Quick Answer: The CISSP exam uses Computerized Adaptive Testing with 100 to 150 questions, a 3-hour time limit, and a 700 out of 1000 passing score. Most successful candidates study 100 to 150 hours over 2 to 4 months and complete 500 or more practice questions, scoring 80 percent or higher consistently before scheduling. This guide gives you 30 free scenario-based questions, one dedicated section per domain, and the complete explanation behind every correct answer so you train the right way to think, not just memorize. When you are ready for the full question bank, CertMage’s CISSP exam dumps cover all 8 domains with exam-format simulations updated for 2026.
Before You Start: The One Thing That Separates Passes From Failures
Passing CISSP is not about memorizing encryption algorithms or port numbers. The test adapts. Most CISSP questions require you to think like a security manager, not an engineer.
Every question in this guide is written to train that managerial mindset. When you read a scenario and your instinct is to jump to the technical fix, stop. Ask yourself: what would a senior security manager decide here? What addresses the root cause, satisfies the business requirement, and follows proper governance? That is the answer ISC2 is looking for every time.
The CISSP tests your ability to think like a security manager and make risk-based decisions. Focus on understanding principles, not memorizing technical details.
Keep that principle in mind for every question that follows.
Exam Quick Reference
Candidates will be presented with a minimum of 100 items on the CISSP exam. The maximum item count is 150 items for the CISSP examination. Maximum administration time for CISSP is three hours.
A candidate who demonstrates clear competence might pass in 100 questions, while someone performing inconsistently might need all 150 questions for the algorithm to reach confidence. Ending at the minimum question count with a pass result indicates strong, consistent performance.
The passing score is 700 out of 1000 on a scaled score. You won’t know your exact score unless you fail. Pass results simply say “Congratulations” with no numerical score provided. Failed results include your scaled score and domain-level feedback showing which areas need improvement.
The exam fee is $749 in the Americas. The estimated first-time pass rate is around 70 percent for well-prepared candidates.
Domain 1: Security and Risk Management (16%)
Domain 1 is the heaviest weighted domain on the exam and the one that most candidates underestimate. It covers security governance, risk management frameworks, compliance, business continuity, and professional ethics. At 16 percent of the exam, it demands the most preparation time.
Question 1
A Chief Information Security Officer is presenting the annual security budget to the executive board. The board asks why the organization should continue funding a security control that has never triggered an alert in three years. What is the most appropriate response from the CISO?
A. Admit the control may be unnecessary and propose removing it to reduce costs. B. Explain that the absence of alerts indicates the control is effectively deterring threats. C. Recommend replacing the control with a cheaper alternative. D. Commission an immediate penetration test to justify the control’s value.
Correct Answer: B
Why B is correct: This is a governance and risk management question testing whether you understand how preventive controls work. A preventive control that generates no alerts may be succeeding at its job, not failing at it. The CISO’s role in this scenario is to reframe the absence of incidents as evidence of effectiveness rather than evidence of waste. Options A and C both reduce the organization’s security posture based on faulty logic. Option D delays the conversation without answering it. The managerial answer is to explain the control’s deterrent value clearly and connect it to the organization’s risk tolerance.
Question 2
During a risk assessment, a security team identifies a vulnerability with a 30 percent annual probability of exploitation. If exploited, the estimated loss is $500,000. What is the annualized loss expectancy?
A. $150,000 B. $500,000 C. $350,000 D. $50,000
Correct Answer: A
Why A is correct: Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annual Rate of Occurrence (ARO). In this scenario the SLE is $500,000 and the ARO is 0.30, giving an ALE of $150,000. This is a fundamental quantitative risk analysis formula. Any security control investment above $150,000 annually would not be cost-justified unless it eliminates the risk entirely.
Question 3
An organization operates in a heavily regulated industry and must comply with multiple overlapping frameworks including ISO 27001, NIST CSF, and PCI DSS. The security team is struggling to map controls across all three. What is the best approach?
A. Choose one framework and discard the others. B. Implement each framework independently with separate control sets. C. Use a unified control framework that maps requirements across all three. D. Request a compliance waiver from the regulatory bodies.
Correct Answer: C
Why C is correct: This question tests practical governance knowledge. A unified control framework, sometimes called a meta-framework or a controls crosswalk, allows an organization to satisfy multiple compliance requirements with a single set of controls by mapping each control to the corresponding requirement across frameworks. Option A creates regulatory exposure. Option B wastes resources and creates redundant work. Option D is not realistic for regulated industries. The senior security manager recognizes that framework overlap is an efficiency problem solved through alignment, not reduction.
Question 4
A security manager discovers that a new business initiative will require processing personal health data of EU residents but launches in six weeks. The legal team has not been consulted. What should the security manager do first?
A. Begin implementing technical security controls for the data immediately. B. Halt the project until full security review is complete. C. Escalate to senior management and engage legal and privacy teams before proceeding. D. Document the risk and allow the project to continue with monitoring.
Correct Answer: C
Why C is correct: Processing EU personal health data triggers GDPR obligations including data protection impact assessments, lawful basis for processing, and potentially data protection officer involvement. This is a governance and compliance issue that requires legal and privacy expertise before technical controls are designed, because the controls themselves depend on what the legal obligations require. Option B is too absolute and may not be the security manager’s decision alone. Option A puts the cart before the horse. Option D accepts risk without understanding it. The correct managerial action is to escalate and engage the right stakeholders immediately.
Domain 2: Asset Security (10%)
Domain 2 covers information classification, ownership, data handling requirements, privacy protection, and secure disposal. At 10 percent of the exam it is the lightest domain, but questions here are frequently paired with governance and compliance scenarios.
Question 5
A company classifies data into four levels: Public, Internal, Confidential, and Restricted. An employee finds a document marked Confidential on a shared drive and is unsure whether they are authorized to access it. What is the most appropriate action?
A. Access the document and determine its sensitivity based on the content. B. Copy it to personal storage to review later in a secure environment. C. Contact the data owner to confirm authorization before accessing. D. Escalate to IT security and request the file be removed.
Correct Answer: C
Why C is correct: Data classification is only meaningful if the authorization process it implies is followed. Confidential data requires confirmed authorization before access. The data owner is the individual responsible for determining who may access specific data. Options A and B both involve accessing or copying the data without authorization, which is a policy violation regardless of intent. Option D removes the data rather than resolving the authorization question. The correct action is to go through the proper authorization channel before accessing.
Question 6
An organization is decommissioning old hard drives that previously stored Restricted data. The drives are physically functional but will be sold as surplus. What is the most appropriate disposal method?
A. Standard formatting and reinstallation of the operating system. B. Degaussing or physical destruction before disposal. C. Encryption of remaining data before releasing drives. D. Overwriting with a single pass of zeros.
Correct Answer: B
Why B is correct: Restricted data requires the highest level of media sanitization. Standard formatting, single-pass overwriting, and encryption all leave data potentially recoverable through forensic techniques. Degaussing destroys the magnetic structure of the drive rendering data unrecoverable. Physical destruction eliminates any possibility of data recovery. For Restricted classification data, only these two methods provide the assurance level the classification demands. This is a core asset security principle: disposal method must match the classification level of data that was stored.
Domain 3: Security Architecture and Engineering (13%)
Domain 3 is one of the most technically demanding domains, covering security models, cryptography, physical security, and secure design principles. Candidates with non-engineering backgrounds often find this domain the most challenging.
Question 7
A security architect is designing a new system that must ensure a subject cannot read data at a higher sensitivity level than their clearance. Which security model enforces this requirement?
A. Clark-Wilson model B. Biba model C. Bell-LaPadula model D. Brewer-Nash model
Correct Answer: C
Why C is correct: The Bell-LaPadula model is specifically designed to enforce confidentiality in multi-level security systems. Its Simple Security Property (no-read-up rule) prevents a subject from reading objects at a higher classification level than their clearance. The Biba model enforces integrity rather than confidentiality using a no-write-up rule. Clark-Wilson enforces integrity through well-formed transactions. Brewer-Nash (Chinese Wall) prevents conflicts of interest. The scenario specifies confidentiality through clearance-based read control, which is the precise definition of Bell-LaPadula’s Simple Security Property.
Question 8
An organization wants to ensure that digital certificates issued by their internal CA are trustworthy and verifiable by all internal systems. Which PKI component maintains the list of revoked certificates?
A. Registration Authority B. Certificate Revocation List C. Online Certificate Status Protocol responder D. Certificate Repository
Correct Answer: B
Why B is correct: The Certificate Revocation List (CRL) is the PKI component that contains the list of certificates that have been revoked before their expiration date. The Registration Authority handles identity verification before certificate issuance. The OCSP responder is an alternative real-time revocation checking mechanism but is not a list itself. The Certificate Repository stores issued certificates. The question asks which component maintains the list of revoked certificates, which is specifically the CRL.
Question 9
A security engineer is implementing encryption for data at rest on a database server. The organization requires that encryption and decryption operations be performed as fast as possible with minimal performance impact. Which type of encryption is most appropriate?
A. Asymmetric encryption using RSA-4096 B. Symmetric encryption using AES-256 C. Hashing using SHA-512 D. Asymmetric encryption using ECC-256
Correct Answer: B
Why B is correct: Symmetric encryption uses the same key for both encryption and decryption, making it significantly faster than asymmetric encryption. AES-256 is the current standard for high-performance data-at-rest encryption and is hardware-accelerated on modern processors. Asymmetric encryption algorithms including RSA and ECC are computationally expensive and are not suitable for bulk data encryption. SHA-512 is a hashing algorithm, not an encryption algorithm, and is not reversible. For data-at-rest encryption requiring performance efficiency, AES-256 is the correct choice.
Question 10
A company’s physical security policy requires that all visitors to the data center be escorted at all times. A technician sees an unknown individual walking unescorted through the server room and assumes they must have authorization because they are wearing a company badge. What security principle is being violated?
A. Separation of duties B. Defense in depth C. Least privilege D. Tailgating and complacency in physical access control
Correct Answer: D
Why D is correct: This scenario describes a failure to enforce the escort policy due to social engineering through the appearance of legitimacy. A company badge does not authorize unescorted access to the data center if the policy requires escort. The technician’s assumption is the vulnerability, not a missing technical control. This is a physical security and policy enforcement failure. The correct action would be to challenge the individual or notify security immediately. Social engineering exploits exactly this kind of deference to perceived authority or legitimacy.
Domain 4: Communication and Network Security (13%)
Domain 4 covers network architecture, secure protocols, transmission security, and network attack defense. This is an accessible domain for candidates with networking backgrounds but tests at a governance level rather than a configuration level.
Question 11
A security analyst discovers that an attacker has been intercepting encrypted HTTPS traffic between employees and an external financial site without either party’s knowledge. The analyst confirms the attacker is presenting a forged certificate that the employee browsers are accepting. What type of attack is this?
A. Replay attack B. Man-in-the-middle attack using SSL stripping C. Man-in-the-middle attack with certificate spoofing D. DNS cache poisoning
Correct Answer: C
Why C is correct: The scenario describes a man-in-the-middle attack where the attacker is presenting a forged certificate that browsers are accepting. SSL stripping downgrades HTTPS to HTTP rather than presenting a forged certificate. DNS cache poisoning redirects traffic at the DNS level but does not involve certificate forgery. Replay attacks involve retransmitting captured authentication data. The defining characteristics here are interception of encrypted traffic, a forged certificate, and browser acceptance of that certificate, which precisely describes MITM with certificate spoofing.
Question 12
An organization is deploying a new network segment for IoT devices. The security team wants to ensure that a compromised IoT device cannot be used to attack systems on the corporate network. What is the most effective control?
A. Install antivirus software on all IoT devices. B. Place IoT devices on a separate network segment with strict firewall rules limiting traffic to and from the corporate network. C. Require all IoT devices to use VPN connections. D. Monitor IoT traffic with an IDS.
Correct Answer: B
Why B is correct: Network segmentation with strict firewall rules is the most effective control for containing IoT device compromise. IoT devices frequently lack support for antivirus software or VPN clients, making options A and C impractical or impossible for most device types. IDS monitoring detects attacks but does not prevent lateral movement once a device is compromised. Segmentation limits the blast radius of a compromise by restricting what a compromised device can reach, which is the correct architectural response to devices with inherently limited security capability.
Question 13
A company uses WPA2-Enterprise for wireless authentication. An employee reports that their laptop connected to a rogue access point with the same SSID as the corporate network. Which control would most effectively prevent this in the future?
A. Implement 802.1X with certificate-based mutual authentication. B. Increase the wireless encryption key length. C. Deploy wireless intrusion prevention. D. Require employees to manually verify the access point MAC address before connecting.
Correct Answer: A
Why A is correct: Certificate-based mutual authentication under 802.1X requires both the client and the access point to present valid certificates. This means the client verifies the access point is legitimate before connecting, preventing connection to rogue access points that cannot present a valid server certificate. Increasing key length does not prevent rogue AP connection. WIPS detects rogue APs but cannot prevent connection once a device selects the rogue AP. Manual MAC address verification is not operationally practical and MAC addresses can be spoofed. Mutual certificate authentication is the architecturally correct solution.
Domain 5: Identity and Access Management (13%)
Domain 5 covers physical and logical access controls, identification, authentication, authorization, and identity management. This domain appears heavily in real-world security work and tests both concept knowledge and scenario judgment.
Question 14
A user attempts to log into a corporate application and provides their username and password. The system then sends a one-time code to the user’s registered mobile device. What authentication factor combination is being used?
A. Something you know and something you are. B. Something you have and something you know. C. Two instances of something you know. D. Something you know and somewhere you are.
Correct Answer: B
Why B is correct: Username and password are “something you know.” The one-time code sent to a registered mobile device requires physical possession of that device, making it “something you have.” This is the classic two-factor authentication combination. Options A and D both require biometric or geolocation factors which are not present in this scenario. Option C incorrectly categorizes the OTP as a knowledge factor when it is a possession factor. Distinguishing these three authentication categories correctly is a fundamental IAM competency.
Question 15
An organization is implementing role-based access control. During an access review, the security team discovers that several employees have accumulated permissions from previous roles that they no longer need in their current position. What principle has been violated and what is the correct remediation?
A. Separation of duties has been violated. Remove access for all affected accounts immediately. B. Least privilege has been violated. Conduct a formal access recertification and revoke unnecessary permissions. C. Need-to-know has been violated. Terminate accounts and recreate them with only current role permissions. D. Dual control has been violated. Require two approvers for all future access changes.
Correct Answer: B
Why B is correct: Accumulation of permissions from previous roles is called privilege creep and it directly violates the principle of least privilege, which requires that users have only the minimum access necessary for their current role. The correct remediation is a formal access recertification process where each user’s permissions are reviewed against their current role requirements and unnecessary access is revoked. Immediately terminating accounts is disproportionate. The violation described does not involve separation of duties or dual control. Formal recertification is the mature, governance-appropriate response.
Question 16
A security architect is designing an access control system for a hospital. Different clinical roles need access to patient records, but access must be granularly controlled based on the specific patient relationship and the type of data being accessed. Which access control model is most appropriate?
A. Discretionary Access Control B. Mandatory Access Control C. Role-Based Access Control D. Attribute-Based Access Control
Correct Answer: D
Why D is correct: Attribute-Based Access Control (ABAC) makes authorization decisions based on multiple attributes including user attributes, resource attributes, and environmental attributes. In a hospital context, access might depend on the clinician’s department, the patient’s assigned care team, the type of record being accessed, and the time of day. This granularity cannot be achieved with DAC, MAC, or standard RBAC. DAC relies on resource owner decisions. MAC uses classification labels and clearances. RBAC uses role membership. Only ABAC supports the policy complexity this scenario requires.
Domain 6: Security Assessment and Testing (12%)
Domain 6 covers security testing strategies, vulnerability assessments, penetration testing, log review, and security control testing. It tests whether you understand when and how to use each assessment method at a governance level.
Question 17
A security manager needs to evaluate whether security controls across the entire organization are operating as intended, not just whether they exist on paper. Which assessment method is most appropriate?
A. Vulnerability scan B. Security control assessment C. Penetration test D. Risk assessment
Correct Answer: B
Why B is correct: A security control assessment evaluates whether controls are implemented correctly, operating as intended, and producing the desired outcome. A vulnerability scan identifies technical weaknesses in systems but does not evaluate whether organizational controls are functioning. A penetration test simulates an attack to identify exploitable weaknesses but does not systematically evaluate all controls across the organization. A risk assessment identifies and evaluates risks but does not verify control operation. The specific requirement to evaluate whether controls are operating as intended matches the definition of a security control assessment.
Question 18
During a penetration test, the testing team discovers a critical vulnerability that would allow full administrative access to the production environment. The test is scheduled to run for two more weeks. What should the penetration testers do?
A. Exploit the vulnerability to demonstrate impact and include it in the final report. B. Immediately notify the client’s security team and document the finding without exploiting further. C. Continue the test as planned since the client authorized full scope testing. D. Exploit the vulnerability in a controlled manner and then remediate it before the client notices.
Correct Answer: B
Why B is correct: When a critical vulnerability that could cause significant harm is discovered during a penetration test, the responsible action is immediate disclosure to the client, regardless of the remaining test duration or scope authorization. The authorization to test does not obligate the testers to withhold critical findings for two weeks. Option A risks causing actual damage to a production environment. Option D involves unauthorized remediation which goes beyond scope. The professional and ethical standard is prompt disclosure so the client can make an informed decision about whether to address it immediately or continue the test knowing the risk.
Question 19
An organization conducts quarterly log reviews as part of its security monitoring program. During a review, an analyst finds that logs from a specific web server have not been captured for the past three weeks. What is the most significant concern this raises?
A. The web server may have been offline for three weeks. B. Security events during that period are undetected and the gap may indicate tampering. C. The log management system may need to be upgraded. D. The analyst should document the gap and continue the review.
Correct Answer: B
Why B is correct: A three-week gap in log collection from a specific server is a significant security concern because any attacks, unauthorized access, or policy violations that occurred during that period are invisible to the organization. More critically, the gap itself may be the result of an attacker disabling logging to hide their activity, which is a common attacker technique. The absence of logs is not simply an administrative issue. It is a potential indicator of compromise. The correct response is to treat the gap as a potential security incident and investigate the cause before continuing the review.
Domain 7: Security Operations (13%)
Domain 7 is the second heaviest domain at 13 percent and covers incident response, forensics, disaster recovery, business continuity, and security operations management. It tests both procedural knowledge and scenario judgment.
Question 20
A security operations center analyst receives an alert indicating that a workstation is communicating with a known command-and-control IP address at regular 60-second intervals. The workstation belongs to a finance department employee. What is the first action the analyst should take?
A. Immediately power off the workstation to stop the communication. B. Contact the employee to ask if they are aware of the communication. C. Follow the incident response plan and isolate the workstation from the network while preserving evidence. D. Block the C2 IP address at the firewall.
Correct Answer: C
Why C is correct: This scenario describes a likely malware infection with beaconing behavior, which is a critical security incident. The incident response plan governs the response sequence. Isolating the workstation from the network stops the communication without powering it off, preserving volatile memory evidence that may be crucial for forensic analysis. Powering off the workstation destroys volatile evidence. Contacting the employee alerts a potential insider threat and delays response. Blocking the IP at the firewall does not address the compromised system itself. Proper incident response requires isolation first, evidence preservation second, and investigation third.
Question 21
An organization’s disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its primary order management system. During a ransomware attack, the system is taken offline. Backups are available but the most recent backup is from 6 hours ago. Which statement is accurate?
A. The organization can meet its RTO but not its RPO. B. The organization cannot meet either its RTO or its RPO without additional action. C. The organization meets its RPO because the backup exists. D. The organization should accept the data loss since recovery is still possible.
Correct Answer: A
Why A is correct: RTO is the maximum acceptable time to restore a system after an outage. RPO is the maximum acceptable amount of data loss measured in time. If the organization can restore the system within 4 hours using the 6-hour-old backup, it meets its RTO of 4 hours. However, the backup is 6 hours old, meaning up to 6 hours of data will be lost. Since the RPO requires no more than 1 hour of data loss, the RPO is violated. Understanding the distinction between RTO and RPO and being able to evaluate whether each is met given specific facts is a core Domain 7 competency.
Question 22
During a forensic investigation of a compromised Linux server, the forensic analyst’s first step is to run a full disk image of the server. A colleague suggests first reviewing running processes to identify malicious activity. Who is correct and why?
A. The colleague is correct because identifying malicious processes immediately stops ongoing damage. B. The analyst is correct because disk imaging preserves evidence integrity before any analysis begins. C. Both are wrong. The server should be powered off before any investigation. D. The colleague is correct because process analysis is non-destructive.
Correct Answer: B
Why B is correct: The order of volatility in digital forensics dictates that the most volatile evidence, including running processes, network connections, and RAM contents, is captured before less volatile evidence like disk contents. However, the scenario specifies the analyst is imaging the disk first, which may be appropriate if volatile data has already been captured or if the investigation prioritizes file system evidence. The key principle being tested is evidence integrity. Beginning analysis before imaging risks altering evidence. The disk image creates a forensically sound copy that can be analyzed repeatedly without affecting the original. Powering off the server destroys volatile evidence entirely.
Question 23
A company’s business continuity plan has not been tested in two years. The IT director argues that testing is unnecessary because the plan was thorough when written. What is the most significant risk of not testing?
A. The plan may be out of date due to system changes, personnel turnover, and evolved threats. B. Regulators may find the lack of testing during an audit. C. The plan document may be lost or inaccessible. D. Employees may not know where to find the plan when needed.
Correct Answer: A
Why A is correct: The primary risk of an untested BCP is that it may not work when needed because the organization has changed. Systems are replaced, staff turn over, vendors change, and threat landscapes evolve. A plan that was comprehensive two years ago may reference systems that no longer exist, contact information that is outdated, or procedures that no longer apply. Regulatory risk is real but secondary to the operational risk of plan failure. The most significant risk is that the plan will fail at the worst possible moment because it was never validated against current reality.
Domain 8: Software Development Security (10%)
Domain 8 covers security in the software development lifecycle, application security controls, and software security assessment. It is frequently tested through scenarios involving development governance rather than specific coding techniques.
Question 24
A development team is using an agile methodology and wants to integrate security into every sprint rather than conducting a single security review before release. What security approach best supports this goal?
A. Penetration testing after each release. B. DevSecOps with security integrated throughout the CI/CD pipeline. C. Quarterly security code reviews by an external team. D. Requiring security sign-off before any code merges to main branch.
Correct Answer: B
Why B is correct: DevSecOps integrates security practices, tools, and responsibilities directly into the continuous integration and continuous delivery pipeline, enabling security checks including static analysis, dependency scanning, and automated security testing to run with every code commit and build. Penetration testing after each release is too late in the cycle to shift left. Quarterly external reviews conflict with sprint velocity and agile cadence. Security sign-off before merge is a manual gate that creates bottlenecks. DevSecOps is the methodology specifically designed to make security continuous in an agile context.
Question 25
A web application security review identifies that user-supplied input is being directly incorporated into database queries without sanitization. What vulnerability does this represent and what is the primary mitigation?
A. Cross-site scripting. Primary mitigation is output encoding. B. SQL injection. Primary mitigation is parameterized queries or prepared statements. C. Buffer overflow. Primary mitigation is input length validation. D. Cross-site request forgery. Primary mitigation is CSRF tokens.
Correct Answer: B
Why B is correct: Direct incorporation of unsanitized user input into database queries is the textbook definition of SQL injection vulnerability. The primary mitigation is parameterized queries or prepared statements, which separate the query structure from the user-supplied data so the database never interprets user input as part of the query syntax. Input validation and stored procedures are complementary but secondary controls. XSS involves output to browsers. Buffer overflow involves memory boundary violations. CSRF involves forged cross-origin requests. SQL injection is specifically about unsanitized input in database queries.
Question 26
A security team is reviewing a third-party software library before approving its use in a production application. Which of the following is the most important security consideration?
A. Whether the library has a user-friendly API. B. Whether the library has known vulnerabilities in its current and recent versions. C. Whether the library is open source or commercial. D. Whether the library has been downloaded more than 10,000 times.
Correct Answer: B
Why B is correct: Third-party library security review centers on known vulnerabilities. A library with unpatched vulnerabilities in its current version introduces known risk into the production application regardless of its other qualities. API usability and download counts are not security considerations. Open source libraries can be more or less secure than commercial libraries, and the classification itself is not the deciding factor. Security review of third-party components must prioritize vulnerability status, maintenance activity, and patch history. This is a fundamental software supply chain security principle.
Mixed Domain Scenario Questions
The final four questions combine multiple domain concepts the way the actual CISSP exam presents them.
Question 27
An organization discovers that a former employee’s active directory account was used to access sensitive financial data two weeks after the employee’s termination date. The account should have been disabled on the last day of employment. What type of control failure occurred, and what is the primary recommendation?
A. A technical control failure. Implement automated account termination triggered by HR system updates. B. A physical control failure. Require badge deactivation on the termination date. C. A detective control failure. Implement user behavior analytics to detect unusual access. D. An administrative control failure only. Retrain HR on termination procedures.
Correct Answer: A
Why A is correct: This scenario describes a failure in logical access control during the account lifecycle management process. Manual account termination processes are inherently unreliable because they depend on human execution at the right time. The primary recommendation is to automate account disabling through integration between the HR system and Active Directory, so that termination in the HR system automatically triggers account disabling without manual steps. While administrative controls are also involved, the technical control of automated provisioning and deprovisioning is the most robust solution. Detective controls would identify the problem after it occurs rather than preventing it.
Question 28
A security architect must choose between building a new data center internally or migrating to a cloud service provider. The organization handles data subject to HIPAA. Senior management wants to reduce capital expenditure. What is the most important security consideration before making this decision?
A. The cloud provider’s pricing model compared to internal build costs. B. Ensuring that the cloud provider can sign a Business Associate Agreement and meet all HIPAA security requirements. C. Whether the cloud provider is located in the same country as the organization. D. Whether the cloud provider’s service level agreement guarantees 99.9 percent uptime.
Correct Answer: B
Why B is correct: HIPAA requires that any third party that handles Protected Health Information on behalf of a covered entity must sign a Business Associate Agreement (BAA) and meet the HIPAA Security Rule requirements. Before any cloud migration decision involving HIPAA data, the organization must confirm the cloud provider can legally and technically satisfy these requirements. Cost comparison, geographic location, and uptime guarantees are all important considerations but they are secondary to the legal and compliance prerequisite. A cloud migration that reduces costs but violates HIPAA creates regulatory exposure that far exceeds any cost savings.
Question 29
A company is assessing its risk posture and identifies a critical server with a 40 percent annual probability of exploitation. The server hosts a single internal application used by 20 employees. The SLE is $800,000. The security team proposes a $280,000 annual control. Is this control cost-justified?
A. Yes, because the control cost is less than the SLE. B. No, because the ALE is $320,000 and the control costs $280,000, leaving minimal residual benefit. C. Yes, because the ALE is $320,000 and the control at $280,000 costs less than the potential loss. D. No, because the probability is too high to justify any control.
Correct Answer: C
Why C is correct: ALE equals SLE multiplied by ARO. Here: $800,000 times 0.40 equals $320,000. The proposed control costs $280,000 per year. Since $280,000 is less than the ALE of $320,000, the control is technically cost-justified, saving $40,000 annually in expected loss. Option B reaches the right numbers but incorrectly concludes the control is not justified. The test of cost-justification for a control is whether the control cost is less than the ALE it addresses. At $280,000 versus $320,000 ALE, the control is cost-justified, though the margin is thin and the organization may seek a less expensive control.
Question 30
A CISO receives a request from the CEO to bypass the normal vulnerability management process and immediately patch a single critical server without going through the change management board, because a board member personally asked the CEO to act quickly. What should the CISO do?
A. Comply with the CEO’s request since the CEO outranks the change management process. B. Refuse the request entirely and follow normal change management procedures. C. Explain the risks of bypassing change management and propose an emergency change process that includes appropriate documentation and approvals. D. Patch the server immediately and document the change afterward.
Correct Answer: C
Why C is correct: This question tests whether you understand that security governance exists to protect the organization, not to impede it. Change management processes exist because uncontrolled changes to production systems can introduce new vulnerabilities, cause outages, and create compliance gaps. The correct answer is not to blindly refuse the CEO nor to blindly comply. A mature security leader acknowledges the urgency, explains the organizational risk of bypassing controls, and proposes an emergency change process that achieves the speed required while maintaining the documentation and approval trail that protects the organization. Option C is the managerial answer because it solves the problem without abandoning governance.
How to Use This Practice Test Effectively
Every question you answered incorrectly reveals a gap worth studying. Do not simply note the correct answer and move on. Read the explanation, identify the principle behind the question, and find two or three similar scenarios in your study materials to confirm you understand the concept rather than just the answer.
Study all 8 domains proportionally to their exam weights. Use the think like a manager approach for scenario questions. Complete 500 or more practice questions and score 80 percent or higher consistently before scheduling your exam.
The 30 questions in this guide represent one scenario per key concept area. The actual exam pulls from a much deeper pool. Most successful candidates study 100 to 150 hours over 2 to 4 months and score 80 percent or higher on practice tests consistently before scheduling.
When you are ready to move beyond these 30 questions, CertMage’s CISSP practice test library provides full domain-by-domain question banks with exam-format simulations built for the current 2026 CBK. Each question includes the complete explanation so you always understand the reasoning behind the correct answer, not just the letter.
Your 8-Week CISSP Study Plan
Weeks 1 and 2: Domain 1 (Security and Risk Management) and Domain 7 (Security Operations). These are the two highest-weighted domains and both require significant mindset adjustment for technical candidates. Cover governance frameworks, risk quantification formulas, business continuity, and incident response procedures.
Week 3: Domain 3 (Security Architecture and Engineering) and Domain 4 (Communication and Network Security). Cover security models, cryptography fundamentals, PKI, and network architecture principles.
Week 4: Domain 5 (Identity and Access Management) and Domain 6 (Security Assessment and Testing). Cover access control models, authentication factors, penetration testing methodology, and security control assessment.
Week 5: Domain 2 (Asset Security) and Domain 8 (Software Development Security). Cover data classification, handling requirements, SDLC security, and application security controls.
Weeks 6 and 7: Full mixed practice exams. Use CertMage to simulate exam conditions across all 8 domains. Track your performance by domain and spend additional time on any domain below 75 percent.
Week 8: Final review of weak areas, exam mechanics review, and rest. Do not cram the night before. Consistency beats intensity. Protect your energy and take at least one no-study day per week throughout your preparation.
Frequently Asked Questions
How many questions is the CISSP exam in 2026?
Candidates will be presented with a minimum of 100 items on the CISSP exam. The maximum item count is 150 items. Maximum administration time is three hours.
What is the CISSP passing score?
700 out of 1000 on a scaled score. Pass results simply say “Congratulations” with no numerical score. Failed results include your scaled score and domain-level feedback.
What is the best way to prepare for the CISSP exam?
Focus on understanding concepts at a managerial level rather than memorizing technical details. Study all 8 domains proportionally to their exam weights. Complete 500 or more practice questions and score 80 percent or higher consistently before scheduling. CertMage provides the practice question volume and exam simulation needed to reach that benchmark.
How hard is the CISSP exam?
CISSP is considered one of the most challenging IT certifications. The estimated first-time pass rate is around 70 percent for well-prepared candidates. The exam tests managerial-level thinking rather than just technical knowledge.
How long should I study for CISSP?
Most successful candidates study 100 to 150 hours over 2 to 4 months. Candidates with strong security backgrounds and several years of experience in multiple domains can prepare in 6 to 8 weeks. Candidates newer to some domains should allow 3 to 4 months.
What is the CISSP salary?
According to the ISC2 Cybersecurity Workforce Study, CISSP holders earn a median salary of $168,900 in North America. This represents a 20 to 25 percent premium over non-certified cybersecurity professionals.
What is the difference between CISSP and CISM?
CISSP focuses on technical security implementation and covers 8 broad security domains, while CISM emphasizes management and governance aspects of information security with 4 domains focused on strategy and operations. CISSP is broader and more widely required in job postings. CISM is preferred for pure information security management roles.
