ISC2 certification practice

CISSP Practice Questions

Try 10 free CISSP exam-style questions for Certified Information Systems Security Professional. Check each answer and review the explanation and source references.

Exam code: CISSP
Provider: ISC2
Free questions: 10
Full set: 1,485 questions
Last update check: October 18, 2026

Start the free questions Browse ISC2 exams

The Certified Information Systems Security Professional (CISSP) exam from ISC2 is aimed at security practitioners who design, manage, and oversee information security programs. It certifies broad knowledge across eight domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), Security Assessment and Testing, Security Operations, and Software Development Security.

Many candidates find the breadth itself the main challenge. Someone strong in Communication and Network Security may have little hands-on exposure to Software Development Security or Asset Security. Questions often ask for the best choice from a management and risk perspective rather than a purely technical fix, so Security and Risk Management thinking matters across every domain. Security Architecture and Engineering, with its security models and cryptography concepts, and Identity and Access Management, with its range of access control approaches, also tend to need careful study.

This free practice test includes 10 questions. Answer each one, then check your answer before moving on. Read every explanation, including those for questions you got right, because the reasoning behind why the other options are weaker is often where the learning happens. Note which domains cause your mistakes, revisit that material, and come back to the questions later to confirm your understanding has improved.

Get Full Access

Domain Security Architecture and Engineering

Which of the following BEST describes a Protection Profile (PP)?

Answer options

Correct Answer:

Explanation

A Protection Profile (PP), as defined by the Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408), is an implementation-independent document. It specifies a standard set of security requirements for a particular class of products, such as firewalls or operating systems. The PP is created to address a defined set of consumer security needs and threats, serving as a reusable template. Vendors can then develop a specific product, documented in a Security Target (ST), that claims conformance to a particular PP, demonstrating that it meets this standardized set of security requirements.

References

1. Common Criteria for Information Technology Security Evaluation. (2017). Part 1: Introduction and general model

Version 3.1

Revision 5 (ISO/IEC 15408-1:2017). Section 5.3.1

Paragraph 128

states

"A Protection Profile (PP) is an implementation-independent set of security requirements for a category of TOEs [Targets of Evaluation]... A PP is intended to be reusable and to define requirements for a category of TOEs that meet a specific set of consumer needs."

2. National Institute of Standards and Technology (NIST). (2006). An Introduction to the Common Criteria and the NIAP Evaluation and Validation Scheme (NIST Special Publication 800-23). Section 2.2

"Protection Profiles

" states

"A Protection Profile (PP) is a document

typically created by a user or user community

which identifies security requirements for a class of security devices... relevant to that user for a particular purpose."

3. Bishop

M. (2005). Introduction to Computer Security. Pearson Education. Chapter 26

"Assurance

" Section 26.3.2

"The Common Criteria

" describes a Protection Profile as a document that "defines the security requirements and protections of a type of product." It emphasizes its role in defining a class of devices.

Question breakdown

Tests: Understand Common Criteria evaluation components (PP, ST, TOE)
Difficulty: Medium

Key idea: A Protection Profile is a reusable, implementation-independent statement of security requirements for a category of products that meets a defined set of consumer needs.

How to reach the answer

Recall that Common Criteria separates what consumers need (PP) from what a vendor claims for a specific product (ST).
The PP is written for a product class, such as firewalls, not for one implementation, so it must be implementation-independent.
Option A contains both clues: 'implementation independent' and 'specific consumer needs'.
Eliminate options that say 'implementation dependent' or describe one-to-one PP/ST mappings, because those describe the ST or misstate the relationship.

Each option

ACorrect. This matches the Common Criteria definition: an implementation-independent requirement set for a product category addressing consumer needs.
BIncorrect. Building a specific product from its requirements is the role of vendor design work and the Security Target, not the PP.
CIncorrect. A PP is implementation-independent, and it includes both functional and assurance requirements, not only functional ones.
DIncorrect. Many Security Targets can claim conformance to one PP, so there is no required one-to-one correspondence, and a PP does not represent evaluated products.

Common trap: Mixing up the PP with the Security Target, which is the implementation-specific document a vendor writes for one product.

In practice: Government buyers often require products to be evaluated against a NIAP-approved Protection Profile, and vendors cite PP conformance in their Security Target.

Remember: PP = consumer-side, implementation-independent requirements for a product class; ST = vendor-side claims for a specific TOE.

Official documentation: CISSP Certification Exam Outline

Drafted with AI assistance and checked against the answer key.

Open this question on its own page

Domain Security Architecture and Engineering

What principle requires that changes to the plaintext affect many parts of the ciphertext?

Answer options

Correct Answer:

Explanation

Diffusion is a fundamental cryptographic principle introduced by Claude Shannon. Its purpose is to obscure the statistical relationship between the plaintext and the ciphertext. This is achieved by ensuring that a single change in a plaintext character or bit results in changes to many parts of the resulting ciphertext. This property, often called the avalanche effect, makes it significantly harder for a cryptanalyst to deduce the key or plaintext by observing patterns, as the influence of each plaintext symbol is spread widely across the ciphertext. Modern block ciphers like AES use operations such as permutation and mixing to achieve strong diffusion.

References

1. Shannon

C. E. (1949). Communication Theory of Secrecy Systems. Bell System Technical Journal

28(4)

656-715. In Section 5

"Theoretical Secrecy

" Shannon introduces diffusion as a method where "the statistical structure of [the message]... is 'dissipated' into long range statistics." (p. 662). https://doi.org/10.1002/j.1538-7305.1949.tb00928.x

2. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. In Chapter 3

Section 3.2

"Feistel Cipher Design Principles

" diffusion is defined as the property where "the statistical structure of the plaintext is dissipated into long-range statistics of the ciphertext... by having each plaintext digit affect the value of many ciphertext digits." (p. 71).

3. National Institute of Standards and Technology (NIST). (2001). FIPS PUB 197: Advanced Encryption Standard (AES). Section 5.1.3

"The MixColumns() Transformation

" describes a key step in AES that provides diffusion within the cipher

ensuring that the bits from one column are spread to all four columns in the next state.

Question breakdown

Tests: Apply cryptographic design principles (confusion and diffusion)
Difficulty: Easy

Key idea: Diffusion spreads the influence of each plaintext bit across many ciphertext bits, which hides statistical patterns.

How to reach the answer

The clue is 'changes to the plaintext affect many parts of the ciphertext'.
Shannon's two principles are confusion, which obscures the key-to-ciphertext relationship, and diffusion, which spreads plaintext influence.
Spreading plaintext influence is diffusion, and the resulting behavior is called the avalanche effect.
Permutation is one technique for achieving diffusion, not the principle itself.

Each option

ACorrect. Diffusion is the principle that each plaintext change ripples across many ciphertext bits.
BIncorrect. Encapsulation is a networking and object-oriented concept, not a cipher design principle.
CIncorrect. Obfuscation means making code or data hard to understand, not a defined Shannon property of ciphers.
DIncorrect. Permutation (transposition) is a mechanism used to achieve diffusion, but it is not the named principle.

Common trap: Choosing permutation because it is the operation that produces diffusion in ciphers like AES.

In practice: When assessing custom or legacy ciphers, weak diffusion shows up as ciphertext patterns that leak plaintext structure, as in ECB-mode images.

Remember: Diffusion spreads plaintext influence across the ciphertext; confusion hides the key relationship.

Official documentation: CISSP Certification Exam Outline

Drafted with AI assistance and checked against the answer key.

Open this question on its own page

Domain Asset Security

DRAG DROP Place in order, from BEST (1) to WORST (4), the following methods to reduce the risk of data remanence on magnetic media.

Drag and drop answer

Enable JavaScript to use the drag and drop feature.

Correct Answer:

Method Overwriting: A. 1 Degaussing: B. 2 Destruction: C. 3 Deleting: D. 4

Explanation

The methods are ranked based on their effectiveness in rendering data irrecoverable.

Destruction is the most effective method as it physically destroys the media (e.g., through shredding, pulverizing, or incineration), making data recovery impossible.
Degaussing is the next best, using a powerful magnetic field to neutralize the magnetic alignment on the media, effectively erasing the data and making it infeasible to recover even with advanced laboratory techniques.
Overwriting involves writing new patterns of data over the original data. While effective against simple recovery tools, sophisticated forensic methods might still be able to recover data remnants.
Deleting is the least effective method. It typically only removes the file's pointer from the file system's index, leaving the actual data on the disk until it is overwritten by new files. This data is easily recovered with common software.

References

NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization. This standard defines the hierarchy of sanitization methods.

Section 2.4, "Destruction": Describes methods like disintegration, pulverization, melting, and incineration as the ultimate form of sanitization. "Destruction of media is the most secure method of sanitization." (Page 8).

Section 2.3, "Purge": Defines Purge techniques, including Degaussing, as rendering data recovery "infeasible using state of the art laboratory techniques." (Page 8).

Section 2.2, "Clear": Defines Clear techniques, including Overwriting, as applying "logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques." (Page 7). Standard file deletion is explicitly noted as not being a sufficient method of clearing.

Garfinkel, S., & Rosen, R. (2015). A Guide to Understanding Data Remanence in Automated Information Systems. National Institute of Standards and Technology.

Section 3.1, "Data Deletion versus Media Sanitization": "Deleting a file on a typical file system is a simple, fast operation. In most cases, the operation simply removes the directory entry for the file and returns the file’s allocated blocks to the pool of free space... the file’s data blocks are not actually modified in any way and could be recovered." (Page 9). This confirms 'Deleting' as the least secure option.

Zhi, L. (2010). A new approach to information security of computer hard disk. 2010 2nd IEEE International Conference on Information Management and Engineering. https://doi.org/10.1109/ICIME.2010.5477465

Section III, "Common Methods of Hard Disk Information Security": This paper reviews common methods and implicitly ranks their security. It describes physical destruction as providing "the highest security degree," degaussing as a "reliable secure erasure method," and overwriting as a method that can be defeated by specialized equipment, placing them in the same hierarchy as the NIST standard.

Domain Security Operations

DRAG DROP Order the below steps to create an effective vulnerability management process.

Drag and drop answer

Enable JavaScript to use the drag and drop feature.

Identify assets
Identify risks
Implement change management
Implement patch deployment
Implement recurring scanning schedule

Correct Answer:

Order 1: A. Identify assets 2: B. Identify risks 3: E. Implement recurring scanning schedule 4: C. Implement change management 5: D. Implement patch deployment

Explanation

This sequence represents a logical and standard methodology for establishing an effective vulnerability management program.

Identify assets: The foundational step is to create a comprehensive inventory of all hardware and software assets. An organization cannot protect what it does not know it has. This step defines the scope of the entire program.
Identify risks: Once assets are known, an initial risk assessment is performed to identify existing vulnerabilities and understand their potential impact. This establishes a baseline and helps prioritize subsequent actions.
Implement recurring scanning schedule: To ensure continuous discovery, an automated scanning process is implemented. This operationalizes the vulnerability identification phase, allowing the organization to detect new vulnerabilities in a timely manner.
Implement change management: Before remediation actions (like patching) are performed, a formal governance process for change management must be established. This ensures that all changes are reviewed, tested, and approved, minimizing operational disruption.
Implement patch deployment: With a governance framework in place, the technical tools and procedures for patch deployment can be implemented. This is the primary remediation step to fix the vulnerabilities discovered during scanning.

References

The MITRE Corporation. (2010). A Reference Architecture for Enterprise Vulnerability Management. Section 2.1, "Foundational Components," emphasizes that Asset Management is a prerequisite for the vulnerability management lifecycle, which consists of scanning, analysis, and remediation.

National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control RA-5 (Vulnerability Monitoring and Scanning) mandates scanning systems, which presupposes an inventory defined in CM-8 (System Component Inventory). Furthermore, remediation is governed by CM-3 (Configuration Change Control), reinforcing the need for change management before implementing fixes.

Enck, W., & Moyer, T. (2007). Towards a More Secure, Available, and Manageable Enterprise Infrastructure. MIT Lincoln Laboratory. The paper discusses the importance of a structured approach starting with asset discovery, followed by vulnerability assessment, and then controlled remediation, highlighting that "patch management is the primary mechanism for mitigating software vulnerabilities" (p. 2) and must be done in a controlled manner.

Al-Shaer, E., & El-Atawy, A. (2008). Network configuration in a box: A toolbox for building secure and available network configuration management systems. Proceedings of the 4th International Workshop on Security and Trust Management (STM '08). The work implicitly supports the sequence by discussing the necessity of knowing the network state (assets and configuration) before managing changes and vulnerabilities. DOI: 10.1007/978-3-540-85247-0_1

Domain Security and Risk Management

DRAG DROP During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. What is the best approach for the CISO? Below are the common phases to creating a Business Continuity/Disaster Recovery (BC/DR) plan. Drag the remaining BC\DR phases to the appropriate corresponding location.

Drag and drop answer

Enable JavaScript to use the drag and drop feature.

Risk Assessment
Business Impact Analysis
Mitigation Strategy Development
BC\DR Plan Development
Training, Testing & Auditing
Plan Maintenance

Correct Answer:

Answer Area Bucket 1: A. Risk Assessment Bucket 2: B. Business Impact Analysis Bucket 3: C. Mitigation Strategy Development Bucket 4: D. BC\DR Plan Development Bucket 5: E. Training, Testing & Auditing Bucket 6: F. Plan Maintenance

Explanation

The question requires ordering the standard phases of the Business Continuity/Disaster Recovery (BC/DR) lifecycle. The scenario involving the CISO and PHI data is context, establishing the need for a formal BC/DR process. The correct approach is to follow this established lifecycle. The process begins with Risk Assessment to identify potential threats and vulnerabilities, followed by a Business Impact Analysis (BIA) to determine the operational and financial impacts of a disruption to critical functions. Based on these analyses, a Mitigation Strategy is developed. This strategy is then formalized into the BC/DR Plan. The plan must be validated through Training, Testing & Auditing. Finally, Plan Maintenance ensures the plan remains current through regular reviews and updates, creating a continuous improvement cycle.

References

National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems.

Section 3, "Information System Contingency Planning Process," outlines the seven-step process that closely mirrors the required sequence: (1) Develop Policy, (2) Conduct BIA, (3) Identify Preventive Controls, (4) Create Contingency Strategies, (5) Develop Plan, (6) Plan Testing, Training, and Exercises, and (7) Plan Maintenance. This standard validates the progression from analysis (BIA) to strategy, plan development, testing, and maintenance.

International Organization for Standardization (ISO) 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 8, "Operation," specifies the operational activities of a BCMS. Section 8.2.2 requires performing a business impact analysis and 8.2.3 a risk assessment. Section 8.3 requires the determination of business continuity strategy, followed by the establishment of 8.4 "business continuity plans and procedures." Clause 9.1.3 then requires that the plans are validated through exercises and testing.

Tipton, H. F., & Krause, M. (Eds.). (2007). Information Security Management Handbook, Sixth Edition. CRC Press.

Chapter 27, "Business Continuity Planning," details the BCP process. It describes the sequence as initiating the project, performing a business impact analysis, developing recovery strategies, developing the BCP, and finally, implementing, testing, and maintaining the plan. This aligns with the provided answer's sequence.

Domain Communication and Network Security

HOTSPOT In the network design below, where is the MOST secure Local Area Network (LAN) segment to deploy a Wireless Access Point (WAP) that provides contractors access to the Internet and authorized enterprise services?

Your Answer

Correct Answer:

LAN 4

Explanation

The network segment labeled LAN 4 represents a Demilitarized Zone (DMZ), which is a perimeter network located between two firewalls. A DMZ is the most secure location to deploy services for less-trusted users, such as contractors, because it isolates their traffic from the highly secured internal network (LAN 2). Placing the Wireless Access Point (WAP) in the DMZ allows contractors to access the Internet through the external firewall while the internal firewall can enforce strict rules, granting access only to specific, authorized enterprise services. This architecture upholds the principle of least privilege and protects critical assets on the internal network, such as the Database Server in LAN 2.

References

Stallings, W. (2017). Network Security Essentials: Applications and Standards (6th ed.). Pearson.

Reference: Chapter 9, Section 9.2, "Firewall Configurations," particularly the discussion on the "Screened Subnet Firewall System" (p. 297, Figure 9.5c). This section details the dual-firewall architecture where the DMZ is the isolated network between an external and internal firewall, which is the standard design for securely hosting systems that require external access without exposing the internal network.

Zwicky, E. D., Cooper, S., & Chapman, D. B. (2000). Building Internet Firewalls (2nd ed.). O'Reilly & Associates.

Reference: Chapter 6, "Firewall Architectures," specifically the section on "Screened Subnet" (pp. 138-142). This source describes the screened subnet (DMZ) as the canonical solution for allowing access from the Internet to selected hosts while protecting the internal network. Placing a WAP for semi-trusted users in this zone is a direct application of this principle.

Cheswick, W. R., Bellovin, S. M., & Rubin, A. D. (2003). Firewalls and Internet Security: Repelling the Wily Hacker (2nd ed.). Addison-Wesley Professional.

Reference: Chapter 4, "Firewall-Friendly Protocols and the DMZ." The chapter explains that the purpose of a DMZ is to create a "neutral zone" for machines that need to be accessible from the outside but should not be trusted on the internal network. This concept directly applies to creating a network segment for contractors.

Domain Security Assessment and Testing

When planning a penetration test, the tester will be MOST interested in which information?

Answer options

Correct Answer:

Explanation

The fundamental purpose of a penetration test is to identify vulnerabilities and demonstrate their potential impact by actively exploiting them. During the planning phase, the tester's primary interest is to understand the target environment's potential weaknesses and map them to known or custom exploits. This information is crucial for defining the scope, methodology, and rules of engagement for the test. The entire attack strategy is built around the exploits that can be leveraged against the identified or suspected vulnerabilities.

References

1. NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment: Section 6.4

"Vulnerability Validation

" states

"The primary objective of vulnerability validation is to obtain evidence to confirm that the vulnerability exists... This is often accomplished by trying to exercise or exploit the vulnerability." The planning phase (Section 5) is conducted with this end goal in mind.

2. (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

9th Edition: Chapter 20

"Security Assessment and Testing

" describes the phases of a penetration test. It states

"The goal of a penetration test is to simulate an attack to identify and exploit vulnerabilities." This confirms that the focus on exploits is central to the entire process

beginning with planning.

3. Penetration Testing: A Hands-On Introduction to Hacking (University of Georgia

CSCI 4260/6260 course material): The methodology taught

mirroring industry standards like the Penetration Testing Execution Standard (PTES)

emphasizes that after information gathering

the next logical step is vulnerability analysis and planning the exploitation phase. The plan revolves around "what can we exploit and how?" (See PTES Standard

"Vulnerability Analysis" and "Exploitation" phases).

Question breakdown

Tests: Plan and conduct penetration testing
Difficulty: Medium

Key idea: A penetration test is built around finding weaknesses and the exploits that can demonstrate them.

How to reach the answer

The clue is 'planning a penetration test' combined with 'MOST interested'.
A pen test differs from a vulnerability scan because it attempts exploitation to prove impact.
The tester therefore plans around which exploits can be used against expected weaknesses.
Access points and social engineering details are inputs, but they serve the exploitation goal.

Each option

AIncorrect. Installing back doors is generally out of scope for an authorized test and is not the central planning concern.
BIncorrect. Network access points are useful reconnaissance data but only as a means to apply exploits.
CIncorrect. Job handouts and tours can support social engineering, but they are minor information sources.
DCorrect. Exploits that can attack weaknesses are the core of the test plan, since the test aims to demonstrate exploitable vulnerabilities.

Common trap: Picking network access points because reconnaissance comes first, while missing that the question asks what matters most.

In practice: Pen test scoping and rules of engagement describe which classes of exploits are permitted against which targets, based on the expected attack surface.

Remember: Pen testing is about proving exploitability, so exploits against weaknesses drive the plan.

Drafted with AI assistance and checked against the answer key.

Open this question on its own page

Domain Communication and Network Security

Which one of the following operates at the session, transport, or network layer of the Open System Interconnection (OSI) model?

Answer options

Correct Answer:

Explanation

A Cyclic Redundancy Check (CRC) is a type of error-detecting code used to detect accidental changes to data. While CRCs are most prominently used at the Data Link Layer (Layer 2) in the Frame Check Sequence (FCS), the fundamental principle of using a calculated value for integrity checking is also a core function of the Network and Transport layers. The IPv4 header (Network Layer 3) and the TCP/UDP headers (Transport Layer 4) both contain checksum fields for error detection. Among the choices provided, CRC is the only option that represents this type of low-level data integrity mechanism embedded within network protocol data units at the specified layers.

References

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Page 231

Section 3.4.2

"The Internet's Transport-Layer Protocols": The text describes the UDP segment structure

stating

"The checksum is used by the receiving host to check whether errors have been introduced into the segment... The checksum is also calculated over a few of the fields in the IP header." This confirms checksum functionality at the Transport Layer (Layer 4).

Page 347

Section 4.4.1

"The IP Datagram Format": The text details the IPv4 datagram format

including the "Header checksum" field

which is used "to aid a router in detecting bit errors in a received IP datagram." This confirms checksum functionality at the Network Layer (Layer 3).

2. Postel

J. (1981

September). RFC 791: Internet Protocol. Internet Engineering Task Force (IETF).

Section 3.1

"Format": This RFC defines the IPv4 header. It specifies the "Header Checksum" field and its purpose: "A checksum on the header only. Since some header fields change (e.g.

time to live)

this is recomputed and verified at each point that the internet header is processed." This directly places an integrity-checking mechanism at the Network Layer (Layer 3).

3. Postel

J. (1981

September). RFC 793: Transmission Control Protocol. Internet Engineering Task Force (IETF).

Section 3.1

"Format": This RFC defines the TCP header

which includes a "Checksum" field. The description states

"The checksum field is the 16 bit one's complement of the one's complement sum of all 16 bit words in the header and text... This is a required field." This places an integrity-checking mechanism at the Transport Layer (Layer 4).

4. Stallings

W. (2017). Data and Computer Communications (10th ed.). Pearson Education.

Chapter 6

Section 6.2

"Error Detection": This section provides a detailed explanation of CRC

noting its power and common implementation. It states

"The CRC is one of the most common and most powerful of the error-detecting codes... The CRC is commonly used in data link control protocols

such as HDLC." While highlighting its primary use at Layer 2

the chapter's context on error detection is applicable to the checksums used in Layers 3 and 4

which serve the same purpose.

Question breakdown

Tests: Map security mechanisms to OSI model layers
Difficulty: Hard

Key idea: Error-detection codes such as CRCs and checksums are built into protocol data units at lower OSI layers, unlike administrative or storage controls.

How to reach the answer

The clue is 'operates at the session, transport, or network layer', so look for a protocol-embedded mechanism.
Data at rest encryption applies to stored data, not to data in transit through the stack.
Configuration management is a process, and integrity checking software (such as file integrity monitoring) runs at the application or host level.
CRC and checksum-style error detection is embedded in protocol headers and trailers, which makes it the only network-stack mechanism listed.

Each option

AIncorrect. Data at rest encryption protects stored data and is not an OSI transmission-layer function.
BIncorrect. Configuration management is an administrative process, not a protocol-layer mechanism.
CIncorrect. Integrity checking software operates on files at the host or application level.
DCorrect. CRC-style error detection is part of protocol data units, and related checksums appear in network- and transport-layer headers.

Common trap: Choosing integrity checking software because 'integrity' sounds like a protocol function, even though it is a host-level tool.

In practice: Network engineers rely on frame CRC and IP/TCP checksums to detect corruption, but these codes provide no protection against deliberate tampering.

Remember: CRCs and checksums are lower-layer protocol mechanisms for accidental-error detection; host tools and processes are not.

Drafted with AI assistance and checked against the answer key.

Open this question on its own page

Domain Security Operations

Which of the following is the MOST beneficial to review when performing an IT audit?

Answer options

Correct Answer:

Explanation

Security logs provide a chronological record of events and are the most beneficial source of evidence for an IT auditor. They offer direct, factual data on what has actually occurred on systems and networks, including user activities, system changes, and security events. By analyzing these logs, an auditor can verify whether security controls are operating effectively, whether policies are being complied with, and can identify anomalies or potential security incidents. While policies and configuration settings establish the criteria and state of a system, logs provide the evidence of operational reality, making them the most crucial element for review.

References

1. (ISC)² CISSP Official Study Guide

9th Edition. Chapter 13

"Security Assessment and Testing

" discusses security audits. It emphasizes that auditors review evidence to determine compliance. The text states

"Auditors often review log files

security settings

and other records to verify that policies are being followed." Logs are presented as a primary form of evidence for what has occurred.

2. NIST Special Publication 800-53A

Revision 5

Assessing Security and Privacy Controls in Information Systems and Organizations. The assessment procedures for the Audit and Accountability (AU) control family

such as AU-2 (Audit Events) and AU-6 (Audit Record Review

Analysis

and Reporting)

explicitly list "Examine" as a primary assessment method. This involves reviewing "system audit records" and "audit review

analysis

and reporting documentation" to determine if controls are implemented correctly and are effective. This positions logs (audit records) as the direct evidence to be examined.

3. NIST Special Publication 800-92

Guide to Computer Security Log Management. Section 2.2

"Log Management Operational Processes

" states that log analysis is a key component of security auditing and forensics. It highlights that logs are used to "demonstrate compliance with regulations and facilitate security auditing and problem resolution." This underscores the central role of logs as the primary data source for an audit.

Question breakdown

Tests: Conduct security audits and collect evidence
Difficulty: Medium

Key idea: Security logs record what actually happened, so they are the strongest evidence that controls operate as intended.

How to reach the answer

The clue is 'MOST beneficial to review when performing an IT audit', so look for the best evidence.
Policies define intended behavior, but they do not prove behavior.
Configuration settings show a current state, but not activity over time.
Security logs give a historical record of events that can be tested against policy, which makes them the best choice.

Each option

AIncorrect. An audit policy only defines what should be logged; it is not evidence of what occurred.
BCorrect. Security logs provide factual, time-stamped evidence of activity, which auditors use to verify control effectiveness.
CIncorrect. Security policies are audit criteria, not evidence of compliance.
DIncorrect. Configuration settings show one moment in time and do not reveal what actually happened.

Common trap: Picking security policies because audits measure against policy, while confusing the criteria with the evidence.

In practice: Auditors sample logs such as privileged access and account changes to confirm that controls like access reviews actually work over the audit period.

Remember: Policies tell you what should happen; logs prove what did happen.

Drafted with AI assistance and checked against the answer key.

Open this question on its own page

Domain Security and Risk Management

Which of the following is the MOST important activity an organization performs to ensure that securiy is part of the overall organization culture?

Answer options

Correct Answer:

Explanation

The most critical activity for embedding security into an organization's culture is ensuring it is aligned with and supports the business's strategic goals. This requires active collaboration with senior management. When security is perceived as a business enabler rather than a cost center, it receives top-down support, funding, and prioritization. This leadership commitment is the foundation upon which a security-conscious culture is built, as it signals the importance of security to the entire organization. Without this strategic alignment and executive sponsorship, other security activities like policy issuance or audits remain tactical compliance exercises rather than integral cultural values.

References

1. Stewart

J. M.

Tittel

& Chapple

M. (2021). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide (9th ed.). Wiley. In Chapter 1

"Security and Risk Management

" the text states

"Senior management creates the security program and ensures that it is properly staffed

funded

and has organizational priority. It is responsible for making the decisions that set the tone for the entire organization." (p. 6). This highlights the foundational role of senior management.

2. (ISC)². (2021). Official (ISC)² CISSP CBK Reference (6th ed.). In Domain 1

"Security and Risk Management

" the concept of security governance is detailed

emphasizing that governance must align with business strategy. The text notes

"The governance process must be driven from the top of the organization (e.g.

board of directors and senior executives) down..." (p. 4).

3. Da Veiga

& Eloff

J. H. P. (2010). A framework and assessment instrument for information security culture. Computers & Security

29(2)

196-207. https://doi.org/10.1016/j.cose.2009.09.002. The research identifies "Management support and leadership" as a critical dimension for establishing and measuring an information security culture

reinforcing that leadership's role is paramount.

Question breakdown

Tests: Align security governance with business strategy and senior management
Difficulty: Easy

Key idea: Security becomes part of organizational culture when it is aligned with business goals and visibly backed by senior management, rather than imposed as a set of tactical controls.

How to reach the answer

Note the qualifiers 'MOST important' and 'overall organization culture'. Together they signal a governance-level answer, not an operational one.
Culture is shaped from the top down. Leadership sets tone, priorities, and funding.
Policies, incident reviews, and audits all depend on management support to have any lasting cultural effect.
Option D is the only choice that ties security to business goals through senior management, so it is the foundational activity.

Each option

AIncorrect. Handing out policies spreads awareness, but it does not create buy-in, and without leadership backing policies are often ignored.
BIncorrect. Formal incident reviews are a reactive, operational improvement activity rather than the driver of organization-wide culture.
CIncorrect. An audit program measures compliance after the fact and can make security feel like policing rather than a shared value.
DCorrect. Working with senior management to support business goals gives security executive sponsorship and strategic relevance, which is the foundation of a security culture.

Common trap: Option A is tempting because policies are the formal expression of security intent, but issuing documents is a tactical step that only works once leadership has established security as a business priority.

In practice: Security leaders who present risk in business terms to executives and tie controls to strategic objectives get the funding, staffing, and tone-from-the-top messaging that make employees take security seriously.

Remember: For 'most important' governance or culture questions, pick the option that aligns security with business objectives through senior management support.

Official documentation: CISSP Certification - ISC2

Drafted with AI assistance and checked against the answer key.

Open this question on its own page

Question 1 of 10

Exam domains

What the CISSP practice set covers

Every question in this set is mapped to one of 8 exam domains. Check the official exam outline for the current domain weights.

Security and Risk Management

2 of the 10 free questions

Asset Security

1 of the 10 free questions

Security Architecture and Engineering

2 of the 10 free questions

Communication and Network Security

2 of the 10 free questions

Identity and Access Management (IAM)

Security Assessment and Testing

1 of the 10 free questions

Security Operations

2 of the 10 free questions

Software Development Security

Study resources

CISSP study guides and comparisons

Go deeper than the practice questions: certification comparisons, study plans, and career context for CISSP.

All guides

IT Careers & Certification Insights · 8 min read AWS Certification Salary 2026: How It Stacks Up Against CISSP, CISM, and CRISC Read the guide

IT Certification Comparisons · 15 min read PMP vs CISSP: Which Professional Certification Is Worth More in 2026? Read the guide

IT Careers & Certification Insights · 13 min read CISSP vs CEH: Which Cybersecurity Certification Should You Take in 2026? Read the guide

Source context

How this practice set is maintained

Maintained by the CertMage content team, this page loads questions from the exam dataset connected to its preparation resource. When an answer includes a supporting reference, it is shown with that answer so you can review the underlying vendor documentation.

Certification objectives, interfaces, and vendor services can change. Verify important details against the provider's current exam guide and documentation before your exam.

How this practice set is maintained

Certified Cloud Security Professional

ISC2 Certified in Cybersecurity

Information Systems Security Management Professional

ISC2 ISC2-SSCP certification exam

Certified in Governance, Risk and Compliance

ISC2 - Certified Secure Software Lifecycle Professional