Practice for the CISSP exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your company is evaluating a cloud provider to host financial systems. During due diligence, auditors ask which third-pa. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CISSP practice test →
What you will practice
- Your company is evaluating a cloud provider to host financial systems. During due diligence, auditors ask whi…
- During a GDPR compliance review, executives ask who in the organization is ultimately responsible for classif…
- Your multinational firm discovers that a regional office is storing EU citizens' personal data without proper…
- A company is designing a new data center. The security architect is applying Crime Prevention Through Environ…
- A financial firm conducts a Business Impact Analysis (BIA) to prepare for disasters. During the review, the c…
- A company's CISO wants to track security vulnerability trends across the industry to understand which types o…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your company is evaluating a cloud provider to host financial systems. During due diligence, auditors ask which third-party assurance report would be BEST for validating that the provider's controls protect confidentiality, integrity, and…
Answer: A. SOC 2
A SOC 2 report is the correct choice because it assesses service providers against the Trust Services Criteria, which include security, availability, and confidentiality. Do not let the word financial mislead you into choosing SOC 1, which focuses strictly on financial reporting controls.
Q2. During a GDPR compliance review, executives ask who in the organization is ultimately responsible for classifying and determining protection requirements for sensitive customer data.
Answer: A. Data Owner, defines classification, determines sensitivity, and sets requirements for use
The Data Owner holds ultimate responsibility for classifying information and setting protection requirements, aligning with the Data Controller role under GDPR. Custodians handle the day-to-day technical enforcement, but they do not dictate the classification rules.
Q3. Your multinational firm discovers that a regional office is storing EU citizens' personal data without proper GDPR consent records. Local management argues that deleting the data will disrupt contracts with U.S. clients who depend on it fo…
Answer: B. Temporarily suspend use of the data and notify Legal for GDPR compliance assessment
Temporarily suspending data use and notifying Legal is the correct answer because regulatory compliance always supersedes operational convenience. For the exam, remember that technical controls like encryption do not cure a missing legal basis for processing data.
Q4. A company is designing a new data center. The security architect is applying Crime Prevention Through Environmental Design (CPTED) principles to reduce physical threats. Which sequence of security measures best represents the correct order…
Answer: B. Deter: Detect: Delay: Respond
Proactive physical security dictates deterring an attacker first, then detecting them if they proceed, and delaying their progress. Responding is always the final step, as you cannot neutralize a physical threat until after it has been identified.
Q5. A financial firm conducts a Business Impact Analysis (BIA) to prepare for disasters. During the review, the continuity planner must determine how much downtime each system can tolerate before the business suffers unacceptable loss. Which s…
Answer: C. The shorter the MTD, the higher the recovery cost
A short Maximum Tolerable Downtime requires faster recovery methods, which significantly increases overall costs. For the exam, remember that zero downtime requires expensive redundant hot sites, whereas longer tolerance windows allow cheaper cold site alternatives.
Q6. A company's CISO wants to track security vulnerability trends across the industry to understand which types of weaknesses are becoming more common and how severe they are. Which resource provides the best information for this purpose?
Answer: B. Common Vulnerability Scoring System (CVSS)
The Common Vulnerability Scoring System provides standardized numerical severity scores to help organizations analyze trends and prioritize remediation efforts. However, the Common Vulnerabilities and Exposures list is actually required to identify which specific system weaknesses are emerging globally.
Q7. During a recent audit, the SOC manager notices that the organization's Security Information and Event Management (SIEM) platform has not generated any alerts for over two weeks, even though minor security incidents were reported manually…
Answer: A. The SIEM's correlation rules or data feeds may have failed
A sudden lack of alerts from an active SIEM usually points to a failure in data ingestion or correlation rules. Silence indicates a potential loss of visibility, not improved security. If logs are not feeding the engine, the tool cannot detect threats.
Q8. A company's information security program has been approved, but the CISO reports that several initiatives cannot move forward due to lack of budget and staff. Who is ultimately accountable for ensuring that adequate resources are made avai…
Answer: B. Chief Executive Officer (CEO)
Senior management, such as the CEO, is ultimately accountable for allocating adequate resources to security initiatives. While the CISO handles implementation, executive leadership must provide the budget and staff to execute the program.
Q9. Your organization's public website is hosted in a DMZ, but a recent penetration test shows attackers can pivot from the web server to the internal network via misconfigured routes. Executives ask how to prevent similar attacks while mainta…
Answer: B. Implement a reverse proxy to isolate backend systems from direct Internet access
A reverse proxy isolates backend systems by terminating external connections and forwarding only validated requests. This prevents attackers from pivoting. Deploying an IDS only detects intrusions, whereas a proxy actively prevents network traversal.
Q10. Your SOC identifies malware spreading on a file server. The malware has not yet caused major disruption, but analysts confirm it is actively replicating across shared drives. Executives demand to know what should be done NEXT.
Answer: A. Contain the incident by isolating the infected server from the network
The immediate next step is to contain the incident by isolating the infected server, which stops the malware from spreading further. Eradication and recovery happen later; you must always stop the bleeding before performing actual cleanup.
Q11. Your company is considering launching a mobile banking app. Risk analysis shows potential fraud losses of $25 million annually, insurance coverage capped at $5 million, and strong fraud controls that can reduce losses to $3 million. Howeve…
Answer: H. Mitigate, implement strong fraud detection controls to reduce the annual loss
Mitigation is the best choice because implementing strong fraud controls reduces the annual loss expectancy to a tolerable three million dollars, safeguarding the massive revenue projection. Transferring the risk fails because the insurance cap leaves a massive exposure.
Q12. A bank performs a quantitative risk analysis for a potential ransomware event affecting its trading systems. Findings: Asset value (AV): $20 million; Exposure factor (EF): 25%; Annual rate of occurrence (ARO): 0.5 (once every 2 years). Pro…
Answer: G. Implement the control, it is cost-effective and reduces impact to an acceptable level
Implementing the control is justified because the two million dollar annual loss reduction far exceeds the four hundred thousand dollar cost. A positive return on investment dictates action. Do not delay a clear quantitative decision by requesting unnecessary qualitative rankings.
Q13. A financial institution uses digital signatures for transactions. An internal audit finds expired and duplicated certificates across multiple business units. Executives want "one system" to prevent recurrence, ensure compliance, and simpli…
Answer: C. Deploy a centralized Public Key Infrastructure (PKI) with automated certificate issuance and revocation
A centralized Public Key Infrastructure with automated lifecycle management is correct because it directly resolves certificate sprawl and enforces governance across the enterprise. Manual reviews or relying solely on hardware security modules fail to provide comprehensive lifecycle automation.
Q14. Your SOC detects malware spreading across several internal file servers. The servers are critical to daily operations, but analysts confirm the malware is still actively replicating and beaconing out to an external IP. Executives demand to…
Answer: D. Contain the infection by isolating the impacted servers from the network
Isolating the impacted servers is the correct next step because containment halts active spread and limits further damage before eradication begins. Jumping straight to eradication or recovery risks missing infection vectors or reintroducing the malware.
Q15. A multinational healthcare organization is designing an access control system for its cloud-based research environment. The system must restrict access based on data sensitivity and clearance level, prevent users from changing permissions…
Answer: G. Mandatory Access Control (MAC)
Mandatory Access Control is correct because it enforces strict, centrally defined rules based on clearance levels and data classification to provide the highest confidentiality assurance. Unlike discretionary access control, users cannot change permissions on files they do not own.
Q16. Your company is expanding operations into the European Union and will process personal data of EU citizens. During project review, the CIO asks what must be addressed FIRST to reduce the organization's risk of penalties.
Answer: B. Encrypt all EU personal data at rest and in transit using industry-standard algorithms
Addressing legal and regulatory requirements like establishing a data processing agreement is the critical first step to avoid massive fines. Technical controls like encryption and DLP are important safeguards, but they do not fulfill the structural compliance mandates demanded by regulators.
More CISSP drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.