Practice for the CISSP exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A multinational company plans to migrate its critical databases to a public cloud provider. During the planning phase, t. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CISSP practice test →
What you will practice
- A multinational company plans to migrate its critical databases to a public cloud provider. During the planni…
- A pharmaceutical company's R&D division needs to transfer proprietary research data to a partner organization…
- A large hospital network is implementing a new electronic health records (EHR) system. During the rollout, th…
- A multinational company wants to ensure that executives can send signed and encrypted emails between offices…
- Your organization is evaluating a cloud vendor that will process financial transaction data subject to Sarban…
- A multinational healthcare organization headquartered in Toronto collects personal medical information from p…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A multinational company plans to migrate its critical databases to a public cloud provider. During the planning phase, the legal team raises concerns about the varying privacy regulations in different countries where the company operates…
Answer: A. Review data residency and privacy requirements for each jurisdiction involved
Reviewing data residency and privacy requirements for each jurisdiction is correct because a security manager must perform due diligence to understand legal constraints before designing cloud architecture. Technical controls like encryption are implemented only after confirming these regulatory obligations.
Q2. A pharmaceutical company's R&D division needs to transfer proprietary research data to a partner organization overseas for joint development. Both firms have signed NDAs, and a secure VPN tunnel is already established. The CISO is asked ho…
Answer: A. Require digital signatures and encryption at the file level before transfer
Requiring digital signatures and file-level encryption is correct because applying controls directly to the data ensures end-to-end confidentiality and integrity outside the secure tunnel. Relying solely on a VPN provides transport security but leaves data exposed once it reaches the endpoint.
Q3. A large hospital network is implementing a new electronic health records (EHR) system. During the rollout, the CIO wants to ensure that the system maintains both data integrity and availability in the event of a hardware failure or power l…
Answer: A. Implement RAID with regular database replication across multiple sites
Implementing RAID with regular database replication is correct because combining hardware redundancy with cross-site replication ensures continuous availability and protects data integrity. Nightly backups or uninterruptible power supplies alone cannot guarantee seamless operational continuity during hardware failures.
Q4. A multinational company wants to ensure that executives can send signed and encrypted emails between offices in the U.S. and Europe. They want to ensure confidentiality, integrity, and non-repudiation while using existing corporate email i…
Answer: B. S/MIME
S/MIME integrates directly into enterprise email systems like Exchange to provide end-to-end encryption and digital signatures. While TLS secures the transmission channel, it does not protect the data at rest or provide user-level non-repudiation.
Q5. Your organization is evaluating a cloud vendor that will process financial transaction data subject to Sarbanes–Oxley (SOX) controls. Senior management asks which third-party assurance report best demonstrates that the vendor's internal co…
Answer: C. SOC 2 Type II
A SOC 2 Type II report verifies the operational effectiveness of security controls over time. For vendor risk assessments, remember that SOC 1 focuses strictly on financial reporting, whereas SOC 2 focuses directly on security and availability.
Q6. A multinational healthcare organization headquartered in Toronto collects personal medical information from patients across Canada. The Chief Privacy Officer must ensure compliance with Canadian federal privacy legislation that governs how…
Answer: A. Personal Information Protection and Electronic Documents Act (PIPEDA)
PIPEDA is the Canadian federal privacy law regulating how private-sector organizations handle personal data. Match the jurisdiction to the scenario, recognizing that HIPAA applies to the United States and FIPPA typically governs Canadian public sector entities.
Q7. A European retailer hires a third-party marketing analytics company to process customer purchase data in order to identify buying trends. The retailer determines why and how the customer data will be analyzed, while the marketing company o…
Answer: B. The retailer is the Data Controller; the marketing company is the Data Processor
Under the GDPR, the data controller determines why and how personal data is processed, while the processor acts on their behalf. Focus on who holds ultimate decision authority over the data, as that entity retains legal compliance accountability.
Q8. A company is designing a secure file-transfer system between two business partners. Each transfer must ensure confidentiality and authentication, but performance and scalability are critical because thousands of files are exchanged daily…
Answer: B. Use symmetric encryption for bulk data and asymmetric encryption for key exchange
Hybrid encryption uses fast symmetric algorithms for bulk data and asymmetric algorithms to securely exchange those keys. Relying purely on asymmetric encryption for large volumes of data would create severe performance bottlenecks and limit scalability.
Q9. Your company's mobile development team is implementing secure communication for a new mobile banking app. The app will run on limited-resource devices and must perform key exchange and digital signing efficiently, while maintaining equival…
Answer: D. ECC (Elliptic Curve Cryptography)
Elliptic Curve Cryptography provides strong security with much smaller key sizes, making it highly efficient for mobile devices. RSA requires significantly larger keys to match this strength, demanding more computational overhead and draining battery life.
Q10. An organization's CISO is developing a new enterprise security awareness program. The plan requires funding, staffing, and executive approval to be successful. Who holds the ultimate responsibility to ensure that adequate resources are pro…
Answer: C. Senior Management / Executive Management
Senior management holds ultimate accountability for organizational security and must allocate the necessary funding and staffing. Responsibility for daily operations can be delegated downward to a security manager, but final accountability remains with executives.
Q11. During the final stage of an application's pre-production testing, the QA team wants to identify runtime vulnerabilities such as SQL injection, cross-site scripting, and authentication flaws, but does not have access to the source code. Wh…
Answer: B. Dynamic Application Security Testing (DAST)
Dynamic Application Security Testing evaluates a running application from the outside without requiring underlying source code access. Conversely, Static Application Security Testing analyzes source code internally during early development phases rather than evaluating live runtime behavior.
Q12. A web application developer is tasked with improving the security of the front end of an online banking portal. Which of the following controls best represent front-end security measures?
Answer: A. Input validation and client-side encryption
Input validation and client-side encryption operate directly within the user interface layer to protect data before it reaches backend servers. Database parameterization and role-based access control are backend controls that secure server-side data rather than client-facing interfaces.
Q13. A multinational enterprise is transitioning from a traditional perimeter-based security model to Zero Trust Architecture (ZTA). Which of the following technologies or principles best embody the Zero Trust approach?
Answer: B. Implementing continuous authentication and micro-segmentation
Implementing continuous authentication and micro-segmentation directly enforces the core Zero Trust philosophy of never trusting implicitly. Traditional security approaches rely on strong perimeter firewalls or VPN tunnels, which incorrectly assume internal network traffic is completely safe.
Q14. During an incident response, analysts discover that a critical application server was compromised by a zero-day exploit. The attacker exfiltrated sensitive design documents. Management asks you, as the CISO, what the FIRST priority should…
Answer: A. Contain the attack by disconnecting the server from the network
The first priority is containment to stop ongoing data exfiltration and limit further business impact. While preserving volatile evidence is critical, you must stop the bleeding first; letting attackers continue stealing data just to gather perfect logs is unacceptable.
Q15. A global bank is adopting a Zero Trust Architecture (ZTA). The CISO stresses that the design must prevent lateral movement inside the network, continuously enforce least privilege access, and satisfy regulatory auditors who require visibil…
Answer: F. Implement continuous identity verification and microsegmentation with policy-based access enforcement
Continuous identity verification and microsegmentation with policy-based enforcement successfully cover all three required Zero Trust outcomes. Single sign-on or multifactor authentication only validates the initial login and fails to stop lateral movement once a device connects.
Q16. A multinational bank must test its Disaster Recovery Plan (DRP) for a mission-critical payment system. Executives insist the test must demonstrate real operational readiness, process live transactions in a controlled manner, and minimize r…
Answer: G. Parallel test, activate the alternate site and process live transactions while production continues
A parallel test activates the alternate site and processes live transactions while production continues, balancing operational readiness with minimal disruption. Full interruption tests carry unacceptable risk, while simulations lack the real transaction processing required by executives.
More CISSP drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.