Questions & answers (free, no sign-in needed)
- View
10 beginner questions across the eight CISSP domains: risk responses, data ownership, symmetric cryptography, IPsec tunnels, authentication factors and access control models, penetration testing, chain of custody, recovery point objectives and preventing SQL injection.
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
A company finds that a planned online service would create a privacy risk that it cannot reduce to an acceptable level, so it decides not to launch the service. Which risk response is this?
- A. Risk acceptance
- B. Risk transfer
- C. Risk avoidance ✔ correct
- D. Risk mitigation
Answer: C. Risk avoidance removes the risk by not doing the risky activity. Transfer shifts the impact to another party (for example insurance), mitigation reduces it with controls and acceptance keeps it as it is.
Source: csrc.nist.gov/glossary/term/risk_response · Domain: Security and Risk Management
The HR director is accountable for employee records and decides how they are protected and who may access them, while the IT team runs the backups. Which role does the HR director hold?
- A. Data custodian
- B. Information (data) owner ✔ correct
- C. Data processor
- D. System administrator
Answer: B. The information owner has authority over the information and is responsible for deciding the controls for it. The IT team that runs backups acts as a data custodian, carrying out the owner's decisions.
Source: csrc.nist.gov/glossary/term/information_owner · Domain: Asset Security
Which of these is a symmetric encryption algorithm that uses the same secret key to encrypt and decrypt?
- A. AES ✔ correct
- B. RSA
- C. ECDSA
- D. Diffie-Hellman
Answer: A. AES (FIPS 197) is a symmetric block cipher. RSA and ECDSA are asymmetric (public key) algorithms, and Diffie-Hellman is an asymmetric key agreement method used to establish a shared secret.
Source: nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf · Domain: Security Architecture and Engineering
A company wants to connect two branch offices over the internet with an encrypted tunnel that protects all IP traffic between their networks. Which protocol suite is designed for this?
- A. SNMPv2c
- B. TFTP
- C. Telnet
- D. IPsec ✔ correct
Answer: D. IPsec provides confidentiality, integrity and authentication at the IP layer and is widely used for site-to-site VPN tunnels. SNMPv2c, TFTP and Telnet send data without encryption.
Source: www.rfc-editor.org/rfc/rfc4301 · Domain: Communication and Network Security
Which two are examples of the "something you have" authentication factor? (Select TWO)
- A. A hardware security key ✔ correct
- B. A password
- C. A fingerprint scan
- D. A smart card ✔ correct
- E. A memorized PIN
Answer: A, D. Something you have is a physical device the user possesses, such as a hardware key or smart card. Passwords and PINs are something you know, and a fingerprint is something you are.
Source: csrc.nist.gov/glossary/term/multi_factor_authentication · Domain: Identity and Access Management (IAM)
In which access control model can the owner of a file decide which other users may access it?
- A. Mandatory access control (MAC)
- B. Role-based access control (RBAC)
- C. Discretionary access control (DAC) ✔ correct
- D. Attribute-based access control (ABAC)
Answer: C. In DAC the owner of an object decides who gets access, as with file permissions on a typical desktop. In MAC the system enforces labels set by policy, RBAC grants rights by role and ABAC evaluates attributes.
Source: csrc.nist.gov/glossary/term/discretionary_access_control · Domain: Identity and Access Management (IAM)
An organization hires an authorized team to act like real attackers and try to bypass the security of its network and applications. What type of assessment is this?
- A. Vulnerability scan
- B. Penetration test ✔ correct
- C. Compliance audit
- D. Code review
Answer: B. A penetration test simulates real attacks to find ways around security controls, often by actually exploiting weaknesses. A vulnerability scan only identifies possible weaknesses without exploiting them.
Source: csrc.nist.gov/glossary/term/penetration_testing · Domain: Security Assessment and Testing
During an investigation, an analyst records every person who handled a seized laptop, with the date, time and purpose of each transfer. What is this record called?
- A. Chain of custody ✔ correct
- B. Legal hold
- C. Change log
- D. Incident ticket
Answer: A. Chain of custody documents each person who handled the evidence and when it was collected or transferred. It shows the evidence was not tampered with, so it can be relied on in legal proceedings.
Source: csrc.nist.gov/glossary/term/chain_of_custody · Domain: Security Operations
The recovery point objective (RPO) is the point in time to which data must be recovered after an outage, so it reflects how much data loss is acceptable.
- A. True ✔ correct
- B. False
Answer: A. True. RPO is the point in time to which data must be restored. For example, a 4-hour RPO means backups or replication must allow restoring data no older than 4 hours before the outage.
Source: csrc.nist.gov/glossary/term/recovery_point_objective · Domain: Security Operations
A developer replaces SQL statements built by joining strings with parameterized queries (prepared statements). Which attack does this mainly prevent?
- A. Cross-site request forgery
- B. Clickjacking
- C. Buffer overflow
- D. SQL injection ✔ correct
Answer: D. Parameterized queries keep the SQL code separate from user data, so input cannot change the query's logic. This is the primary defense against SQL injection.
Source: cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html · Domain: Software Development Security
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public ISC2 exam objectives (CISSP exam outline effective 2024-04-15 (a new outline takes effect 2027-04-15)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by ISC2; exam names are trademarks of their owners. Official exam page: www.isc2.org/certifications/cissp/cissp-certification-exam-outline.