CISSP Exam Questions

What is considered a compensating control for not having electrical surge protectors installed?

What is considered the BEST explanation when determining whether to provide remote network access to a third-party security service?

When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?

What is the FIRST step in reducing the exposure of a network to Internet Control Message Protocol (ICMP) based attacks?

A system developer has a requirement for an application to check for a secure digital signature before the application is accessed on a user's laptop. Which security mechanism addr...

The security organization is looking for a solution that could help them determine with a strong level of confidence that attackers have breached their network. Which solution is M...

A security architect is reviewing plans for an application with a Recovery Point Objective (RPO) of 15 minutes. The current design has all of the application infrastructure located...

Which of the following outsourcing agreement provisions has the HIGHEST priority from a security operations perspective?

When designing a Cyber-Physical System (CPS), which of the following should be a security practitioner's first consideration?

A security professional was tasked with rebuilding a company's wireless infrastructure. Which of the following are the MOST important factors to consider while making a decision on...

A subscription service which provides power, climate control, raised flooring, and telephone wiring but NOT the computer and peripheral equipment is BEST described as a:

Which of the following is the PRIMARY goal of logical access controls?

The ability to send malicious code, generally in the form of a client side script, to a different end user is categorized as which type of vulnerability?

The security architect has been mandated to assess the security of various brands of mobile devices. At what phase of the product lifecycle would this be MOST likely to occur?

A hacker can use a lockout capability to start which of the following attacks?

An Internet media company produces and broadcasts highly popular television shows. The company is suffering a huge revenue loss due to piracy. What technique should be used to trac...

Using the cipher text and resultant clear text message to derive the non-alphabetic cipher key is an example of which method of cryptanalytic attack?

All hosts on the network are sending logs via syslog-ng to the log collector. The log collector is behind its own firewall, The security professional wants to make sure not to put...

An organization has been collecting a large amount of redundant and unusable data and filling up the storage area network (SAN). Management has requested the identification of a so...

A security practitioner has been asked to model best practices for disaster recovery (DR) and business continuity. The practitioner has decided that a formal committee is needed to...

What is the MOST appropriate hierarchy of documents when implementing a security program?

Which of the following is the MOST common cause of system or security failures?

Which access control method is based on users issuing access requests on system resources, features assigned to those resources, the operational or situational context, and a set o...

Information security practitioners are in the midst of implementing a new firewall. Which of the following failure methods would BEST prioritize security in the event of failure?

Which of the following is a PRIMARY security weakness in the design of Domain Name System (DNS)?

Which of the following BEST describes the purpose of the reference monitor when defining access control to enforce the security model?

A project manager for a large software firm has acquired a government contract that generates large amounts of Controlled Unclassified Information (CUI). The organization's informa...

Which of the following protects personally identifiable information (PII) used by financial services organizations?

Which of the following is a common term for log reviews, synthetic transactions, and code reviews?

At what stage of the Software Development Life Cycle (SDLC) does software vulnerability remediation MOST likely cost the least to implement?

Which of the following BEST describes when an organization should conduct a black box security audit on a new software product?

The Chief Information Officer (CIO) has decided that as part of business modernization efforts the organization will move towards a cloud architecture. All business-critical data w...

When reviewing vendor certifications for handling and processing of company data, which of the following is the BEST Service Organization Controls (SOC) certification for the vendo...

Which of the following is a covert channel type?

Which change management role is responsible for the overall success of the project and supporting the change throughout the organization?

Which of the following is a unique feature of attribute-based access control (ABAC)?

When auditing the Software Development Life Cycle (SDLC) which of the following is one of the high-level audit phases?

Which of the following BEST describes the purpose of Border Gateway Protocol (BGP)?

Which of the following is the PRIMARY purpose of installing a mantrap within a facility?

A security professional can BEST mitigate the risk of using a Commercial Off-The-Shelf (COTS) solution by deploying the application with which of the following controls in ?

Which of the following would an information security professional use to recognize changes to content, particularly unauthorized changes?

An organization with divisions in the United States (US) and the United Kingdom (UK) processes data comprised of personal information belonging to subjects living in the European U...

Which of the following has the responsibility of information technology (IT) governance?

Dumpster diving is a technique used in which stage of penetration testing methodology?

What is the MOST common cause of Remote Desktop Protocol (RDP) compromise?

An organization is looking to include mobile devices in its asset management system for better tracking. In which system tier of the reference architecture would mobile devices be...

Which is MOST important when negotiating an Internet service provider (ISP) service-level agreement (SLA) by an organization that solely provides Voice over Internet Protocol (VoIP...

A company developed a web application which is sold as a Software as a Service (SaaS) solution to the customer. The application is hosted by a web server running on a specific oper...

A systems engineer is designing a wide area network (WAN) environment for a new organization. The WAN will connect sites holding information at various levels of sensitivity, from...

Which event magnitude is defined as deadly, destructive, and disruptive when a hazard interacts with human vulnerability?