CISSP Practice Test

CISSP practice test: what's covered

Free CISSP sample questions

1. The PRIMARY purpose of designing an information security assessment strategy is to:

   • A. Identify all vulnerabilities in the organization
   • B. Align assessment activities with organizational risk tolerance and compliance obligations
   • C. Generate detailed reports for executive review
   • D. Comply with regulatory penetration testing requirements
   Show answer

   Correct: B. Option 'Align assessment activities with organizational risk tolerance and compliance obligations' is correct because it provides the most comprehensive alignment with risk management standards and CISSP Domain 6 testing principles. Option 'Identify all vulnerabilities in the organization' is incorrect because it addresses an operational output rather than the primary strategic objective. Option 'Generate detailed reports for executive review' is wrong because it lacks proper authorization or regulatory scoping. Option 'Comply with regulatory penetration testing requirements' is incorrect because it provides an incomplete mechanism for verifying control effectiveness.

2. You are serving as the Lead Security Auditor conducting an enterprise compliance assessment. An organization is choosing between an internal and an external assessor. Which factor MOST justifies hiring an external assessor?

   • A. Lower cost
   • B. Faster turnaround
   • C. Independence and objectivity required by regulators or stakeholders
   • D. Better understanding of internal systems
   Show answer

   Correct: C. Option 'Independence and objectivity required by regulators or stakeholders' is correct because it provides the most comprehensive alignment with risk management standards and CISSP Domain 6 testing principles. Option 'Lower cost' is incorrect because it addresses an operational output rather than the primary strategic objective. Option 'Faster turnaround' is wrong because it lacks proper authorization or regulatory scoping. Option 'Better understanding of internal systems' is incorrect because it provides an incomplete mechanism for verifying control effectiveness.

3. A CISO is building the annual security testing calendar. The organization has SOX, PCI-DSS, and HIPAA obligations, processes 1.2M card transactions annually, and operates a customer-facing SaaS. Which approach should the CISO use to set assessment frequency?

   • A. Test all systems quarterly to satisfy the most stringent regulator
   • B. Apply a risk-based approach, testing high-risk systems more frequently while meeting each regulation's minimum cadence
   • C. Test only the systems in scope of each regulation, separately
   • D. Outsource all testing annually to a single QSA firm
   Show answer

   Correct: B. Option 'Apply a risk-based approach, testing high-risk systems more frequently while meeting each regulation's minimum cadence' is correct because it provides the most comprehensive alignment with risk management standards and CISSP Domain 6 testing principles. Option 'Test all systems quarterly to satisfy the most stringent regulator' is incorrect because it addresses an operational output rather than the primary strategic objective. Option 'Test only the systems in scope of each regulation, separately' is wrong because it lacks proper authorization or regulatory scoping. Option 'Outsource all testing annually to a single QSA firm' is incorrect because it provides an incomplete mechanism fo

4. During a third-party risk assessment, a CISO is establishing security testing frameworks. NIST SP 800-53A is BEST described as:

   • A. A control catalog
   • B. A risk management framework
   • C. An assessment procedures guide for NIST SP 800-53 controls
   • D. A privacy framework
   Show answer

   Correct: C. Option 'An assessment procedures guide for NIST SP 800-53 controls' is correct because it provides the most comprehensive alignment with risk management standards and CISSP Domain 6 testing principles. Option 'A control catalog' is incorrect because it addresses an operational output rather than the primary strategic objective. Option 'A risk management framework' is wrong because it lacks proper authorization or regulatory scoping. Option 'A privacy framework' is incorrect because it provides an incomplete mechanism for verifying control effectiveness.

5. A SOC Manager is auditing incident detection and vulnerability management workflows. Rules of Engagement (ROE) for a penetration test should be FINALIZED:

   • A. Verbally with the testing team before kickoff
   • B. In writing, signed by both parties before any testing begins
   • C. After scope discovery during the test
   • D. By the security team without legal review
   Show answer

   Correct: B. Option 'In writing, signed by both parties before any testing begins' is correct because it provides the most comprehensive alignment with risk management standards and CISSP Domain 6 testing principles. Option 'Verbally with the testing team before kickoff' is incorrect because it addresses an operational output rather than the primary strategic objective. Option 'After scope discovery during the test' is wrong because it lacks proper authorization or regulatory scoping. Option 'By the security team without legal review' is incorrect because it provides an incomplete mechanism for verifying control effectiveness.

Last updated: 2026-10-19

CISSP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test