CISSP Practice Test – Full 150-Question Mock Exam

CISSP practice test: what's covered

Free CISSP sample questions

1. A senior security engineer is evaluating the following enterprise requirement: The CIA triad components are:

   • A. Confidentiality, Integrity, Availability
   • B. Confidentiality, Identity, Authority
   • C. Control, Identity, Audit
   • D. Compliance, Integrity, Authentication
   Show answer

   Correct: A. The cornerstone of information security: Confidentiality, Integrity, Availability. Choice "Confidentiality, Integrity, Availability" is correct because it directly satisfies the security objective. Other choices such as "Confidentiality, Identity, Authority" and "Control, Identity, Audit" are incorrect because they either misrepresent the core standard or apply to unrelated operational domains.

2. A senior security engineer is evaluating the following enterprise requirement: In quantitative risk analysis, ALE is calculated as:

   • A. Single Loss Expectancy multiplied by Annual Rate of Occurrence (SLE × ARO)
   • B. Asset Value multiplied by Exposure Factor (AV × EF)
   • C. Annual Rate of Occurrence multiplied by Return on Investment
   • D. Single Loss Expectancy plus Asset Value
   Show answer

   Correct: A. ALE (Annual Loss Expectancy) = SLE × ARO. SLE = AV × EF. ARO = annual rate of occurrence. Choice "Single Loss Expectancy multiplied by Annual Rate of Occurrence (SLE × ARO)" is correct because it directly satisfies the security objective. Other choices such as "Asset Value multiplied by Exposure Factor (AV × EF)" and "Annual Rate of Occurrence multiplied by Return on Investment" are incorrect because they either misrepresent the core standard or apply to unrelated operational domains.

3. A senior security engineer is evaluating the following enterprise requirement: SLE (Single Loss Expectancy) is calculated as:

   • A. Asset Value multiplied by Exposure Factor (AV × EF)
   • B. Annual Loss Expectancy divided by Annual Rate of Occurrence
   • C. Threat × Vulnerability
   • D. Risk × Impact
   Show answer

   Correct: A. SLE = Asset Value × Exposure Factor. Then ALE = SLE × ARO. Choice "Asset Value multiplied by Exposure Factor (AV × EF)" is correct because it directly satisfies the security objective. Other choices such as "Annual Loss Expectancy divided by Annual Rate of Occurrence" and "Threat × Vulnerability" are incorrect because they either misrepresent the core standard or apply to unrelated operational domains.

4. A senior security engineer is evaluating the following enterprise requirement: Which is NOT a valid risk treatment?

   • A. Mitigate the risk using security controls
   • B. Transfer the risk via insurance or contracts
   • C. Accept the identified residual risk level
   • D. Encrypt the underlying asset storage
   Show answer

   Correct: D. Encryption is a control (mitigation), not a risk treatment. Treatments: mitigate, transfer, accept, avoid. Choice "Encrypt the underlying asset storage" is correct because it directly satisfies the security objective. Other choices such as "Mitigate the risk using security controls" and "Transfer the risk via insurance or contracts" are incorrect because they either misrepresent the core standard or apply to unrelated operational domains.

5. A senior security engineer is evaluating the following enterprise requirement: Risk transference is BEST exemplified by:

   • A. Patching a vulnerability
   • B. Cyber insurance and outsourcing risk-bearing functions
   • C. Disabling a service
   • D. Risk acceptance
   Show answer

   Correct: B. Transfer shifts financial impact (insurance) or operations (outsource) — but not all liability. Choice "Cyber insurance and outsourcing risk-bearing functions" is correct because it directly satisfies the security objective. Other choices such as "Patching a vulnerability" and "Disabling a service" are incorrect because they either misrepresent the core standard or apply to unrelated operational domains.

Last updated: 2026-09-23

CISSP practice test FAQ

Related practice tests

• CISSP Domain 1 practice test
• CISSP Domain 3 practice test
• CCSP practice test
• ISC2 CC practice test
• CISM practice test
• CISSP study roadmap