component of a network device.
-
Question 2 of 3
2. Question
A wireless network has a single access point and two clients. One client is on the south side of the building toward the edge of the network. The other client is on the north side of the building, also toward the edge of the network. The clients are too far from each other to see each other. In this scenario, which technology can be used to avoid collisions?
Correct
Explanation: In this scenario, collision avoidance is used. Wireless networks use collision avoidance specifically to address the issue described in the scenario (which is known as the “hidden node problem”).
Incorrect
Explanation: In this scenario, collision avoidance is used. Wireless networks use collision avoidance specifically to address the issue described in the scenario (which is known as the “hidden node problem”).
-
Question 3 of 3
3. Question
Your company uses VoIP for internal telephone calls. You are deploying a new intrusion detection system and need to capture traffic related to internal telephone calls only. Which protocol should you capture?
Correct
Explanation: SIP is a communications protocol used for multimedia communication such as internal voice calls. In this scenario, you need to capture SIP traffic to ensure that you are only capturing traffic related to the phone calls.
Incorrect
Explanation: SIP is a communications protocol used for multimedia communication such as internal voice calls. In this scenario, you need to capture SIP traffic to ensure that you are only capturing traffic related to the phone calls.
Domain 5. Identity and Access Management
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
This section covers technologies and concepts related to authentication and authorization, for example, usernames, passwords and directories. While it isn’t a huge domain, it is technical and there are many important details related to the design and implementation of the technologies.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
You are implementing a multi-factor authentication solution. As part of the design, you are capturing the three authentication factors. What are they?
Correct
Explanation: The three factors are something you know (such as a password), something you have (such as a smartcard or authentication app), and something you are (such as a fingerprint or retina). Using methods from multiple factors for authentication enhances security and mitigates the risk of a stolen or cracked password.
Incorrect
Explanation: The three factors are something you know (such as a password), something you have (such as a smartcard or authentication app), and something you are (such as a fingerprint or retina). Using methods from multiple factors for authentication enhances security and mitigates the risk of a stolen or cracked password.
-
Question 2 of 3
2. Question
Your company is rapidly expanding its public cloud footprint, especially with Infrastructure as a Service (IaaS), and wants to update its authentication solution to enable users to be authenticated to services in the cloud that are yet to be specified. The company issues the following requirements:
– Minimize the infrastructure required for the authentication.
– Rapidly deploy the solution.
– Minimize the overhead of managing the solution.
You need to choose the authentication solution for the company. Which solution should you choose?Correct
Explanation: With the rapid expansion to the cloud and the type of services in the cloud unknown, a cloud-based identity service, especially one from your public cloud vendor, is the best choice. Such services are compatible with IaaS, SaaS and PaaS solutions. While a third-party identity service can handle SaaS, it will not be as capable in non-SaaS scenarios. A federated identity solution is also limited to certain authentication scenarios and requires more time to deploy and more work to manage.
Incorrect
Explanation: With the rapid expansion to the cloud and the type of services in the cloud unknown, a cloud-based identity service, especially one from your public cloud vendor, is the best choice. Such services are compatible with IaaS, SaaS and PaaS solutions. While a third-party identity service can handle SaaS, it will not be as capable in non-SaaS scenarios. A federated identity solution is also limited to certain authentication scenarios and requires more time to deploy and more work to manage.
-
Question 3 of 3
3. Question
A user reports that they cannot gain access to a shared folder. You investigate and find the following information:
– Neither the user nor any groups the user is a member of have been granted permissions to the folder.
– Other users and groups have been granted permissions to the folder.
– Another IT person on your team reports that he updated the permissions on the folder recently.
Based on the information in this scenario, which type of access control is in use?Correct
Explanation: Because you found individual users being granted permissions, and an IT administrator had manually changes permissions on the folder, DAC is in use. RBAC uses roles, and rule-based access control relies on rules and user attributes, so you would not find individual users configured with permissions on the folder with either of these. MAC is based on clearance levels, so, again, users aren’t individually granted permissions on a folder; instead, a group for each clearance is used.
Incorrect
Explanation: Because you found individual users being granted permissions, and an IT administrator had manually changes permissions on the folder, DAC is in use. RBAC uses roles, and rule-based access control relies on rules and user attributes, so you would not find individual users configured with permissions on the folder with either of these. MAC is based on clearance levels, so, again, users aren’t individually granted permissions on a folder; instead, a group for each clearance is used.
Domain 6. Security Assessment and Testing
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
This section covers assessments and audits, along with all the technologies and techniques you will be expected to know to perform them.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
Your company recently implemented a pre-release version of a new email application. The company wants to perform testing against the application and has issued the following requirements:
– Testers must test all aspects of the email application.
– Testers must not have any knowledge of the new e-mail environment.
Which type of testing should you use to meet the company requirements?Correct
Explanation: In black box testing, testers have no knowledge of the system they are testing.
Incorrect
Explanation: In black box testing, testers have no knowledge of the system they are testing.
-
Question 2 of 3
2. Question
You are working with your company to validate assessment and audit strategies. The immediate goal is to ensure that all auditors are following the processes and procedures defined by the company’s audit policies. Which type of audit should you use for this scenario?
Correct
Explanation: Third-party testing is specifically geared to ensuring that the other auditors (internal and external) are properly following your policies and procedures.
Incorrect
Explanation: Third-party testing is specifically geared to ensuring that the other auditors (internal and external) are properly following your policies and procedures.
-
Question 3 of 3
3. Question
Your company is planning to perform some security control testing. The following requirements have been established:
– The team must try to bypass controls in the systems.
– The team can use technical methods or non-technical methods in attempting to bypass controls.
Which type of testing should you perform to meet the requirements?Correct
Explanation: In a penetration test, teams attempt to bypass controls, whether technically or non-technically.
Incorrect
Explanation: In a penetration test, teams attempt to bypass controls, whether technically or non-technically.
Domain 7. Security Operations
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
This domain is focused on the day-to-day tasks of securing your environment. If you are in a role outside of operations (such as in engineering or architecture), you should spend extra time in this section to ensure familiarity with the information. You’ll notice more “hands on” sections in this domain, specifically focused on how to do things instead of the design or planning considerations found in previous domains.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
You are conducting an analysis of a compromised computer. You figure out that the computer had all known security patches applied prior to the computer being compromised. Which two of the following statements are probably true about this incident?
Correct
Explanation: When a vulnerability exists but there is no patch to fix it, it is a zero-day vulnerability. When exploit code exists to take advantage of a zero-day vulnerability, it is called a zero-day exploit. In this scenario, because the computer was up to date on patches, we can conclude that there was a zero-day vulnerability and a zero-day exploit.
Incorrect
Explanation: When a vulnerability exists but there is no patch to fix it, it is a zero-day vulnerability. When exploit code exists to take advantage of a zero-day vulnerability, it is called a zero-day exploit. In this scenario, because the computer was up to date on patches, we can conclude that there was a zero-day vulnerability and a zero-day exploit.
-
Question 2 of 3
2. Question
You are investigating poor performance of a company’s telephone system. The company uses IP-based phones and reports that in some scenarios, such as when there is heavy use, the call quality drops and there are sometimes lags or muffling. You need to maximize the performance of the telephone system. Which technology should you use?
Correct
Explanation: Quality of service provides priority service to a specified application or type of communication. In this scenario, call quality is being impacted by other services on the network. By prioritizing the network communication for the IP phones, you can maximize their performance (though that might impact something else).
Incorrect
Explanation: Quality of service provides priority service to a specified application or type of communication. In this scenario, call quality is being impacted by other services on the network. By prioritizing the network communication for the IP phones, you can maximize their performance (though that might impact something else).
-
Question 3 of 3
3. Question
You are preparing your company for disaster recovery. The company issues the following requirements for disaster recovery testing:
– The company must have the ability to restore and recover to an alternate data center.
– Restore and recovery operations must not impact your data center.
– IT teams must perform recovery steps during testing.
Which type of recovery should you use to meet the company’s requirements?Correct
Explanation: The first key requirement in this scenario is that the data center must not be impacted by the testing. This eliminates the partial interruption and full interruption tests because those impact the data center. The other key requirement is that IT teams must perform recovery steps. This requirement eliminates the tabletop testing because tabletop testing involves walking through the plans, but not performing recovery operations.
Incorrect
Explanation: The first key requirement in this scenario is that the data center must not be impacted by the testing. This eliminates the partial interruption and full interruption tests because those impact the data center. The other key requirement is that IT teams must perform recovery steps. This requirement eliminates the tabletop testing because tabletop testing involves walking through the plans, but not performing recovery operations.
Domain 8. Software Development Security
Quiz-summary
0 of 3 questions completed
Questions:
- 1
- 2
- 3
Information
This domain focuses on managing the risk and security of software development. Security should be a focus of the development lifecycle, and not an add-on or afterthought to the process. The development methodology and lifecycle can have a big effect on how security is thought of and implemented in your organization. The methodology also ties into the environment that the software is being developed for. Organizations should ensure that access to code repositories is limited to protect their investment in software development. Access and protection should be audited on a regular basis. You must also take into consideration the process of acquiring a development lifecycle, whether from another company, or picking up a development project that is already in progress.
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 3 questions answered correctly
Time has elapsed
Categories
- Not categorized 0%
- 1
- 2
- 3
- Answered
- Review
-
Question 1 of 3
1. Question
You are a software development manager starting a new development project. You want to focus the development process around user stories. The development process must be efficient and have multiple iterations as changes and requirements are discovered. Which development methodology should you use?
Correct
Explanation: Agile development emphasizes efficiency and iterations during the development process. Agile focuses on user stories to work through the development process.
Incorrect
Explanation: Agile development emphasizes efficiency and iterations during the development process. Agile focuses on user stories to work through the development process.
-
Question 2 of 3
2. Question
You are in the early stages of the development lifecycle and creating design requirements. The application will contain several forms that allow users to enter information to be saved in a database. The forms should require users to submit up to 200 alphanumeric characters, but should prevent certain strings. What should you perform on the text fields?
Correct
Explanation: The text fields that the users interact with should have input validation to ensure that the character limit has not been exceeded and that no special characters that might cause database inconsistencies are used.
Incorrect
Explanation: The text fields that the users interact with should have input validation to ensure that the character limit has not been exceeded and that no special characters that might cause database inconsistencies are used.
-
Question 3 of 3
3. Question
You plan on creating an artificial intelligence application that is based on constraints and an end goal. What generation language should you use for the development process?
Correct
Explanation: Generation 5 languages are associated with artificial intelligence. The constraints of the application and its goal are defined; then the program learns more on its own to achieve the goal.
Incorrect
Explanation: Generation 5 languages are associated with artificial intelligence. The constraints of the application and its goal are defined; then the program learns more on its own to achieve the goal.
We hope our free practice questions have helped you on your way toward getting your CISSP certification. Feel free to share your feedback and suggestions in the comments section below. Best wishes on the exam!
Please note: Passing these practice exams does not guarantee success in passing the actual CISSP certification exam, which contains 100-150 questions and takes 3 hours, but it should give you a good indication of your readiness to take that exam.
