Question bank
ISC2 CISSP
44 ISC2 CISSP questions with the correct answer and a written explanation, organised across 8 exam domains.
- 44 questions
- 8 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Asset Security
4 questions in this domain
- Question 1Single Choice
Who bears ultimate accountability for the classification of an organization's information assets?
- AData ownerCorrect answer
- BData custodian
- CSystem administrator
- DData auditor
Why this is the answer
The data owner is the senior business leader accountable for classification and protection decisions. Custodians implement controls but do not own classification decisions.
- Question 2Multiple Select
Select the two correct statements about data ownership and custodianship.
- AThe data owner defines classification and access policy.Correct answer
- BThe data custodian implements and maintains technical controls.Correct answer
- CThe data custodian determines the final classification level.
- DThe system administrator is ultimately accountable for the data set.
Why this is the answer
The owner decides classification and policy; the custodian implements controls. Custodians do not classify, and administrators are not accountable owners.
- Question 3Interactive
Based on the record metadata shown in the code block, which role should implement encryption and backup controls for this asset?
- AData custodianCorrect answer
- BData owner
- CEnd user
- DInternal auditor
Why this is the answer
The custodian executes the owner's directives by applying encryption, backups, and access controls. The owner remains accountable and sets the label.
- Question 4Single Choice
Which classification level is always considered the lowest in both private and military schemes?
- APublicCorrect answer
- BSensitive
- CPrivate
- DConfidential
Why this is the answer
Public represents no significant damage if disclosed, while sensitive, private, and confidential represent increasing sensitivity.
Communication and Network Security
6 questions in this domain
- Question 5Single Choice
Which protocol is the secure replacement for Telnet for remote administration?
- ASSHCorrect answer
- BFTP
- CHTTP
- DSNMPv2c
Why this is the answer
Telnet sends data in cleartext. SSH encrypts remote administration sessions and is the secure alternative.
- Question 6Multiple Select
Which of the following are secure design principles for network protocols? Select all that apply.
- ADefense in depth with layered security controlsCorrect answer
- BDisabling unneeded protocols, ports, and servicesCorrect answer
- CFail-safe defaults that deny access by defaultCorrect answer
- DAllowing all traffic and logging anomalies for later review
Why this is the answer
Secure design combines layered defense, least privilege, and fail-safe defaults. Allowing all traffic and logging anomalies violates these principles.
- Question 7Interactive
Refer to the enabled_protocols list in the code block. Which protocols are insecure and should be disabled under least privilege? Select all that apply.
- ATELNETCorrect answer
- BFTPCorrect answer
- CSNMPv3
- DHTTPS
Why this is the answer
TELNET and FTP transmit data and credentials in cleartext. SNMPv3 and HTTPS are modern secure protocols and should not be disabled for being insecure.
- Question 8Single Choice
At which OSI layer does IPsec operate to secure IP communications?
- ALayer 2
- BLayer 3Correct answer
- CLayer 4
- DLayer 7
Why this is the answer
IPsec operates at Layer 3, the network layer, protecting IP packets in transit.
- Question 9Multiple Select
Which characteristics are present in a secure protocol design? Select all that apply.
- AMutual authentication of communicating partiesCorrect answer
- BStrong encryption with forward secrecyCorrect answer
- CMessage integrity controls such as HMAC or digital signaturesCorrect answer
- DUse of default community strings for management access
Why this is the answer
Secure protocols authenticate endpoints, encrypt with modern ciphers, and verify integrity. Default community strings are insecure and violate least privilege.
- Question 10Interactive
The code block defines an IPS deployment mode. What is the security consequence if the inline IPS fails while in this mode?
- ATraffic passes through without inspectionCorrect answer
- BAll traffic is blocked until the device recovers
- COnly encrypted traffic is allowed through
- DTraffic is automatically routed to a quarantine VLAN
Why this is the answer
Fail-open means that on failure the device stops enforcing policy and traffic continues without inspection, prioritizing availability over security.
Identity and Access Management (IAM)
6 questions in this domain
- Question 11Single Choice
In access control, what is the act of a subject claiming an identity, such as presenting a username or email address?
- AIdentificationCorrect answer
- BAuthentication
- CAuthorization
- DAccountability
Why this is the answer
Identification is the subject's claim of identity; authentication verifies that claim through credentials or factors.
- Question 12Multiple Select
Select all that apply. Which of the following are recognized authentication factor categories used to verify an identity claim?
- ASomething you knowCorrect answer
- BSomething you haveCorrect answer
- CSomething you areCorrect answer
- DSomething you remember
Why this is the answer
Knowledge, possession, and inherence are factor categories; 'something you remember' is another form of knowledge, not a distinct category.
- Question 13Interactive
Based on the code snippet, which IAM lifecycle action is executed when a user status is terminated?
- ADeprovisioningCorrect answer
- BProvisioning
- CAuthentication
- DAuthorization
Why this is the answer
The code revokes all access after termination, which is the deprovisioning stage of the identity and access lifecycle.
- Question 14Single Choice
In the IAM model, which access control stage verifies a subject's identity claim using credentials or factors?
- AAuthenticationCorrect answer
- BIdentification
- CAuthorization
- DAccountability
Why this is the answer
Authentication verifies an identity claim by requiring a credential or authentication factor, while authorization decisions happen afterward.
- Question 15Multiple Select
Which of the following are common examples of identifiers used during the identification stage? Select all that apply.
- AUsernameCorrect answer
- BEmail addressCorrect answer
- CEmployee IDCorrect answer
- DFingerprint
Why this is the answer
Usernames, email addresses, and employee IDs are identity claims; a fingerprint is an authentication factor, not an identifier.
- Question 16Interactive
Based on the code snippet, how should an authentication attempt using a password and a PIN be classified?
- AMFA, because two credentials are used
- BNot MFA, because both are knowledge factorsCorrect answer
- CMFA, because a password is not a PIN
- DNot MFA, because neither factor is biometric
Why this is the answer
MFA requires two distinct factor categories; a password and a PIN are both knowledge factors, so this is not MFA.
Security Architecture and Engineering
6 questions in this domain
- Question 17Single Choice
Which secure design principle is characterized by deploying multiple, overlapping security controls so that failure of one layer does not compromise the entire system?
- ADefense in depthCorrect answer
- BLeast privilege
- COpen design
- DFail secure
Why this is the answer
Defense in depth, also called layered security, uses multiple overlapping controls so that defeating one layer does not compromise the entire system.
- Question 18Multiple Select
Which of the following are required properties of a reference monitor? (Select all that apply)
- ATamper-proofCorrect answer
- BAlways invokedCorrect answer
- CVerifiableCorrect answer
- DSupport caching of authorization decisions
Why this is the answer
A reference monitor must be tamper-proof, always invoked, and verifiable. Caching prior decisions without rechecking violates complete mediation.
- Question 19Interactive
Review the pseudocode. What security model property does this access control logic enforce?
- ABell-LaPadulaCorrect answer
- BBiba
- CClark-Wilson
- DBrewer-Nash
Why this is the answer
The code allows read when clearance is higher and write only when classification is not lower, matching Bell-LaPadula's No Read Up and No Write Down rules.
- Question 20Single Choice
Which security model is primarily concerned with preserving data integrity by preventing subjects from writing to higher integrity levels?
- ABibaCorrect answer
- BBell-LaPadula
- CClark-Wilson
- DBrewer-Nash
Why this is the answer
The Biba model protects integrity by preventing lower-integrity subjects from writing to higher-integrity objects, known as No Write Up.
- Question 21Multiple Select
Which scenarios describe fail-secure behavior? (Select all that apply)
- AA locked server room door remains locked when power is lostCorrect answer
- BA database rejects all requests when the authentication service becomes unavailableCorrect answer
- CAn emergency exit door automatically unlocks during a fire alarm
- DA network device allows all traffic when its firewall service crashes
Why this is the answer
Fail-secure denies access by default during failure. Locked doors and rejected database requests preserve security when a component fails.
- Question 22Interactive
Which secure design principle is violated if the cached access decision is reused without rechecking after a policy change?
- AComplete mediationCorrect answer
- BLeast privilege
- CSeparation of duties
- DOpen design
Why this is the answer
Complete mediation requires every access to be verified against the current security policy. Reusing cached authorization can allow access after policy changes.
Security Assessment and Testing
5 questions in this domain
- Question 23Single Choice
What does a vulnerability assessment primarily do?
- AIdentifies and reports known weaknesses without exploitationCorrect answer
- BExploits weaknesses to demonstrate business impact
- CReviews documents to verify regulatory compliance
- DSimulates an attacker to gain unauthorized access
Why this is the answer
A vulnerability assessment uses automated tools to identify known vulnerabilities and does not attempt exploitation. Exploitation is part of penetration testing.
- Question 24Multiple Select
Which two statements about penetration testing are correct?
- AActively exploits vulnerabilities to determine impactCorrect answer
- BMust have signed rules of engagement before startingCorrect answer
- CUses automated scanning only, without manual techniques
- DIs guaranteed to find every vulnerability in scope
Why this is the answer
Penetration testing actively exploits vulnerabilities and requires signed rules of engagement. It cannot guarantee finding every vulnerability and is not limited to automated scanning.
- Question 25Interactive
Review the testing configuration snippet. What type of assessment is described?
- AVulnerability assessmentCorrect answer
- BPenetration test
- CSecurity audit
- DRed team exercise
Why this is the answer
The snippet enables patch checking and severity reporting but disables exploitation, matching vulnerability assessment.
- Question 26Single Choice
In a black-box penetration test, what knowledge does the tester receive?
- ANo internal knowledgeCorrect answer
- BFull access to source code
- CPartial user credentials
- DArchitecture diagrams
Why this is the answer
Black-box testing simulates an outside attacker with no internal knowledge and relies on open-source intelligence.
- Question 27Multiple Select
Which two activities are part of a structured assessment lifecycle?
- APlanning and scopingCorrect answer
- BReporting and remediation supportCorrect answer
- CDeveloping marketing collateral
- DIgnoring stakeholder sign-off
Why this is the answer
An assessment lifecycle includes planning, scoping, information gathering, analysis, reporting, and remediation support. Marketing and ignoring sign-off are not valid steps.
Security Operations
6 questions in this domain
- Question 28Single Choice
When an unexpected security event is identified, which document should provide the authoritative framework for guiding the organization's response?
- AIncident Response PlanCorrect answer
- BDisaster Recovery Plan
- CBusiness Impact Analysis
- DNetwork diagram
Why this is the answer
The Incident Response Plan is the authoritative set of procedures for responding to unexpected security events and aligns actions with policy and risk tolerance.
- Question 29Multiple Select
Which of the following options are legitimate stages in the NIST SP 800-61 incident response process model?
- APreparationCorrect answer
- BContainmentCorrect answer
- CBaselining
- DCapacity planning
Why this is the answer
NIST SP 800-61 defines Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity; baselining and capacity planning are not process stages.
- Question 30Interactive
Review the severity value in the code block. Based on typical escalation principles, what action should the analyst take for this alert?
- AEscalate to the SOC managerCorrect answer
- BIgnore the alert
- CDelete the log
- DRun a port scan
Why this is the answer
High-severity alerts require escalation to the appropriate level of response rather than being ignored, deleted, or investigated with unrelated tools.
- Question 31Single Choice
In the NIST incident response process, which stage directly follows the containment stage once the threat has been isolated?
- AEradicationCorrect answer
- BRecovery
- CPreparation
- DDetection and Analysis
Why this is the answer
The linear sequence is Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity; containment precedes eradication.
- Question 32Multiple Select
Which of the following actions are typically performed by the Incident Response Team during a security incident?
- AIsolate infected hostsCorrect answer
- BRemove malicious filesCorrect answer
- CApprove external disclosures
- DSet executive compensation
Why this is the answer
The IRT performs technical analysis, containment, eradication, and recovery tasks. External disclosure approval is a management or legal responsibility.
- Question 33Interactive
The command in the code block is commonly run by system administrators. Why is it inappropriate as the first step in a forensic investigation?
- AIt destroys volatile memory evidenceCorrect answer
- BIt makes the hard drive larger
- CIt speeds up the analysis
- DIt prevents unauthorized access
Why this is the answer
A normal shutdown can terminate processes and clear memory, destroying volatile data that must be collected first in a forensic investigation.
Security and Risk Management
7 questions in this domain
- Question 34Single Choice
Under security governance principles, who is ultimately accountable for an organization's security program and its outcomes?
- ABoard of DirectorsCorrect answer
- BChief Information Security Officer
- CIT Director
- DSecurity Steering Committee
Why this is the answer
Ultimate accountability rests with the board of directors; accountability cannot be delegated to implementers such as the CISO.
- Question 35Multiple Select
Which of the following options are considered core components of security governance in the CISSP framework?
- AStrategic alignment with business goalsCorrect answer
- BBoard and senior management oversightCorrect answer
- CDefining risk appetiteCorrect answer
- DConfiguring network firewalls
Why this is the answer
Governance focuses on strategic alignment, executive oversight, and risk appetite; firewall configuration is operational management.
- Question 36Interactive
Review the JSON structure in the code block. Who holds the approval authority for these governance actions?
- ABoard of DirectorsCorrect answer
- BSecurity Analyst
- CNetwork Engineer
- DHelp Desk Manager
Why this is the answer
Board and senior management approve enterprise policies and risk appetite; staff roles implement, not approve.
- Question 37Single Choice
Which statement most accurately distinguishes security governance from regulatory compliance in the CISSP governance framework?
- AGovernance includes strategic alignment; compliance is one output.Correct answer
- BCompliance is the ultimate goal of governance.
- CGovernance and compliance are identical.
- DGovernance is a one-time audit exercise.
Why this is the answer
Compliance is a necessary output of governance, but governance is a strategic, continuous enterprise-wide process.
- Question 38Multiple Select
Which of the following are mandatory legal or regulatory instruments in a security governance context?
- AGDPR regulationCorrect answer
- BHIPAA legislationCorrect answer
- CISO/IEC 27001 standard
- DNIST SP 800-53 framework
Why this is the answer
GDPR and HIPAA are laws; ISO 27001 and NIST are voluntary frameworks unless incorporated by contracts.
- Question 39Interactive
Review the YAML attributes in the code block. How should this legal instrument be classified?
- ACriminal lawCorrect answer
- BCivil law
- CIndustry standard
- DCorporate policy
Why this is the answer
This classification reflects a legislative source, government enforcement, and imprisonment penalties characteristic of criminal law.
- Question 40Single Choice
A data breach affects the personal data of EU residents. Which law governs breach notification obligations?
- AGDPR regulationCorrect answer
- BGLBA law
- CSOX legislation
- DPCI DSS framework
Why this is the answer
GDPR applies extraterritorially to the data of EU residents and mandates 72-hour breach notification duties.
Software Development Security
4 questions in this domain
- Question 41Single Choice
What does application security in the SDLC emphasize most?
- AAdding security testing only before release
- BIntegrating security controls and verification into every phase of developmentCorrect answer
- CDeploying a web application firewall after deployment
- DOutsourcing all security activities to an external vendor
Why this is the answer
Application security is a continuous, proactive effort embedded in each SDLC phase, not a final inspection or standalone tool.
- Question 42Multiple Select
Which activities are performed during the design phase of a secure SDLC? (Select all that apply)
- AThreat modelingCorrect answer
- BApplying secure design principlesCorrect answer
- CDeploying the application to production
- DExecuting DAST against a running instance
Why this is the answer
Threat modeling and secure design principles are performed before code is written. Deployment and DAST occur later in the lifecycle.
- Question 43Interactive
The code block constructs a database query by concatenating user input. Which control most effectively eliminates the injection risk?
- AParameterized queries or prepared statementsCorrect answer
- BBlocklisting SQL keywords
- CAdding a Web Application Firewall
- DEncrypting the database connection
Why this is the answer
Parameterized prepared statements separate SQL code from data, preventing injection. Blacklists and firewalls can be bypassed.
- Question 44Single Choice
Which testing technique scans source code without executing the application?
- ASASTCorrect answer
- BDAST
- CRASP
- DPenetration testing
Why this is the answer
Static Application Security Testing (SAST) is white-box and analyzes source code, bytecode, or binaries without execution.
Frequently asked questions
Everything about the ISC2 CISSP question bank and how to use it.