Practice for the CISSP exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your company is designing a new e-commerce platform. During testing, a vulnerability scan reveals potential for SQL inje. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CISSP practice test →
What you will practice
- Your company is designing a new e-commerce platform. During testing, a vulnerability scan reveals potential f…
- Your security operations team detects unusual outbound traffic from a finance server that may indicate an on-…
- Your company is building a new DevOps pipeline. During a security review, auditors warn that vulnerabilities…
- An employee reports receiving an email that appeared to come from the company's HR department, asking them to…
- A global financial company is moving customer authentication from passwords alone to a new solution. Manageme…
- A developer pushes a critical patch directly into production without going through the organization's change…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your company is designing a new e-commerce platform. During testing, a vulnerability scan reveals potential for SQL injection on the customer login page. The developers propose multiple options, and management asks you what is the BEST nex…
Answer: A. Train developers on secure coding practices and enforce input validation in the application code
Secure coding practices and strict input validation directly resolve the root cause of injection vulnerabilities within the application itself. While a Web Application Firewall is a valuable compensating control, it does not actually fix the underlying flawed code and can potentially be bypassed.
Q2. Your security operations team detects unusual outbound traffic from a finance server that may indicate an on-path (man-in-the-middle) attack. The CEO demands assurance that customer financial data has not been tampered with during transmis…
Answer: A. Implementing Transport Layer Security (TLS) with digital certificates
Transport Layer Security with digital certificates provides both encryption and cryptographic integrity checks, ensuring data cannot be altered in transit. A host-based IDS only detects anomalies after they occur, while segmentation does not guarantee protection against active interception.
Q3. Your company is building a new DevOps pipeline. During a security review, auditors warn that vulnerabilities may go unnoticed if testing isn't integrated into the development process. As the security manager, what is the BEST way to addres…
Answer: B. Integrate automated static and dynamic application security testing into the CI/CD pipeline
Integrating automated SAST and DAST directly into the pipeline continuously identifies vulnerabilities early without slowing down rapid deployments. Manual code reviews and penetration tests are valuable, but they do not scale effectively for fast-paced continuous integration and delivery environments.
Q4. An employee reports receiving an email that appeared to come from the company's HR department, asking them to update personal information through a suspicious link. After investigating, you confirm this is a phishing attempt targeting mult…
Answer: D. Block the malicious domain and URLs through the organization's email and web filters
Blocking the malicious domain and URLs at technical filters is the most effective immediate containment step to halt active exploitation. User training and email reminders are important preventative measures, but they are long-term solutions and will not stop the ongoing attack.
Q5. A global financial company is moving customer authentication from passwords alone to a new solution. Management wants the strongest assurance of identity while balancing usability. Which of the following is the BEST option to implement?
Answer: C. Fingerprint biometrics with device certificates
Combining fingerprint biometrics with device certificates implements robust multi-factor authentication using something you are and something you have. SMS-based passwords are easily intercepted via SIM swapping, and both factors must be independent types to provide true multi-factor assurance.
Q6. A developer pushes a critical patch directly into production without going through the organization's change management process. A week later, the patch causes system downtime during peak business hours. Senior management asks how this sit…
Answer: B. Enforce strict change management with a Change Advisory Board (CAB) review
Enforcing strict change management with Change Advisory Board oversight directly prevents unauthorized code from bypassing risk evaluation before deployment. Automated regression testing is important, but it is a technical control that fails to address the core governance failure.
Q7. An attacker launches a ransomware attack that encrypts your company's file servers, halting all order processing. The IT team reports they cannot immediately restore the servers. Executives demand to know how customer orders can continue w…
Answer: C. Business Continuity Plan
The Business Continuity Plan directly addresses keeping critical business operations running during a disruption. For the exam, distinguish BCP from Disaster Recovery; BCP focuses on business survival, while DRP focuses specifically on restoring IT infrastructure.
Q8. During an insider investigation, security staff discover a USB drive connected to a finance workstation. The drive may contain exfiltrated customer data. The lead investigator instructs the team to carefully remove the USB and prepare it f…
Answer: D. Record a detailed chain of custody documenting who handled the evidence and when
A documented chain of custody legally proves that evidence was handled properly and not tampered with after collection. While write blockers and forensic imaging preserve data integrity, chain of custody is the absolute requirement for legal admissibility in court.
Q9. Your company is migrating its customer payment processing system to a public cloud provider (IaaS). During a compliance review, auditors warn that a breach of cardholder data could trigger PCI DSS fines and destroy customer trust. Which re…
Answer: A. Implementing and managing strong access controls for applications that process cardholder data
In the Infrastructure as a Service shared responsibility model, the customer always retains accountability for securing their applications, data, and access controls. You cannot outsource regulatory liability, so relying on provider audits or notifications does not mitigate your direct compliance risk.
Q10. Your company is updating its Business Continuity Plan (BCP) after opening two new global offices. Executives ask what should be done FIRST when revising the plan.
Answer: A. Conduct a Business Impact Analysis (BIA) to identify critical processes and dependencies
Conducting a Business Impact Analysis identifies critical business processes, dependencies, and recovery time objectives. For the exam, remember the standard lifecycle order: the BIA establishes what matters most before you assess risks or update disaster recovery site contracts.
Q11. A startup is developing a mobile payment app. The app must provide lightweight encryption that works efficiently on smartphones with limited processing power while still ensuring strong security to share keys. Which algorithm is the BEST c…
Answer: C. Elliptic Curve Cryptography (ECC)
Elliptic Curve Cryptography provides strong security with much smaller key sizes, making it computationally efficient for mobile devices. For the exam, when you see a scenario requiring strong cryptography with lightweight processing constraints, immediately look for ECC.
Q12. A financial services company recently suffered a breach when an employee connected a personal, malware-infected laptop to the internal network. Executives want a control that will STOP unauthorized or non-compliant devices from connecting…
Answer: A. Network Access Control (NAC)
Network Access Control enforces pre-admission security checks to block unauthorized or non-compliant devices from connecting. Intrusion prevention systems and firewalls act after the device connects, which fails the requirement to stop the connection beforehand.
Q13. Your organization stores customer financial records in a public cloud provider's object-storage service. The compliance officer requires that when the data retention period ends, the data must be permanently deleted so it cannot be recover…
Answer: C. Use the provider's cryptographic erasure function
Cryptographic erasure destroys the encryption keys protecting the data, rendering the ciphertext permanently unreadable. In cloud environments, you rarely have direct physical access to the underlying storage media to perform traditional overwriting or block-level wiping.
Q14. A software assurance manager is reviewing a critical payroll web application before deployment. The team wants to find vulnerabilities in the source code itself, such as buffer overflows, input validation flaws, or insecure functions, with…
Answer: A. Static application security testing (SAST)
Static application security testing analyzes source code without executing it to find flaws like insecure functions. Dynamic application security testing evaluates a running application from the outside, whereas fuzzing actively throws random data at it.
Q15. A multinational healthcare provider is migrating sensitive patient records into a new SaaS platform hosted by a third-party cloud vendor. During the risk assessment, executives are concerned about regulatory compliance across regions (e.g…
Answer: A. Review and sign a data processing agreement (DPA) with the cloud vendor to ensure compliance obligations are met
A Data Processing Agreement establishes the legal and contractual obligations required for regulatory compliance before sharing sensitive data. While technical controls like encryption and audits are essential, management must ensure contractual compliance gaps are closed before migration begins.
Q16. Your organization recently experienced a tailgating incident, where an unauthorized individual followed an employee into the data center. The CEO asks you what is the BEST preventive control to stop this from happening again.
Answer: B. Deploying mantraps with biometric authentication
A mantrap provides a strong physical preventive control by physically preventing more than one person from entering at a time. Cameras are only detective controls, and relying solely on guards or training leaves security dependent on inconsistent human behavior.
More CISSP drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.