Practice for the CISSP exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A water-treatment facility operates multiple Industrial Control Systems (ICS) that manage pumps, valves, and chemical do. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CISSP practice test →
What you will practice
- A water-treatment facility operates multiple Industrial Control Systems (ICS) that manage pumps, valves, and…
- An organization hires an independent consultant to perform penetration testing on its network after obtaining…
- A regional bank's data center experiences an outage due to a power failure. During the Business Impact Analys…
- A healthcare organization is modernizing its internal network using a Zero Trust architecture. The CISO wants…
- A secure research lab applies multiple CPTED (Crime Prevention Through Environmental Design) principles. Secu…
- During an internal security review, it's discovered that several departments are classifying customer data in…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A water-treatment facility operates multiple Industrial Control Systems (ICS) that manage pumps, valves, and chemical dosing. When assessing the security posture of these systems, the security architect emphasizes human safety and system r…
Answer: D. Availability and Safety
Availability and safety represent the highest priorities in Industrial Control Systems because operational failure directly risks human life and physical infrastructure. Unlike corporate information technology environments, industrial systems prioritize continuous machinery operation over strict data confidentiality.
Q2. An organization hires an independent consultant to perform penetration testing on its network after obtaining written authorization from the CIO. The consultant's job is to identify exploitable weaknesses without disrupting operations and…
Answer: B. White Hat Hacker
A white hat hacker operates with explicit authorization to identify system weaknesses and improve organizational security defenses. The key distinguishing factors are proper permission and protective intent, whereas unauthorized attackers lack approval and typically exploit systems maliciously.
Q3. A regional bank's data center experiences an outage due to a power failure. During the Business Impact Analysis (BIA), management defines the following: MTD (Maximum Tolerable Downtime): 24 hours, RTO (Recovery Time Objective): 8 hours, RP…
Answer: F. Systems must be restored within 8 hours and data loss must not exceed 30 minutes
Systems must be recovered within the eight-hour recovery time objective, and data loss cannot exceed thirty minutes. The maximum tolerable downtime represents the absolute deadline before severe business impact.
Q4. A healthcare organization is modernizing its internal network using a Zero Trust architecture. The CISO wants to limit the potential blast radius of lateral movement if an attacker compromises one medical device or workstation. Which desig…
Answer: C. Segment the network into small logical zones with identity-based access control
Dividing the network into small logical zones with identity-based access controls directly limits lateral movement. In a Zero Trust architecture, segmenting assets restricts an attacker's ability to pivot after compromising a single device.
Q5. A secure research lab applies multiple CPTED (Crime Prevention Through Environmental Design) principles. Security architects have already installed fencing, lighting, and CCTV cameras. They now want to ensure that if an intruder bypasses t…
Answer: F. Mantraps and reinforced internal doors
Physical barriers like mantraps and reinforced doors delay intruders, providing critical time for guards to respond. This enforces the detect, delay, and respond sequence. Motion lights only detect, while patrols respond.
Q6. During an internal security review, it's discovered that several departments are classifying customer data inconsistently — some label it "Internal Use," others as "Confidential." Senior management wants a unified, legally defensible proce…
Answer: D. Have data owners define and approve classification levels based on business and legal requirements
Data owners must define and approve classification levels because they understand the business impact and legal requirements. Custodians handle technical enforcement later. If you enforce inconsistent labels first, you fail to solve the governance gap.
Q7. During a security audit, the data-center manager asks which type of portable fire extinguisher should be mounted near server racks and UPS equipment. The system houses high-voltage electrical components, and water or conductive agents are…
Answer: D. Class C
Class C extinguishers use non-conductive agents like carbon dioxide for energized electrical fires. Using water or conductive chemicals risks electrocution and severe equipment damage. Always prioritize human safety around high-voltage server racks.
Q8. During an internal security assessment, an attacker captures network traffic between a workstation and a domain controller that uses the Kerberos authentication protocol. They attempt to reuse a previously captured Ticket-Granting Ticket (…
Answer: B. Time synchronization between clients and the Key Distribution Center (KDC)
Kerberos relies on strict time synchronization between clients and the KDC to embed timestamps in tickets. If an attacker replays an old ticket, the server rejects the expired timestamp. Asymmetric encryption does not inherently stop replay attacks.
Q9. A global retailer stores credit card data from online transactions for refund processing. To reduce PCI DSS scope and lower breach impact, the CISO wants to ensure that the organization does not store or transmit actual card numbers after…
Answer: C. Replace stored card numbers with tokens generated by a PCI-compliant payment processor
Tokenization replaces sensitive card numbers with non-sensitive tokens, drastically reducing compliance scope. The payment processor maps tokens back to primary account numbers. Unlike encryption, tokenization removes sensitive data from internal systems.
Q10. Your company is negotiating with a cloud provider to host its new patient record management system. During due diligence, your compliance team warns of GDPR and HIPAA obligations. Management asks: What is the MOST critical issue to resolve…
Answer: G. Ensure the data processing agreement (DPA) addresses GDPR/HIPAA responsibilities
Ensuring the Data Processing Agreement addresses all regulatory responsibilities is the most critical step to legally bind the vendor to compliance. A SOC 2 report shows security posture, but without a legally binding DPA, your organization remains solely liable for data breaches.
Q11. During a risk workshop, a security analyst states, "If our customer database is not encrypted, an attacker could steal sensitive data through SQL injection." As the CISO, how should you correctly classify the analyst's statement?
Answer: D. Vulnerability
The analyst's statement accurately describes a vulnerability, which is an inherent weakness or lack of a preventive safeguard like encryption. The threat is the malicious actor utilizing the SQL injection technique, while the risk is the potential business impact of the stolen data.
Q12. Your development team is adopting a structured threat modeling methodology for a new e-commerce platform. The CISO wants a method that: Is risk-centric, focused on business impact. Uses attacker perspectives and abuse cases. Prioritizes th…
Answer: F. PASTA
The correct choice is PASTA because it is a risk-centric methodology that aligns technical threats with business impact. STRIDE is a common distractor; remember it categorizes technical threat types rather than prioritizing based on business risk.
Q13. Your multinational bank plans to outsource digital signing of high-value wire transfer instructions to a third-party FinTech provider. The business requires: Nonrepudiation of the sender (regulators must trust the signature in court). Cros…
Answer: G. Mandate use of a PKI with certificates issued by globally trusted Certificate Authorities, with all key management retained by the bank
The correct choice works because mandating PKI with internally managed keys ensures legal nonrepudiation and limits supply chain risk. Relying on vendor compliance reports or blockchain fails to provide the recognized legal standing and strict key control required by regulators.
Q14. A global insurance company is revising its Business Continuity Plan (BCP) after regulators warned that recovery capabilities must be demonstrated in the next audit. Key findings: Critical claims processing system has RTO of 4 hours, MTD of…
Answer: H. Recommend a parallel test of the DR site to validate RTO compliance without full interruption of production
The correct choice is recommending a parallel test because it validates recovery capabilities without disrupting production operations. Simulation tests are merely tabletop exercises and will not satisfy regulatory demands for actual demonstrated recovery capability.
Q15. Your enterprise wants employees to log in once with their corporate Active Directory credentials and then seamlessly access multiple third-party SaaS apps (like Salesforce, ServiceNow, and Workday) without re-entering passwords. The soluti…
Answer: H. SAML
The correct choice is SAML because it uses XML-based assertions to provide federated single sign-on across organizational boundaries. OpenID Connect is a tempting distractor, but remember it relies on JSON web tokens instead of XML for modern authentication.
More CISSP drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.