ISC2 Certification
62 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The ISC2 Information Systems Security Professional (CISSP) certification validates professional expertise in ISC2 technologies. This study guide covers all 62 practice questions from our CISSP practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
Which of the following best describes the primary purpose of a Business Impact Analysis (BIA) in the context of business continuity planning?
A BIA is specifically designed to identify critical business functions and quantify the impact (financial, operational, reputational) if those functions are disrupted. This information forms the foundation for recovery planning priorities.
In cryptographic key management, what is the primary advantage of using a Hardware Security Module (HSM) compared to software-based key storage?
HSMs provide dedicated hardware with tamper detection, physical security measures, and cryptographic isolation that make key extraction extremely difficult. This is superior to software storage which is vulnerable to memory attacks and malware.
Which access control model is most appropriate for an organization where users require different permission levels based on their role within the organization, with predefined sets of permissions for each role?
RBAC assigns permissions to predefined roles rather than individual users, making it ideal for organizations with clearly defined job functions. Users inherit permissions associated with their assigned role.
During a forensic investigation, a security analyst discovers that a suspect altered file modification timestamps using specialized tools. Which of the following best describes what the analyst should document?
Modified timestamps indicate potential evidence tampering but do not invalidate the investigation. Forensic analysts should document this finding and seek corroborating evidence from system logs, network records, and other metadata sources.
What is the primary function of a Data Loss Prevention (DLP) system in an organization's security infrastructure?
DLP systems monitor data movement across networks and endpoints, identifying and blocking unauthorized transmission of sensitive information based on content policies. This prevents both accidental and intentional data loss.
In the context of secure software development, which phase is most critical for identifying and mitigating security vulnerabilities before code is written?
Security vulnerabilities are most cost-effective to address during the design phase. Identifying security flaws in architecture before implementation prevents the need for costly redesigns and reduces exploitation risk.
Which of the following BEST describes the relationship between confidentiality, integrity, and availability (CIA triad) in information security?
The CIA triad represents three core security objectives that must work together: keeping data secret, ensuring data accuracy, and maintaining system availability. All three are essential for comprehensive security.
An organization is implementing a third-party cloud service for critical business operations. Which of the following is the MOST important contractual element to address security and compliance requirements?
A comprehensive Security SLA and DPA establish the provider's security obligations, incident response procedures, audit rights, and compliance requirements. These contractual elements directly protect the organization's data and systems.
What is the primary weakness of using security through obscurity as a primary defense mechanism?
Security through obscurity fails because sophisticated attackers can reverse-engineer, analyze, and discover hidden mechanisms. It should only supplement, not replace, strong cryptographic and security controls.
In a Public Key Infrastructure (PKI), what is the primary responsibility of a Certificate Authority (CA) that distinguishes it from a Registration Authority (RA)?
The CA is the trusted entity that digitally signs certificates, binding a public key to an identity. The RA verifies the identity information before requesting a certificate from the CA, creating a separation of duties.
Which type of security control is BEST exemplified by requiring users to use a strong password combined with multi-factor authentication for access to sensitive systems?
Strong passwords and multi-factor authentication are preventive controls that stop unauthorized access before it happens by raising barriers to entry. Detective controls would identify the attempt after occurrence.
During a security audit, the auditor discovers that administrative accounts with unlimited privileges have not been reviewed for necessity in over two years. What principle has been violated?
The principle of least privilege requires that users and accounts have only the minimum permissions necessary to perform their functions. Regular reviews ensure that excessive privileges are identified and removed.
Which of the following BEST describes the difference between a threat, a vulnerability, and a risk in information security?
Threat (potential source of harm), vulnerability (weakness), and risk (probability and impact of exploit) are distinct concepts. Risk = Threat × Vulnerability × Impact in the security equation.
In network segmentation, what is the primary purpose of implementing a demilitarized zone (DMZ)?
A DMZ is a network segment that sits between the internet and internal networks, hosting public-facing services. This architecture limits exposure of internal systems if external servers are compromised.
What is the primary security concern with allowing users to store encryption keys on their personal devices for remote access to corporate systems?
Personal devices are often not managed, patched, or monitored by IT security. They may have malware, lack encryption, and be vulnerable to theft, significantly increasing the risk of encryption key compromise.
Which of the following is the MOST effective method for detecting insider threats in an organization?
UEBA tools establish baselines of normal behavior and detect anomalies indicating potential insider threats. Combined with access controls and segregation of duties, this provides comprehensive detection while respecting privacy.
In the context of disaster recovery planning, what does the term 'Recovery Point Objective (RPO)' specifically measure?
RPO defines the maximum acceptable data loss during a disruption. For example, an RPO of 4 hours means the organization can tolerate losing up to 4 hours of data if a disaster occurs.
Which type of malware is BEST described as self-replicating code that spreads from one computer to another through network connections without requiring user action?
A worm is self-propagating malware that spreads automatically across networks by exploiting vulnerabilities without user interaction. Unlike viruses, worms don't need to attach to files or require user execution.
An organization discovers that a database administrator has been accessing customer financial data without a documented business need. What is the BEST immediate action to take regarding access control?
Unauthorized access to sensitive data represents an immediate security risk. Privileges should be revoked immediately, and access logs reviewed to determine the extent of the violation and potential impact.
What is the primary difference between authentication and authorization in information security?
Authentication answers 'Are you who you claim to be?' through credentials. Authorization answers 'What are you allowed to do?' based on verified identity and role.
In incident response, which phase involves collecting evidence, identifying affected systems, and stopping the attack while preserving forensic data?
Containment (short-term and long-term) focuses on stopping the attack's progress and impact while preserving evidence for investigation. This includes isolation of systems and forensic data collection.
Which of the following BEST describes the purpose of a security awareness training program in an organization?
Security awareness training empowers employees to recognize threats, follow secure practices, and report incidents. This addresses the human factor, which is often the weakest link in security.
In cryptography, what is the critical difference between symmetric encryption and asymmetric encryption in terms of key management?
Symmetric encryption requires secure distribution of a single shared key to both parties. Asymmetric encryption uses mathematically related key pairs, allowing public key distribution without compromising security.
An organization is implementing a Zero Trust security model. Which of the following BEST characterizes this approach?
Zero Trust requires verification at every access point—users, devices, and applications are never trusted by default. Continuous authentication and authorization are applied regardless of network location.
What is the primary purpose of a security patch management program in an organization?
Patch management addresses known vulnerabilities before they can be exploited. A structured program including testing and staged deployment balances security with operational stability.
Which of the following best describes the primary purpose of the Bell-LaPadula model in information security?
The Bell-LaPadula model is a state machine model designed to enforce confidentiality through mandatory access controls, preventing information flow from higher to lower classification levels.
In the context of cryptographic key management, what is the primary advantage of using a Hardware Security Module (HSM)?
HSMs are specialized hardware devices designed to securely generate, store, and manage cryptographic keys in a tamper-resistant environment, protecting against both logical and physical attacks.
Which access control model is most appropriate for an organization with highly dynamic user roles and temporary project-based assignments?
ABAC provides the flexibility to make access decisions based on attributes (user, resource, environment, action) and is ideal for dynamic environments where roles frequently change or project-based assignments are common.
What is the primary objective of performing a Business Impact Analysis (BIA) in disaster recovery planning?
A BIA quantifies the impact of losing critical business functions and helps determine acceptable downtime thresholds, informing disaster recovery strategy and resource allocation.
In a Public Key Infrastructure (PKI), which of the following is primarily responsible for revoking certificates and publishing revocation status information?
While the CA issues certificates, it also maintains the authority to revoke certificates and is responsible for ensuring revocation status is published through CRLs or Online Certificate Status Protocol (OCSP) responders.
Which of the following statements most accurately describes the relationship between confidentiality, integrity, and availability (CIA triad) in information security?
The CIA triad represents three core security goals, but their relative importance varies by organization and context—for example, a bank prioritizes integrity, while a news service prioritizes availability.
An organization implements a security policy that requires multi-factor authentication for all remote access. Which security principle does this primarily address?
Multi-factor authentication implements defense in depth by requiring multiple independent verification methods, increasing the difficulty of unauthorized access even if one factor is compromised.
What is the primary security concern associated with using API keys as the sole authentication mechanism for microservices?
API keys are static credentials that provide coarse-grained access control and are frequently exposed in source code, configuration files, and logs, making them unsuitable as a sole authentication method.
In the context of secure software development, which practice most directly reduces the risk of SQL injection vulnerabilities?
Parameterized queries prevent SQL injection by separating SQL code from user input data, ensuring that user input cannot alter the structure of SQL commands.
Which of the following best describes the principle of 'defense in depth' as it applies to physical security controls?
Defense in depth for physical security means implementing multiple overlapping controls at different layers—perimeter, building, floor, and room levels—so that failure of one control doesn't compromise overall security.
A security incident response team must determine whether a system compromise has occurred. Which of the following is the most reliable indicator of a successful intrusion?
Forensic evidence such as unauthorized processes, modified files, or anomalous network connections provides definitive proof of compromise, whereas IDS alerts and user reports may indicate suspicious activity without confirming actual breach.
Which of the following cryptographic algorithms is specifically designed for digital signatures and is mandated by FIPS standards for U.S. government applications?
DSA and ECDSA are the cryptographic algorithms specified in FIPS 186 standards for digital signatures in government applications, with ECDSA being preferred for new implementations.
An organization is designing a security awareness program. Which approach is most effective in reducing human-related security incidents?
Effective security awareness combines role-specific, continuous learning with practical exercises and measurable feedback, as annual training alone is insufficient to change behavior or maintain knowledge retention.
In the Biba integrity model, what is the primary constraint that prevents integrity violations?
The Biba model prevents integrity violations through the write-down restriction (users write at their level) and the read-up restriction (users only read from equal or higher integrity sources).
Which of the following is the primary purpose of a Security Operations Center (SOC)?
A SOC is a centralized facility staffed with security professionals who monitor network and system activity 24/7 to detect and respond to security incidents and threats.
What is the primary security risk associated with using legacy cryptographic protocols such as SSL 2.0 or SSL 3.0 in modern web applications?
SSL 2.0 and 3.0 have well-documented cryptographic vulnerabilities (POODLE, downgrade attacks) and have been formally deprecated; organizations should use TLS 1.2 or higher.
In a risk assessment, an asset has been assigned a value of $500,000, a vulnerability has been assigned a likelihood of 3 out of 10, and the potential impact is 80% of the asset value. What is the Annualized Loss Expectancy (ALE)?
ALE = Asset Value × Likelihood × Impact = $500,000 × 0.3 × 0.8 = $120,000. This calculation assumes one occurrence per year; adjust frequency if different.
Which of the following best describes the primary advantage of implementing a Zero Trust security model compared to traditional perimeter-based security?
Zero Trust operates on the principle of 'never trust, always verify' by continuously authenticating and authorizing users and devices regardless of their location, eliminating implicit trust in perimeter controls.
What is the primary objective of conducting a Security Control Assessment (SCA)?
A Security Control Assessment evaluates whether implemented controls are properly designed, operational, and effective in protecting assets against identified threats.
In a cloud service provider environment, which of the following best describes the shared responsibility model for security?
The shared responsibility model divides security duties: providers manage infrastructure security while customers manage application security, data classification, and access control—the division varies by service model.
Which of the following authentication methods is most resistant to phishing attacks?
FIDO2 hardware security keys verify the relying party's identity before authenticating, preventing credential submission to fraudulent websites, making them inherently resistant to phishing.
An organization discovers that a system administrator has been accessing sensitive files without a documented business need. Which security principle has most likely been violated?
The principle of least privilege dictates that users should have only the minimum access necessary to perform their job functions; excessive access enables unauthorized data access and increases risk.
Which of the following is the primary security concern associated with the use of public Wi-Fi networks for business communications?
Unencrypted public Wi-Fi networks allow attackers on the same network to intercept traffic, steal credentials, and perform man-in-the-middle attacks; VPNs should be used for sensitive communications.
In incident response, what is the primary purpose of creating and maintaining a forensic image of a compromised system?
A forensic image captures the entire state of a system for evidence preservation, investigation, and potential legal proceedings, protecting the integrity of the investigation.
Which of the following best describes the primary difference between a vulnerability and a threat in the context of risk management?
Vulnerabilities are weaknesses (e.g., unpatched software), while threats are potential actors or events that could exploit those weaknesses; both must exist for risk to occur.
An organization implements network segmentation by creating separate VLANs for different departments. Which of the following best describes the primary security benefit?
Network segmentation via VLANs implements defense in depth by limiting lateral movement of compromised systems, enabling fine-grained firewall rules between segments, and containing breach impact.
Which of the following represents a fundamental principle of secure software development that should be applied during the design phase?
Secure software development requires integrating security from the design phase through threat modeling and secure architecture, rather than attempting to add security retroactively.
Which of the following best describes the principle of defense in depth as it applies to information security architecture?
Defense in depth is a strategy that uses multiple layers of security controls (technical, administrative, and physical) to protect assets. This approach ensures that if one control fails, others remain in place.
In the context of access control models, which model provides the most granular control by allowing or denying permissions based on attributes of users, resources, and environmental conditions?
ABAC uses policies based on attributes (user attributes, resource attributes, environment attributes) to make dynamic access decisions, providing more flexibility and granularity than traditional models like RBAC or DAC.
What is the primary purpose of conducting a Business Impact Analysis (BIA) during the business continuity planning process?
A BIA identifies critical business functions and determines the impact of their loss, establishing key metrics such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO) to guide continuity planning.
An organization implements a Web Application Firewall (WAF) to protect against OWASP Top 10 vulnerabilities. Which of the following attacks would a WAF be LEAST effective at preventing?
WAFs detect and block known attack patterns at the network/application layer, but cannot identify logic flaws unique to specific business processes. Logic-based vulnerabilities require code review and application-level controls.
Which cryptographic concept ensures that a message has not been altered and originates from the claimed sender?
Digital signatures use asymmetric cryptography to provide both integrity (proving the message hasn't changed) and authentication (proving the sender's identity), ensuring the recipient can verify both the message and its source.
During a security audit, an auditor discovers that privileged accounts have not been reviewed for necessity in over two years. Which principle is being violated?
The principle of least privilege requires that accounts have only the minimum permissions necessary and should be reviewed regularly to ensure they still meet business requirements. Stale privileged accounts violate this principle.
An organization is designing a disaster recovery site that is located 200 kilometers away from the primary data center. What type of recovery site is this, and what is a key advantage of this distance?
A site located 200 km away is typically classified as a warm site. The critical advantage is geographic separation—being far enough away to avoid the same regional disaster (earthquake, hurricane, etc.) that could destroy the primary site.
Which of the following best describes the difference between a threat, a vulnerability, and a risk in the context of information security?
In security terminology: a threat is a potential harmful event (actor or force), a vulnerability is a weakness in a system, and risk is the likelihood and consequence of a threat exploiting a vulnerability to cause harm.
An organization uses salting and hashing for password storage. An attacker obtains the hashed password file but cannot feasibly reverse the hashes to obtain passwords. However, the attacker can still conduct which type of attack against poorly chosen passwords?
Even with proper hashing and salting, weak passwords can be compromised through dictionary attacks—the attacker hashes common passwords and compares results. Salting prevents rainbow table attacks but not dictionary attacks on weak passwords.
Which of the following represents the best practice for managing security patches in a large enterprise environment?
Best practice involves a formal patch management process: test patches in controlled environments first, validate compatibility and functionality, then deploy in stages across the enterprise. This balances security with operational stability.
You've reviewed all 62 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free