CISSP Practice Exam Questions

In order to help you tackle the challenges of mastering the CISSP domains, so we’ve curated a comprehensive set of questions designed to simulate the real exam experience – not just knowledge.

Test your skills across all eight domains, identify areas for improvement, and build the confidence you need to succeed.

Whether you’re just starting your CISSP journey or fine-tuning your skills, our practice questions are here to help you achieve certification success – it’s completely free!

Welcome to CISSP Exam Questions - Quiz 1
Please answer the following 10 questions
Please read our terms of use before taking the exam

What is considered Social Engineering?

A vishing attack

A phishing attack

Manipulating an individual to perform certain actions

Manipulating an individual to expose their credentials

None

A company is planning to deploy a secure email system to protect sensitive information in transit. Which of the following email security mechanisms provides end-to-end encryption and digital signatures, ensuring confidentiality, integrity, and authentication of email messages?

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Sender Policy Framework (SPF)

Simple Mail Transfer Protocol Transport Layer Security (STARTTLS)

DomainKeys Identified Mail (DKIM)

None

Why do organizations use VPNs?

To share resources securely

To allow users to work remotely

To connect two networks together

To ensure confidentiality and integrity of data

None

Which of the following best describes the difference between due care and due diligence?

Due care involves orchestrating and reconstructing methodologies, procedures, conventions, and controls while due diligence involves conducting periodic scrutiny, evaluations, corroboration, and updates to ensure that the due care measures are adequate

Due diligence involves orchestrating and reconstructing methodologies, procedures, conventions, and controls while due care involves conducting periodic scrutiny, evaluations, corroboration, and updates to ensure that the due care measures are adequate

Due care involves implementing and maintaining appropriate policies, procedures, standards, and controls while due diligence involves conducting regular audits, assessments, tests, and updates to ensure that the due care measures are adequate

Due diligence involves implementing and maintaining appropriate policies, procedures, standards, and controls while due care involves conducting regular audits, assessments, tests, and updates to ensure that the due care measures are adequate

None

Where was the Kerberos Protocol developed?

The Massachusetts Institute of Technology (MIT)

United States Department of Defense (DoD)

National Institute of Standards and Technology (NIST)

The National Aeronautics and Space Administration (NASA)

None

Which type of fire suppression system is most suitable for a data center environment due to its ability to extinguish fires quickly without causing damage to sensitive electronic equipment?

Clean agent (gaseous) suppression systems

Carbon dioxide (CO2) suppression systems

Foam-based suppression systems

Water-based sprinkler systems

None

In the RSA algorithm, what is the maximum block size for a 2048-bits key size?

2059-bits

1024-bits

2037-bits

2048-bits

None

A company has a business continuity plan that requires the recovery of critical systems within 4 hours of a disaster. The companys' mean time to recover (MTTR) for these systems is 2 hours. What is the companys' Recovery Time Objective (RTO) for these critical systems?

6 Hours

8 Hours

2 Hours

4 Hours

None

How much security is “too much security”?

When security controls are stricter than required by your regulator

When the cost of security exceeds the value of the protected assets

When security controls are so strict that IT staff is starting to complain about required maintenance time

There is no such thing as “too much security”

None

You are a CISO of a large company under GDPR compliance. You get a call in the middle of the night from your SOC telling you that there has been a breach. What is the first thing you need to do?

Check the “IR document”

Inform the company’s compliance officer

Inform the company’s CEO

Go to the office to monitor the situation

None

You finished the exam! Please click on "Submit" or go back and review your answers.

Time's up

Welcome to CISSP Exam Questions - Quiz 2
Please answer the following 10 questions
Please read our terms of use before taking the exam

Alice is using her private key to hash a message before sending it to Bob. What is the main thing Alice trying to achieve?

Privacy

Integrity

Confidentially

Authorization

None

As a CISO, how should you respond if the CEO determines that the risk associated with a new business-critical project is unacceptable?

Purchase insurance to cover the various potential outcomes of this project

Engage a reputable managed security service provider to handle the security aspects of this project

Upgrade or replace outdated and unsupported software or servers intended for use in this project

Relocate the project-related data to a more secure environment

None

Which of the following options is not consider a risk mitigation method for Industrial Control Systems (ICS)?

Segmentation

Configuration Control

Isolation

Image Management

None

Which of the following is a standard that defines the format of a public key certificate?

RFC 1918

RFC 2616

X.509

802.1X

None

Which of the following is acceptable by the NSA to encrypt top secret data?

ECC 512-bit

RSA 3072-bit

ECC 384-bit

RSA 7680-bit

None

What is the classification level of "Secret" in the U.S government?

The highest level

The third highest level

"Secret" classifications is only used by commercial companies

The second highest level

None

In a symmetric key system where an organization has 10,000 users, how many keys would need to be generated?

49,995,000

20,000

100,000,000

10,000

None

What does the Clark-Wilson model used for?

Handling situations in which a subject should be restricted from gaining particular privileges

Determine how a model system controls subjects and objects

Ensure confidentiality in a multilevel security (MLS) system

Ensure integrity at the transaction level

None

Which of the following is not a main process area of NIST SP 800-160: Systems Security Engineering?

Technical Processes

Technical Management Processes

Procurement Processes

Agreement Processes

None

What is the Kerckhoffs’s Principle?

The enemy knows your system—everything except your keys

Given enough time and resources - every encryption can be broken

It's only a matter of time before a collision is found in encryption algorithm

A cryptosystem should be secure even if everything about the system, except the key

None

You finished the exam! Please click on "Submit" or go back and review your answers.

Time's up

CISSP Practice Exam Questions

CISSP Practice Exam Questions

Coming soon!

Subscribe to our newsletter!

Subscribe to our newsletter!