I85PREP
⌘ K
CISSP study materials
CISSP study resources

CISSP practice questions

One question at a time. Build your CISSP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Risk Management

An attacker obtains a copy of a confidential merger document without altering it. Which part of the CIA triad is primarily affected?

  1. Non-repudiation
  2. Availability
  3. Integrity
  4. Confidentiality Correct answer.

Explanation

Confidentiality is the property that information is not disclosed to unauthorized individuals. Copying a confidential document without authorization is an unauthorized disclosure. Integrity concerns unauthorized modification, availability concerns timely access, and non-repudiation concerns proving that an action occurred.

Question 2Security and Risk Management

Which risk treatment option involves purchasing cyber insurance to offset potential financial loss?

  1. Risk acceptance
  2. Risk avoidance
  3. Risk mitigation
  4. Risk transfer Correct answer.

Explanation

Risk transfer shifts the financial consequences of a risk to another party, commonly through insurance or contractual agreements. Avoidance eliminates the activity that creates the risk, mitigation reduces likelihood or impact, and acceptance retains the risk.

Question 3Security and Risk Management

Which document is a high-level, mandatory statement of management intent that leaves implementation details to standards and procedures?

  1. Guideline
  2. Policy Correct answer.
  3. Procedure
  4. Baseline

Explanation

A policy is a mandatory, high-level statement of management intent and direction. Standards and baselines define specific mandatory requirements, while procedures describe step-by-step implementation. Guidelines are recommended practices rather than mandatory directives.

Question 4Security and Risk Management

According to the ISC2 Code of Ethics, which obligation takes precedence when professional duties conflict?

  1. Maximize shareholder value
  2. Place the safety and welfare of society first Correct answer.
  3. Protect the profession's reputation above all else
  4. Follow the employer's directive without question

Explanation

The ISC2 Code of Ethics places the safety and welfare of society and the common good ahead of other duties. Obligations to principals and to the profession follow that first canon. An employer directive that conflicts with public safety does not override the code.

Question 5Security and Risk Management

Which role is accountable for assigning classification labels and access rules to an information asset?

  1. Data processor
  2. Security auditor
  3. Data custodian
  4. Data owner Correct answer.

Explanation

The data owner is the business role accountable for classifying information and defining who may access it. The custodian implements and maintains controls according to the owner's requirements. Processors handle data on behalf of others, and auditors provide independent review.

Question 6Security and Risk Management

Which metric describes the amount of data loss, measured in time, that an organization can tolerate?

  1. Recovery time objective (RTO)
  2. Service level agreement (SLA)
  3. Maximum tolerable downtime (MTD)
  4. Recovery point objective (RPO) Correct answer.

Explanation

The recovery point objective defines how much data loss, expressed as elapsed time, is acceptable after a disruption. RTO addresses the time allowed to restore a process or system. MTD addresses maximum outage duration, and an SLA is a service commitment.

Question 7Security and Risk Management

Which principle requires granting users only the access needed to perform their assigned tasks?

  1. Defense in depth
  2. Least privilege Correct answer.
  3. Need-to-know
  4. Separation of duties

Explanation

Least privilege limits access rights to the minimum necessary for a user's job responsibilities. Separation of duties divides sensitive tasks among people, need-to-know limits access to specific information based on job need, and defense in depth layers controls.

Question 8Security and Risk Management

Which type of risk analysis uses numeric values such as asset value and annualized rate of occurrence?

  1. Qualitative
  2. Scenario-based
  3. Delphi
  4. Quantitative Correct answer.

Explanation

Quantitative risk analysis assigns numeric values to assets, threats, and losses and calculates measures such as annualized loss expectancy. Qualitative analysis uses descriptive ratings rather than numbers. Delphi and scenario-based methods are qualitative techniques.

Question 9Security and Risk Management

A risk owner decides to accept a risk. Which record makes the acceptance auditable?

  1. The technical control that will reduce the risk
  2. The date the risk was first identified
  3. The rationale and approving authority Correct answer.
  4. A list of affected employees

Explanation

Risk acceptance is only meaningful when documented with the decision rationale and the authority who approved it, showing that acceptance is within the organization's risk appetite. The identification date alone does not document the decision. Controls and affected-user lists do not establish who accepted the risk or why.

Question 10Security and Risk Management

During a business impact analysis, which activity comes first?

  1. Purchase backup generators
  2. Select alternate recovery sites
  3. Test the disaster recovery plan
  4. Map critical processes and dependencies Correct answer.

Explanation

A business impact analysis begins by identifying critical business processes and their dependencies, then determines the impact of disruption and derives recovery objectives. Recovery site selection, equipment purchases, and plan testing follow from those findings.

Question 11Security and Risk Management

An organization stops offering a risky online service rather than adding controls. Which risk treatment is this?

  1. Risk acceptance
  2. Risk transfer
  3. Risk avoidance Correct answer.
  4. Risk mitigation

Explanation

Risk avoidance eliminates the activity that creates the risk, which is what discontinuing the service does. Transfer shifts financial impact, mitigation reduces likelihood or impact, and acceptance retains the risk.

Question 12Security and Risk Management

Before onboarding a cloud vendor that will process customer data, which action best demonstrates due diligence?

  1. Review independent audit reports and security posture Correct answer.
  2. Rely on the vendor's marketing materials
  3. Sign the contract without review to speed onboarding
  4. Delegate all security responsibility to the vendor

Explanation

Due diligence requires independently verifying a vendor's security posture, commonly through audit reports, certifications, and control assessments. Marketing claims and expedited contracting do not provide evidence. Outsourcing a service does not transfer the organization's accountability for data protection.

Question 13Security and Risk Management

A board statement defining the amount and type of risk the organization is willing to pursue is called:

  1. Risk appetite Correct answer.
  2. Risk register
  3. Residual risk
  4. Inherent risk

Explanation

Risk appetite is the amount and type of risk an organization is willing to pursue or retain in achieving its objectives. Residual risk is what remains after controls, inherent risk exists before controls, and a risk register is a log of identified risks.

Question 14Security and Risk Management

Which metric best demonstrates the effectiveness of a security awareness program?

  1. Falling phishing click rates over time Correct answer.
  2. Number of training slides delivered
  3. Total hours of training completed
  4. Percentage of employees who attended a session

Explanation

Awareness program effectiveness is shown by measurable behavior change, such as reduced phishing simulation click-through rates over time. Attendance, hours, and content volume measure activity rather than whether behavior improved.

Question 15Security and Risk Management

Which control prevents a single administrator from both creating a vendor and approving payment to that vendor?

  1. Least privilege
  2. Job rotation
  3. Mandatory vacation
  4. Separation of duties Correct answer.

Explanation

Separation of duties divides sensitive tasks so that no single person can complete a transaction end to end. Job rotation and mandatory vacation help detect fraud but do not split the conflicting duties. Least privilege limits access but does not prevent one person from holding both duties if granted.

Question 16Security and Risk Management

Which lawful basis under the GDPR applies when an individual has given clear affirmative permission to process personal data?

  1. Legal obligation
  2. Contract necessity
  3. Legitimate interest
  4. Consent Correct answer.

Explanation

Consent is one lawful basis for processing under the GDPR and requires a clear affirmative indication from the individual. Legitimate interest, contract necessity, and legal obligation are separate bases that do not depend on permission.

Question 17Security and Risk Management

A risk register entry lists a threat, vulnerability, likelihood, impact, owner, and treatment plan. Which element is missing if the organization wants to track whether the treatment worked?

  1. The date the threat was first seen
  2. The asset's purchase price
  3. The names of the security team
  4. Residual risk rating Correct answer.

Explanation

Tracking treatment effectiveness requires recording residual risk after controls are applied and comparing it with the prior rating. Purchase price does not indicate control effectiveness, team names are not a risk measure, and a first-seen date does not show whether risk changed.

Question 18Security and Risk Management

Which role performs day-to-day backups and patching according to requirements set by the information owner?

  1. Internal auditor
  2. Data owner
  3. Data subject
  4. Data custodian Correct answer.

Explanation

The data custodian carries out operational duties such as backups, patching, and access maintenance under the owner's direction. The owner sets classification and access rules, the data subject is the individual the data concerns, and the auditor provides independent review.

Question 19Security and Risk Management

A motion detector that alerts guards when someone enters a restricted room is which type of control?

  1. Detective Correct answer.
  2. Corrective
  3. Preventive
  4. Compensating

Explanation

A detective control identifies and reports an event after it occurs, which is what an alerting motion detector does. Preventive controls stop an event, corrective controls restore conditions after an event, and compensating controls substitute for another control.

Question 20Security and Risk Management

Which concept requires management to continually verify that security controls are implemented and working as intended?

  1. Due care
  2. Risk acceptance
  3. Due diligence Correct answer.
  4. Security awareness

Explanation

Due diligence is the ongoing verification and review of controls to confirm they are implemented and effective. Due care is the ongoing responsibility to act reasonably and protect the organization. Acceptance is a risk decision, and awareness is a training activity.

Question 21Security and Risk Management

Which plan focuses on restoring IT systems and data after a disaster while the business continuity plan focuses on keeping critical business functions running?

  1. Occupant emergency plan
  2. Disaster recovery plan Correct answer.
  3. Crisis communications plan
  4. Business impact analysis

Explanation

The disaster recovery plan addresses restoration of technology infrastructure and data after a disruption. A business impact analysis identifies impacts and recovery requirements, a crisis communications plan manages messaging, and an occupant emergency plan addresses life safety.

Question 22Security and Risk Management

An asset is valued at $200,000. A threat occurs once every four years and destroys 25% of the asset's value. What is the annualized loss expectancy (ALE)?

  1. $2,000
  2. $200,000
  3. $50,000
  4. $12,500 Correct answer.

Explanation

The single loss expectancy is $200,000 multiplied by 25 percent, or $50,000. The annualized rate of occurrence is once every four years, or 0.25. Multiplying $50,000 by 0.25 gives an ALE of $12,500.

Question 23Security and Risk Management

Which statement best describes the relationship between total risk, controls, and residual risk?

  1. Residual risk is total risk minus the effect of controls Correct answer.
  2. Residual risk equals total risk plus control effectiveness
  3. Residual risk is the risk before any controls are applied
  4. Residual risk is always zero after controls are applied

Explanation

Residual risk is what remains after controls reduce inherent or total risk; it is total risk minus the risk mitigated by controls. Controls rarely eliminate risk completely. Inherent risk is the risk before controls are applied.

Question 24Security and Risk Management

An employee discovers a colleague storing customer data on a personal cloud account. What is the most appropriate first action under the ISC2 Code of Ethics?

  1. Report the issue through established organizational channels Correct answer.
  2. Delete the data without telling anyone
  3. Ignore it because it is not the employee's data
  4. Post the finding on social media to warn customers

Explanation

The ethical response is to report the issue through established channels so the organization can investigate and remediate while protecting affected parties. Deleting evidence or public disclosure can cause harm and interfere with remediation. Ignoring the issue fails the duty to protect the organization and the public.

Question 25Security and Risk Management

A software vendor notifies customers of a critical vulnerability in a widely used component. Which action best reflects a risk-based supply chain response?

  1. Terminate the vendor contract immediately
  2. Assess exposure, mitigate, and verify Correct answer.
  3. Disable all network access without assessment
  4. Wait for the next patch cycle regardless of severity

Explanation

A risk-based response first determines whether the organization is exposed, applies vendor mitigations or patches, and verifies remediation. Waiting without regard to severity ignores critical risk, and immediate termination or blanket disconnection may be disproportionate and harm availability without assessment.

Question 26Security and Risk Management

An internet-facing web server is running an outdated content management system that an attacker could exploit to gain unauthorized access. Which term best describes the outdated software in this scenario?

  1. A threat
  2. A vulnerability Correct answer.
  3. A risk
  4. An impact

Explanation

A vulnerability is a weakness in a system, process, or control that a threat can exploit. The threat is the actor or event with the potential to cause harm, whereas risk is the combination of likelihood and consequence.

Question 27Security and Risk Management

Which security objective is primarily served by comparing a cryptographic hash of a downloaded file against the value published by the vendor?

  1. Integrity Correct answer.
  2. Availability
  3. Nonrepudiation
  4. Confidentiality

Explanation

Hashing verifies that data has not been altered, which is the definition of integrity protection. Confidentiality would require encryption, availability would require redundancy, and nonrepudiation typically requires a digital signature tied to an identity.

Question 28Security and Risk Management

Management wants a mandatory, technology-specific requirement stating that every server must enforce a 12-character minimum password. Which type of document should contain this requirement?

  1. A vision statement
  2. A procedure
  3. A guideline
  4. A standard Correct answer.

Explanation

Standards are mandatory, quantifiable requirements that support policy, such as specific configuration values. Procedures describe step-by-step instructions, guidelines are recommended practices rather than mandatory rules, and vision statements express long-term direction.

Question 29Security and Risk Management

An accounts payable clerk is moving into a marketing role. Which action best supports the principle of least privilege?

  1. Issue a shared marketing account to simplify migration
  2. Grant marketing access while keeping payables access
  3. Remove access rights no longer needed for the new role Correct answer.
  4. Delay the access review until the next annual audit

Explanation

Least privilege requires that rights be limited to what the current job needs, so obsolete entitlements must be removed promptly when a role changes. Retaining old access or deferring review widens the attack surface and creates segregation-of-duties conflicts.

Question 30Security and Risk Management

A company keeps its primary EU customer database in a regional data center but replicates backups to a country with weaker privacy protections. Which concern does this practice primarily raise?

  1. Accuracy of the backup schedule
  2. Data remanence on retired media
  3. Availability of the primary site
  4. Lawful cross-border data transfer Correct answer.

Explanation

Moving personal data across jurisdictions raises data sovereignty and transfer-restriction obligations, which may require a recognized legal mechanism before the replication can continue. The other options address media sanitization, resilience, and operational scheduling rather than where data legally resides.

Question 31Security and Risk Management

An organization wants key staff to talk through their roles and decisions in a simulated disaster scenario, without activating alternate systems or relocating personnel. Which continuity test type does this describe?

  1. Full interruption
  2. Checklist review
  3. Parallel processing
  4. Tabletop exercise Correct answer.

Explanation

A tabletop exercise is discussion-based: participants rehearse roles and decisions against a scenario without disrupting production. Parallel processing and full interruption both involve actually running or switching to recovery capabilities, and a checklist review only confirms that the plan documentation is complete.

Question 32Security and Risk Management

A company develops a proprietary algorithm that will be embedded in products sold to customers, and it wants protection that lasts indefinitely and requires no public disclosure. Which protection is most appropriate?

  1. Register a trademark for the algorithm's name
  2. Protect the algorithm as a trade secret Correct answer.
  3. Register a copyright on the source code
  4. Patent the algorithm to stop independent re-creation

Explanation

Trade secret protection lasts as long as the information remains confidential and the owner takes reasonable steps to protect it, with no registration or disclosure. Patents require public disclosure and expire, copyright protects the expression of code rather than the underlying method, and trademarks protect brand identifiers only.

Question 33Asset Security

An organization labels its information Public, Internal, Confidential, and Restricted. Which statement correctly describes how these labels relate to one another?

  1. Restricted is the most tightly controlled tier while Public is the least controlled Correct answer.
  2. Public data needs the strongest controls because it is exposed outside the organization
  3. Confidential and Public data carry equivalent handling requirements
  4. Internal data may be released to outside parties without further approval

Explanation

A classification scheme orders information by the harm that disclosure would cause, so each tier carries a matching set of handling controls. The top tier (Restricted) receives the strictest access and storage controls, and the bottom tier (Public) is intended for unrestricted release.

Question 34Asset Security

Which role is accountable for deciding the classification level of a data set and defining who may access it?

  1. Data custodian
  2. Systems administrator
  3. Security auditor
  4. Data owner Correct answer.

Explanation

The data owner is the business-level authority accountable for a data set, including its classification and access rules. Custodians and administrators carry out the owner's decisions, while auditors provide independent assurance.

Question 35Asset Security

Which statement best describes personally identifiable information (PII)?

  1. Any data that has been encrypted while stored
  2. Information that can be used to distinguish or trace a specific individual's identity Correct answer.
  3. Information about an organization's proprietary formulas and processes
  4. Aggregated statistics that cannot single out an individual

Explanation

PII is defined by its ability to single out or trace a specific person, whether directly through an identifier or indirectly through combinable attributes. It is a property of the data's content and context, not of the protective controls applied to it.

Question 36Asset Security

What is the primary purpose of maintaining an accurate asset inventory within an asset security program?

  1. To satisfy software licensing audits only
  2. To determine which employees need security awareness training
  3. To replace the need for data classification
  4. To know which assets exist, where they are, and who is accountable for each Correct answer.

Explanation

An asset inventory establishes the scope of protection: you cannot classify, control, or monitor what you have not recorded. Each entry should capture location, ownership, and relevant attributes so controls can be applied and verified.

Question 37Asset Security

A records retention schedule exists primarily to ensure that information is kept:

  1. Indefinitely so that future analytics efforts have complete data
  2. Only for as long as business and legal requirements demand Correct answer.
  3. Under a specified encryption algorithm while archived
  4. Within a defined nightly backup window for critical servers

Explanation

Retention schedules define minimum and maximum periods driven by legal, regulatory, and business needs. Keeping data beyond those periods increases storage cost and legal exposure without adding value.

Question 38Asset Security

Why is labeling applied to information assets?

  1. To ensure users handle and protect the asset according to its classification Correct answer.
  2. To convert the data into a non-sensitive form
  3. To increase the usable storage capacity of the medium
  4. To eliminate the need for logical access controls

Explanation

Labels make the classification visible so that everyone handling the asset applies the correct handling, storage, and transmission rules. Labeling supports, but does not replace, technical access controls.

Question 39Asset Security

Which sanitization method destroys data by disrupting the magnetic domains of a hard disk drive and therefore cannot sanitize flash-based media?

  1. Degaussing Correct answer.
  2. Block-level overwrite
  3. Cryptographic erasure
  4. Physical destruction

Explanation

Degaussing exposes magnetic media to a strong field that randomizes stored domains, which only applies to magnetic drives. Flash memory stores charge rather than magnetic alignment, so degaussing leaves it intact.

Question 40Asset Security

A company stores encrypted backups with a cloud provider and must destroy a defined subset of records. Which approach most reliably achieves effective destruction?

  1. Degaussing the provider's storage arrays
  2. Deleting the object references in the cloud management console
  3. Overwriting the provider's physical disk platters directly
  4. Destroying the per-object encryption keys that protect those records Correct answer.

Explanation

When data is encrypted at the object level, destroying the key renders the ciphertext permanently unreadable, which is practical where the physical media is outside the customer's control. This technique is often called cryptographic erasure.

Question 41Asset Security

A data loss prevention (DLP) solution is best described as a control that:

  1. Filters outbound web requests to known malicious destinations
  2. Records the patch level of every server in the estate
  3. Replicates data to a secondary site for recovery purposes
  4. Inspects content and blocks or alerts on unauthorized movement of sensitive data Correct answer.

Explanation

DLP engines identify sensitive content by pattern, fingerprint, or label and then enforce policy on where it may travel, including email, endpoints, and web channels. Its defining characteristic is content-aware enforcement of data movement.

Question 42Asset Security

Which statement correctly distinguishes tokenization from encryption?

  1. A token bears no mathematical relation to the original value, and the mapping is held in a separate vault Correct answer.
  2. Tokenization is reversible only with a public key held by the data subject
  3. Tokenization is a lossy compression technique applied to structured records
  4. Tokenization automatically lowers the classification of the data it protects

Explanation

Tokenization substitutes a surrogate value that cannot be reversed by computation alone; the original is retrieved from a protected token vault. Encryption, by contrast, transforms data mathematically and is reversed with a key.

Question 43Asset Security

Data masking is most appropriate in which situation?

  1. Data at rest must be protected with a strong symmetric cipher
  2. Testers need realistic data without exposure of real customer values Correct answer.
  3. Production data must be restored after a ransomware event
  4. Records must be archived for seven years to satisfy tax regulations

Explanation

Masking replaces or obscures sensitive values while preserving the format and usefulness of the data set, which suits non-production environments. It protects privacy without breaking application testing or reporting.

Question 44Asset Security

Which privacy right allows an individual to require an organization to delete personal data that is no longer needed for its original purpose?

  1. Right of access
  2. Right to rectification
  3. Right to data portability
  4. Right to erasure Correct answer.

Explanation

The right to erasure, sometimes called the right to be forgotten, lets a data subject demand deletion where the processing purpose has lapsed or consent is withdrawn. It is distinct from rights that concern receiving, viewing, or correcting data.

Question 45Asset Security

Which practice best protects removable media containing confidential data while it is in transit between sites?

  1. Keeping an unencrypted copy at the destination as a fallback
  2. Applying a classification label and using the lowest-cost carrier
  3. Reformatting the media immediately before each shipment
  4. Encrypting the media and maintaining a chain-of-custody log Correct answer.

Explanation

Portable media should be protected so that loss of the physical item does not expose the content, which means strong encryption plus accountability for who holds the item at each step. A custody log supports investigation if the media goes missing.

Question 46Asset Security

Which sequence correctly represents the stages of the information lifecycle?

  1. Destroy, classify, store, create
  2. Use, destroy, create, archive
  3. Create and classify, store, use and share, archive, destroy Correct answer.
  4. Store, create, destroy, use

Explanation

Information is created and classified first, then stored and used or shared, eventually archived as active use declines, and finally destroyed when retention ends. Controls must be applied at every stage, not only at creation.

Question 47Asset Security

Why should an organization define a baseline configuration for each class of asset?

  1. To calculate depreciation of the hardware for accounting
  2. To establish the classification level of the data the asset holds
  3. To detect deviations that may indicate compromise or unauthorized change Correct answer.
  4. To determine the retention period for records stored on the asset

Explanation

A baseline documents the approved state of an asset so that drift, tampering, or misconfiguration can be detected through comparison over time. This supports integrity monitoring and rapid identification of unauthorized changes.

Question 48Asset Security

Before allowing a vendor to process the organization's confidential data, the organization should:

  1. Transfer ownership of the data to the vendor so liability shifts
  2. Perform due diligence and document security requirements in a contract Correct answer.
  3. Remove classification labels so the vendor can process the data freely
  4. Rely on the vendor's public security web page as evidence of controls

Explanation

Outsourcing processing does not outsource accountability, so the organization must assess the vendor's controls and make obligations enforceable through contract terms. Due diligence plus contractual requirements gives ongoing leverage and audit rights.

Question 49Asset Security

A litigation hold is issued while the retention schedule would otherwise permit destruction of email. What should the organization do?

  1. Suspend destruction of all in-scope records until the hold is formally released Correct answer.
  2. Proceed with scheduled destruction because the retention schedule is a legal requirement
  3. Preserve only records that were already moved to the archive tier
  4. Destroy the records after notifying the court of the scheduled deletion

Explanation

A legal hold overrides the normal retention schedule and obliges the organization to preserve potentially relevant evidence, including records in backups and archives where feasible. Destruction during a hold can constitute spoliation and carries severe legal consequences.

Question 50Asset Security

A multinational firm must ensure that EU customer records never leave that jurisdiction under a new data residency mandate. Which set of controls best satisfies the requirement?

  1. Tokenizing the records before they are transmitted abroad
  2. Replicating the records to a disaster recovery site in another region
  3. Regional data residency controls, geo-fencing, and contractual limits on cross-border transfer Correct answer.
  4. Encrypting the records with keys that are held in the home country

Explanation

Residency obligations constrain where data may be stored and processed, so the solution combines technical location controls with enforceable contractual restrictions and monitoring. Encryption and tokenization reduce exposure but do not prevent the data from being transferred.