CISSP Practice Test

CISSP practice test: what's covered

Free CISSP sample questions

1. As a senior application security architect designing a Secure Software Development Life Cycle (SSDLC) framework for an enterprise, at which stage should security activities be incorporated?

   • A. Deferred until the final QA and pre-production penetration testing phase to minimize developer friction
   • B. Integrated continuously across every phase from initial requirements gathering through deployment and retirement
   • C. Delegated exclusively to the quality assurance testing team immediately prior to release
   • D. Restricted to automated code vulnerability scanning during the post-deployment operations phase
   Show answer

   Correct: B. Option "Integrated continuously across every phase from initial requirements gathering through deployment and retirement" is correct because integrating security across every phase of the SSDLC ('shift-left' security) ensures vulnerabilities are identified and remediated early when remediation costs are lowest. The remaining options are incorrect because deferring security to final QA, delegating it solely to QA, or restricting it to post-deployment creates severe security risks, expensive rework, and deployment bottlenecks.

2. You are evaluating development methodologies for a enterprise project with strict regulatory requirements. Which characteristic BEST defines the traditional Waterfall software development model?

   • A. Iterative delivery cycles where working software is delivered in rapid two-week sprints
   • B. Sequential phases with formal gate reviews where each phase must complete before the next begins
   • C. Continuous deployment pipelines without formal phase gates or milestone approvals
   • D. Ad-hoc rapid prototyping cycles without documented requirements or design baselines
   Show answer

   Correct: B. Option "Sequential phases with formal gate reviews where each phase must complete before the next begins" is correct because Waterfall follows a linear, sequential progression through requirements, design, implementation, testing, and maintenance with strict phase gates. The remaining options are incorrect because iterative delivery sprints describe Agile, continuous deployment pipelines characterize DevOps, and ad-hoc rapid prototyping lacks the formal structure of Waterfall.

3. A software engineering team is transitioning to Agile development practices. What is the PRIMARY focus of the Agile methodology according to the Agile Manifesto?

   • A. Heavyweight upfront architecture documentation and strict change freeze windows
   • B. Iterative delivery, working software, customer collaboration, and responding flexibly to change
   • C. Elimination of all software documentation and security review requirements
   • D. Strict quarterly release schedules managed exclusively by executive steering committees
   Show answer

   Correct: B. Option "Iterative delivery, working software, customer collaboration, and responding flexibly to change" is correct because the Agile Manifesto emphasizes individuals and interactions, working software, customer collaboration, and responding to change over rigid plans. The remaining options are incorrect because heavy upfront documentation is characteristic of Waterfall, eliminating documentation is a misconception of Agile, and rigid quarterly schedules conflict with Agile flexibility.

4. During a Scrum sprint planning session for a secure web application, which role is strictly responsible for prioritizing items in the Product Backlog?

   • A. The Scrum Master who facilitates daily standup meetings and removes process impediments
   • B. The Product Owner who represents business requirements and feature prioritization
   • C. The Lead Software Developer who assigns technical implementation tasks to engineers
   • D. The Chief Information Security Officer (CISO) who approves release deployment windows
   Show answer

   Correct: B. Option "The Product Owner who represents business requirements and feature prioritization" is correct because in Scrum, the Product Owner is uniquely responsible for managing and prioritizing the Product Backlog to maximize business value and security user stories. The remaining options are incorrect because the Scrum Master facilitates the Scrum process, developers execute backlog items, and executive leadership provides governance rather than owning backlog ordering.

5. An enterprise organization is implementing a DevSecOps transformation. What core principle PRIMARILY distinguishes DevOps and DevSecOps philosophies?

   • A. Maintaining strict operational silos between software developers and system administrators
   • B. Automation, cross-functional collaboration between dev and ops, CI/CD integration, and rapid feedback loops
   • C. Manual deployment procedures to enforce dual-control authorization for all code changes
   • D. Replacing automated security scanners with annual manual third-party audits
   Show answer

   Correct: B. Option "Automation, cross-functional collaboration between dev and ops, CI/CD integration, and rapid feedback loops" is correct because DevOps and DevSecOps break down organizational silos by combining development, security, and operations into a continuous, automated workflow with tight feedback loops. The remaining options are incorrect because operational silos contradict DevOps principles, manual deployments create release bottlenecks, and relying solely on annual audits fails to match modern release cadences.

Last updated: 2026-10-19

CISSP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test