CISSP Practice Test

CISSP practice test: what's covered

• Communication & Network Security

Free CISSP sample questions

1. A bank's network team is applying defense in depth across the network. Which measures genuinely add independent layers so one failure does not cause total compromise? (Choose THREE)

   • A. Perimeter firewalls plus internal segmentation between zones
   • B. Host-based controls such as endpoint protection on servers
   • C. Network and host intrusion detection at multiple vantage points
   • D. Relying on a single strong firewall as the only control
   • E. Hiding the internal addressing scheme as the primary defense
   Show answer

   Correct: A and B and C. Layering perimeter, segmentation, host controls, and detection at multiple points provides independent layers so one bypass does not cause full compromise. A single firewall is one layer, not defense in depth, so it is incorrect. Hiding addresses is security through obscurity and is not a genuine independent control, making it wrong as a primary defense.

2. An architect is redesigning a flat corporate LAN where any host can reach any other host. Adopting Zero Trust, what core stance should the new design enforce?

   • A. Never trust and always verify, applying least privilege and per-session authorization regardless of network location
   • B. Trust traffic originating inside the corporate LAN by default
   • C. Rely on a strong perimeter firewall as the single enforcement point
   • D. Use static allow rules that rarely change once configured
   Show answer

   Correct: A. Zero Trust removes implicit network trust and authorizes each session explicitly based on identity and context. Trusting the internal LAN is exactly the assumption Zero Trust rejects. A single perimeter firewall is the perimeter-only model Zero Trust replaces. Static rarely-changing rules contradict the continuous, dynamic verification Zero Trust requires.

3. After a breach spread freely across one large subnet, leadership asks how segmentation would have helped. What is the primary security benefit of network segmentation?

   • A. It limits attacker lateral movement and reduces blast radius by isolating zones with controlled crossings
   • B. It increases raw throughput by reducing collision domains
   • C. It eliminates the need for firewalls between trusted hosts
   • D. It lowers licensing cost by reducing the number of subnets
   Show answer

   Correct: A. Segmentation compartmentalizes the network so cross-zone access is gated, containing an intrusion. Throughput is a performance side effect, not the security purpose. It does not remove the need for firewalls; it relies on them to control crossings. Cost reduction is incorrect because segmentation usually adds, not reduces, infrastructure.

4. A data center team wants to apply security policy to each individual workload rather than to broad VLANs. Which capability are they describing?

   • A. Microsegmentation that enforces fine-grained per-workload policy to restrict east-west traffic
   • B. Traditional VLAN segmentation that groups large subnets
   • C. Port security that filters by switch port MAC address only
   • D. NAT overload that hides internal hosts behind one address
   Show answer

   Correct: A. Microsegmentation applies identity- or workload-aware policy at a granular level, a cornerstone of Zero Trust east-west control. Traditional VLAN segmentation operates on coarse subnets, not per workload. Port security only validates MAC addresses on a port. NAT overload is an addressing technique and provides no per-workload policy enforcement.

5. A company must host a public web portal and an SMTP relay reachable from the internet without exposing internal systems. Where should these services be placed?

   • A. In a DMZ, a separate segment isolating public-facing services from the internal network
   • B. Directly on the internal user VLAN for easier management
   • C. On the management network alongside switch and router consoles
   • D. Inside an encrypted VPN tunnel reachable only by employees
   Show answer

   Correct: A. A DMZ acts as a buffer zone hosting internet-facing services while shielding the internal network. Placing them on the internal VLAN would expose internal systems to internet traffic. The management network must stay isolated from public access. A VPN-only tunnel would prevent the public from reaching services that are meant to be public.

Last updated: 2026-10-19

CISSP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test