Loading demo links...
Showing 1–20 of 20 questions
Match the types of e-authentication tokens to their description.
Drag each e-authentication token on the left to its corresponding description on the right.
Answer is in the explanation below.
Match the access control type to the example of the control type.
Drag each access control type net to its corresponding example.
Answer is in the explanation below.
HOT SPOT
Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.
Answer is in the explanation below.
Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?
Select an option, then click Submit answer.
To verify that only employees have access to the facility.
To identify present hazards requiring remediation.
To monitor staff movement throughout the facility.
To provide a safe environment for employees.
What is the GREATEST challenge of an agent-based patch management solution?
Select an option, then click Submit answer.
Time to gather vulnerability information about the computers in the program
Requires that software be installed, running, and managed on all participating computers
The significant amount of network bandwidth while scanning computers
The consistency of distributing patches to each participating computer
In a change-controlled environment, which of the following is MOST likely to lead to unauthorized changes to production programs?
Select an option, then click Submit answer.
Modifying source code without approval
Promoting programs to production without approval
Developers checking out source code without approval
Developers using Rapid Application Development (RAD) methodologies without approval
Which of the following is the PRIMARY purpose of due diligence when an organization embarks on a merger or acquisition?
Select an option, then click Submit answer.
Assess the business risks.
Formulate alternative strategies.
Determine that all parties are equally protected.
Provide adequate capability for all parties.
Strategy and program management, project delivery, governance, operations
A cybersecurity engineer has been tasked to research and implement an ultra-secure communications channel to protect the organization's most valuable intellectual property (IP). The primary directive in this initiative is to ensure there Is no possible way the communications can be intercepted without detection. Which of the following Is the only way to ensure this
‘outcome?
Select an option, then click Submit answer.
Diffie-Hellman key exchange
Symmetric key cryptography
[Public key infrastructure (PKI)
Quantum Key Distribution
A software developer installs a game on their organization-provided smartphone. Upon installing the game, the software developer is prompted to allow the game access to call logs, Short Message Service (SMS) messaging, and Global Positioning System (GPS) location data. What has the game MOST likely introduced to the smartphone?
Select an option, then click Submit answer.
Alerting
Vulnerability
Geo-fencing
Monitoring
Which reporting type requires a service organization to describe its system and define its control objectives and controls that are relevant to users internal control over financial reporting?
Select an option, then click Submit answer.
Statement on Auditing Standards (SAS)70
Service Organization Control 1 (SOC1)
Service Organization Control 2 (SOC2)
Service Organization Control 3 (SOC3)
An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of which of the following types of attack?
Select an option, then click Submit answer.
Cross-Site Scripting (XSS)
Cross-site request forgery (CSRF)
Injection
Click jacking
What is the PRIMARY purpose of auditing, as it relates to the security review cycle?
Select an option, then click Submit answer.
To ensure the organization’s controls and policies are working as intended
To ensure the organization can still be publicly traded
To ensure the organization’s executive team won’t be sued
To ensure the organization meets contractual requirements
Which of the following is true of Service Organization Control (SOC) reports?
Select an option, then click Submit answer.
SOC 1 Type 2 reports assess the security, confidentiality, integrity, and availability of an organization’s controls
SOC 2 Type 2 reports include information of interest to the service organization’s management
SOC 2 Type 2 reports assess internal controls for financial reporting
SOC 3 Type 2 reports assess internal controls for financial reporting
What is the FINAL step in the waterfall method for contingency planning?
Select an option, then click Submit answer.
Maintenance
Testing
Implementation
Training
What are the PRIMARY responsibilities of security operations for handling and reporting violations and incidents?
Select an option, then click Submit answer.
Monitoring and identifying system failures, documenting incidents for future analysis, and scheduling patches for systems
Scheduling patches for systems, notifying the help desk, and alerting key personnel
Monitoring and identifying system failures, alerting key personnel, and containing events
Documenting incidents for future analysis, notifying end users, and containing events
Access to which of the following is required to validate web session management?
Select an option, then click Submit answer.
Log timestamp
Live session traffic
Session state variables
Test scripts
Which of the following would be considered an incident if reported by a security information and event management (SIEM) system?
Select an option, then click Submit answer.
An administrator is logging in on a server through a virtual private network (VPN).
A log source has stopped sending data.
A web resource has reported a 404 error.
A firewall logs a connection between a client on the Internet and a web server using Transmission Control Protocol (TCP) on port 80.
What is the PRIMARY reason for implementing change management?
Select an option, then click Submit answer.
Certify and approve releases to the environment
Provide version rollbacks for system changes
Ensure that all applications are approved
Ensure accountability for changes to the environment
Which type of disaster recovery plan (DRP) testing carries the MOST operational risk?
Select an option, then click Submit answer.
Cutover
Walkthrough
Tabletop
Parallel
Physical Access Control Systems (PACS) allow authorized security personnel to manage and monitor access control for subjects through which function?
Select an option, then click Submit answer.
Remote access administration
Personal Identity Verification (PIV)
Access Control List (ACL)
Privileged Identity Management (PIM)
This page holds a free practice test for the Certified Information Systems Security Professional (CISSP) certification from ISC2. The 20 questions are a free sample of the full Study4Pass practice set of 1382 questions, so you can check your level before you commit to the real exam. The free sample includes 17 single-answer, 2 drag-and-drop and 1 interactive questions — the same mix of formats you will meet in the full set. Questions are spread across the areas that matter most on the real exam: Jan 2023 Update, Software Development Security, Mixed questions and Communication and Network Security. The ISC CISSP (Certified Information Systems Security Professional) exam is a comprehensive exam that tests a candidate's knowledge and skills in the areas of information security, risk management, and security operations.
The target audience of the ISC CISSP Exam is cybersecurity professionals, such as information security analysts, security architects, security engineers, security consultants, systems administrators, and network administrators. The prerequisite for the ISC CISSP exam is that applicants must have a minimum of five years of cumulative, paid, full-time work experience in two or more of the eight…
Treat this sample as a diagnostic. Answer honestly, check the explanation after every question, and note which topics feel shaky. A short, focused review of those topics is worth more than re-reading everything — and the full set lets you drill them topic by topic.
A good way to use this page: take the whole sample in one sitting, then go back over every explanation with fresh eyes. Mark the topics that felt uncertain, not just the ones you got wrong — uncertain answers are unmarked risk on the real exam. One or two focused passes like this usually move a score more than days of passive reading.
Inside the full CISSP practice set:
Answer a question, then check the result to see the correct answer and the explanation behind it. Work at your own pace — there is no timer and no signup. Stuck on a concept? This is an AI-Enabled practice test: use Ask AI on any question and get the underlying concept explained in plain words, so you learn the reasoning instead of memorizing answers. Ready for more? The full 1382-question set adds a timed Exam Simulation mode, topic training for your weak areas, and a flagged-question review, so you can practise the way the real exam feels.
Yes — the 20 questions on this page are completely free, with no signup and no payment details needed.
1382 questions. The 20 free questions above are a sample of that full set, in the same style and topic balance.
Yes — every question shows the correct answer with an explanation, and Ask AI can explain the concept behind a question in plain words if you want to go deeper.
No. This is a practice test: the questions are written to mirror the real CISSP exam’s topics and difficulty, not copied from it.
