Certified Information Systems Security Professional (CISSP)
Last Update Nov 30, 2025
Total Questions : 1486
We are offering FREE CISSP ISC exam questions. All you do is to just go and sign up. Give your details, prepare CISSP free exam questions and then go for complete pool of Certified Information Systems Security Professional (CISSP) test questions that will help you more.
Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee’s salary?
Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?
Which component of the Security Content Automation Protocol (SCAP) specification contains the data required to estimate the severity of vulnerabilities identified automated vulnerability assessments?
Who in the organization is accountable for classification of data information assets?
What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?
The use of private and public encryption keys is fundamental in the implementation of which of the following?
Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?
Which security service is served by the process of encryption plaintext with the sender’s private key and decrypting cipher text with the sender’s public key?
Which technique helps system designers consider potential security concerns of their systems and applications?
An employee's home address should be categorized according to which of the following references?
An attacker has intruded into the source code management system and is able to download but not modify the code. Which of the following aspects of the code theft has the HIGHEST security impact?
Which of the following is used to ensure that data mining activities Will NOT reveal sensitive data?
During a Disaster Recovery (DR) simulation, it is discovered that the shared recovery site lacks adequate data restoration capabilities to support the implementation of multiple plans simultaneously. What would be impacted by this fact if left unchanged?
In which process MUST security be considered during the acquisition of new software?
Which of the following is the PRIMARY reason for selecting the appropriate level of detail for audit record generation?
The Rivest-Shamir-Adleman (RSA) algorithm is BEST suited for which of the following operations?
Which of the following phases in the software acquisition process does developing evaluation criteria take place?
Which of the following is the BEST method a security practitioner can use to ensure that systems and sub-systems gracefully handle invalid input?
Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?
At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?
What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?
What is the MOST important step during forensic analysis when trying to learn the purpose of an unknown application?
Recovery strategies of a Disaster Recovery planning (DRIP) MUST be aligned with which of the following?
With what frequency should monitoring of a control occur when implementing Information Security Continuous Monitoring (ISCM) solutions?
A continuous information security monitoring program can BEST reduce risk through which of the following?
Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?
Which of the following is the FIRST step in the incident response process?
A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?
What is the expected outcome of security awareness in support of a security awareness program?
When adopting software as a service (Saas), which security responsibility will remain with remain with the adopting organization?
Which of the following is the weakest form of protection for an application that handles Personally Identifiable Information (PII)?
Digital certificates used transport Layer security (TLS) support which of the following?
An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?
Match the level of evaluation to the correct common criteria (CC) assurance level.
Drag each level of evaluation on the left to is corresponding CC assurance level on the right
What is the PRIMARY purpose for an organization to conduct a security audit?
Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?
A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected. What is the MOST probable security feature of Java preventing the program from operating as intended?
What is the BEST approach to addressing security issues in legacy web applications?
Which of the following is the BEST method to prevent malware from being introduced into a production environment?
Which of the following is the PRIMARY risk with using open source software in a commercial software construction?
The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?
When implementing controls in a heterogeneous end-point network for an organization, it is critical that
Which of the following is an attacker MOST likely to target to gain privileged access to a system?
In Business Continuity Planning (BCP), what is the importance of documenting business processes?
When implementing a data classification program, why is it important to avoid too much granularity?
Which of the following BEST describes the responsibilities of a data owner?
Which of the following is an initial consideration when developing an information security management system?
Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?
Which of the following is MOST important when assigning ownership of an asset to a department?
An organization has doubled in size due to a rapid market share increase. The size of the Information Technology (IT) staff has maintained pace with this growth. The organization hires several contractors whose onsite time is limited. The IT department has pushed its limits building servers and rolling out workstations and has a backlog of account management requests.
Which contract is BEST in offloading the task from the IT staff?
Refer to the information below to answer the question.
An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.
When determining appropriate resource allocation, which of the following is MOST important to monitor?
Which of the following secure startup mechanisms are PRIMARILY designed to thwart attacks?
The use of proximity card to gain access to a building is an example of what type of security control?
Which of the following is a critical factor for implementing a successful data classification program?
Refer to the information below to answer the question.
Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.
After magnetic drives were degaussed twice according to the product manufacturer's directions, what is the MOST LIKELY security issue with degaussing?
According to best practice, which of the following is required when implementing third party software in a production environment?
Which of the following is the BEST reason to review audit logs periodically?
Which of the following MOST influences the design of the organization's electronic monitoring policies?
According to best practice, which of the following groups is the MOST effective in performing an information security compliance audit?
Refer to the information below to answer the question.
A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.
Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?
Which of the following violates identity and access management best practices?
Refer to the information below to answer the question.
An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.
Which of the following is considered the MOST important priority for the information security officer?
What is the MOST important consideration from a data security perspective when an organization plans to relocate?
Which of the following represents the GREATEST risk to data confidentiality?
An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?
Which of the following actions will reduce risk to a laptop before traveling to a high risk area?
What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?
A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?
What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24 hours?
Which of the following is a PRIMARY advantage of using a third-party identity service?
An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?
Which of the following is generally indicative of a replay attack when dealing with biometric authentication?
Data leakage of sensitive information is MOST often concealed by which of the following?
Which of the following roles has the obligation to ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization?
In the Open System Interconnection (OSI) model, which layer is responsible for the transmission of binary data over a communications network?
A Simple Power Analysis (SPA) attack against a device directly observes which of the following?
Which of the following command line tools can be used in the reconnaisance phase of a network vulnerability assessment?
Which one of the following operates at the session, transport, or network layer of the Open System Interconnection (OSI) model?
How can lessons learned from business continuity training and actual recovery incidents BEST be used?
An employee of a retail company has been granted an extended leave of absence by Human Resources (HR). This information has been formally communicated to the access provisioning team. Which of the following is the BEST action to take?
A security architect plans to reference a Mandatory Access Control (MAC) model for implementation. This indicates that which of the following properties are being prioritized?
A proxy firewall operates at what layer of the Open System Interconnection (OSI) model?
The goal of a Business Impact Analysis (BIA) is to determine which of the following?
During the Security Assessment and Authorization process, what is the PRIMARY purpose for conducting a hardware and software inventory?
Which of the following are effective countermeasures against passive network-layer attacks?
Which of the following would BEST describe the role directly responsible for data within an organization?
In general, servers that are facing the Internet should be placed in a demilitarized zone (DMZ). What is MAIN purpose of the DMZ?
A company was ranked as high in the following National Institute of Standards and Technology (NIST) functions: Protect, Detect, Respond and Recover. However, a low maturity grade was attributed to the Identify function. In which of the following the controls categories does this company need to improve when analyzing its processes individually?
Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?
Which of the following is of GREATEST assistance to auditors when reviewing system configurations?
In which of the following programs is it MOST important to include the collection of security process data?
A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user’s access to data files?
Which of the following could cause a Denial of Service (DoS) against an authentication system?
When determining who can accept the risk associated with a vulnerability, which of the following is MOST
important?
As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website. Which of the following actions would be performed?
Which of the following steps should be performed FIRST when purchasing Commercial Off-The-Shelf (COTS) software?
Which security access policy contains fixed security attributes that are used by the system to determine a
user’s access to a file or object?
The core component of Role Based Access Control (RBAC) must be constructed of defined data elements.
Which elements are required?
Extensible Authentication Protocol-Message Digest 5 (EAP-MD5) only provides which of the following?
A company receives an email threat informing of an Imminent Distributed Denial of Service (DDoS) attack
targeting its web application, unless ransom is paid. Which of the following techniques BEST addresses that threat?
Which of the following is a common feature of an Identity as a Service (IDaaS) solution?
Which one of the following is an advantage of an effective release control strategy form a configuration control standpoint?
Which of the following methods of suppressing a fire is environmentally friendly and the MOST appropriate for a data center?
An organization recently conducted a review of the security of its network applications. One of the
vulnerabilities found was that the session key used in encrypting sensitive information to a third party server had been hard-coded in the client and server applications. Which of the following would be MOST effective in mitigating this vulnerability?
Which of the following is the PRIMARY benefit of implementing data-in-use controls?
The PRIMARY characteristic of a Distributed Denial of Service (DDoS) attack is that it
Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.
What is the PRIMARY difference between security policies and security procedures?
Which of the following is the BEST method to assess the effectiveness of an organization's vulnerability management program?
TESTED 30 Nov 2025
