TheoryCISSP
Practice Test
1101+ CISSP practice questions with explanations. Study modes, progress tracking, works offline.
Heads up: the app and the web exam use separate accounts — a web unlock and an in-app purchase do not carry over. Buy on the web to practice on the web.
30 free CISSP questions
Sampled across every topic area — not just the first page. Try them as a quiz or flip them as flashcards.
-
CISSP
Which of the following access control models requires security clearance for subjects?
Correct — D. Mandatory access control (MAC) is an access policy that restricts access to objects based on the security clearance of a subject and the classification of an object. -
CISSP
In an organization where there are frequent personnel changes, non-discretionary access control using Role Based Access Control (RBAC) is useful because:
Correct — D. With Non-Discretionary Access Control, a central authority determines what subjects can have access to certain objects based on the organizational security policy. The access controls may be based on the individual’s role in the organization (role-based access control) or the subject’s responsibilities and duties (taskbased access control). In an organization where there are frequent personnel changes, non-discretionary access control is useful because the access controls are based on the individual’s role or title within the organization. These access controls do not need to be changed whenever a new person takes over that role. -
CISSP
Which item is not part of a Kerberos authentication implementation?
Correct — A. Message authentication code (MAC) is a cryptographic function and is not a key component of Kerberos. Kerberos is made up of a KDC, a realm of principals (users, services, applications, and devices), an authentication service, tickets, and a ticket granting service. -
CISSP
A central authority determines which files a user can access. <br/><br/>Which of the following best describes this?
Correct — D. A nondiscretionary access control model uses a central authority to determine which objects (such as files) that users (and other subjects) can access. In contrast, a discretionary access control model allows users to grant or reject access to any objects they own. An ACL is an example or rule‐based access control model. An access control matrix includes multiple objects, and it lists the subject’s access to each of the objects. -
CISSP
The major disadvantage of many Single Sign-On (SSO) implementations is described in which of the following?
Correct — D. Single Sign-On is a distributed Access Control methodology in which a user only has to authenticate once to have access to all major and secondary network domains. <br/><br/>When the individual needs extra resources, they would not be asked to re-authenticate. The security concern this raises is that if a fraudster is able to compromise those credentials, they will also have access to all the resources that the account has access to. Because they are distractors, all of the other responses are wrong. -
CISSP
To computer security software, the three traditional methods of authenticating yourself are something you know, something you have, and something:
Correct — A. Three common factors that can be used for authentication:<br/><br/>- Something a person knows.<br/><br/>- Something a person has.<br/><br/>- Something a person is. -
CISSP
In non-discretionary access control using Role Based Access Control (RBAC), a central authority determines what subjects can have access to certain objects based on the organizational security policy. The access controls may be based on:
Correct — A. With Non-Discretionary Access Control, a central authority determines what subjects can have access to certain objects based on the organizational security policy. The access controls may be based on the individual’s role in the organization (role-based access control) or the subject’s responsibilities and duties (taskbased access control). In an organization where there are frequent personnel changes, non-discretionary access control is useful because the access controls are based on the individual’s role or title within the organization. These access controls do not need to be changed whenever a new person takes over that role. -
CISSP
In Mandatory Access Control, sensitivity labels attached to objects contain what information?
Correct — C. Mandatory Access Control begins with security labels assigned to all resource objects on the system. These security labels contain two pieces of information - a classification (top secret, confidential etc.) and a category (which is essentially an indication of the management level, department or project to which the object is available).Similarly, each user account on the system also has classification and category properties from the same set of properties applied to the resource objects. <br/><br/>When a user attempts to access a resource under Mandatory Access Control the operating system checks the user's classification and categories and compares them to the properties of the object's security label. If the user's credentials match the MAC security label properties of the object access is allowed. It is important to note that both the classification and categories must match. A user with top secret classification, for example, cannot access a resource if they are not also a member of one of the required categories for that object. -
CISSP
The Orange Book describes four hierarchical levels to categorize security systems. <br/><br/>Which of the following levels require mandatory protection?
Correct — C. The U.S. Department of Defense developed the Trusted Computer System Evaluation Criteria (TCSEC), which was used to evaluate operating systems, applications, and different products. These evaluation criteria are published in a book known as the Orange Book.<br/><br/>TCSEC provides a classification system that is divided into hierarchical divisions of assurance levels:<br/><br/>A. Verified protection<br/><br/>B. Mandatory protection<br/><br/>C. Discretionary protection<br/><br/>D. Minimal security<br/><br/>Classification A represents the highest level of assurance, and D represents the lowest level of assurance. Level B is the lowest level that requires mandatory protection. Level A, being a higher level also requires mandatory protection. -
CISSP
As per the Orange Book, what are two types of system assurance?
Correct — C. When products are evaluated for the level of trust and assurance they provide, many times operational assurance and life-cycle assurance are part of the evaluation process. Operational assurance concentrates on the product’s architecture, embedded features, and functionality that enable a customer to continually obtain the necessary level of protection when using the product. Examples of operational assurances examined in the evaluation process are access control mechanisms, the separation of privileged and user program code, auditing and monitoring capabilities, covert channel analysis, and trusted recovery when the product experiences unexpected circumstances. Life-cycle assurance pertains to how the product was developed and maintained. Each stage of the product’s life cycle has standards and expectations it must fulfill before it can be deemed a highly trusted product. Examples of life-cycle assurance standards are design specifications, clipping-level configurations, unit and integration testing, configuration management, and trusted distribution. Vendors looking to achieve one of the higher security ratings for their products will have each of these issues evaluated and tested. -
CISSP
In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-object interactions take place?
Correct — D. A system that employs the Bell-LaPadula model is called a multilevel security system because users with different clearances use the system, and the system processes data at different classification levels. The level at which information is classified determines the handling procedures that should be used. The BellLaPadula model is a state machine model that enforces the confidentiality aspects of access control. A matrix and security levels are used to determine if subjects can access different objects. The subject’s clearance is compared to the object’s classification and then specific rules are applied to control how subjectto-object interactions can take place. This model uses subjects, objects, access operations (read, write, and read/write), and security levels. Subjects and objects can reside at different security levels and will have relationships and rules dictating the acceptable activities between them. -
CISSP
Of the following choices, what is not a valid security practice related to special privileges?
Correct — C. Special privileges should not be granted equally to administrators and operators. Instead, personnel should be granted only the privileges they need to perform their job. Special privileges are activities that require special access or elevated rights and permissions to perform administrative and sensitive job tasks. Assignment and usage of these privileges should be monitored, and access should be granted only to trusted employees. -
CISSP
Which of the following identifies vendor responsibilities and can include monetary penalties if the vendor doesn’t meet the stated responsibilities?
Correct — C. A service level agreement identifies responsibilities of a third party such as a vendor and can include monetary penalties if the vendor doesn’t meet the stated responsibilities. A MOU is in informal agreement and does not include monetary penalties. An ISA defines requirements for establishing, maintaining, and disconnecting a connection. SaaS is one of the cloud‐based service models and does not specify vendor responsibilities. -
CISSP
The two main types of routing protocols are used to make routing decision based on either distance-vector routing protocols or link-state routing protocols. However, there are a handful of De facto and proprietary interior protocols in use. <br/><br/>Which De facto protocol uses link-state algorithms to send out routing table information?
Correct — D. Open Shortest Path First (OSPF) is a De facto protocol using link-state algorithms to send out routing table information. The use of algorithms allow for smaller, more frequent routing table updates to take place. This provides a more stable network than Routing Information Protocol, but requires more memory and CPU resources to support the extra processing. OSPF allows for a hierarchical routing network that has a backbone link connecting all subnets together. -
CISSP
What is needed to allow an external client to initiate a communication session with an internal system if the network uses a NAT proxy?
Correct — D. Static mode NAT is needed to allow an outside entity to initiate communications with an internal system behind a NAT proxy. -
CISSP
At which OSI model layer does the IPSec protocol function?
Correct — D. IPSec operates at the Network layer (layer 3). -
CISSP
Which of the following is a Bluetooth-based attack that relates to gaining unauthorized access through a Bluetooth connection?
Correct — B. The attack that relates to gaining unauthorized access through a Bluetooth connection is a Bluesnarfing attack.<br/><br/>Bluesnarfing is the gaining of unauthorized access through a Bluetooth connection. This access can be gained through a phone, PDA, or any device using Bluetooth. Once access has been gained, the attacker can copy any data in the same way they would with any other unauthorized access. Blue jacking is the sending of unsolicited messages or spam over the Bluetooth connection. -
CISSP
What block size is used by the Advanced Encryption Standard?
Correct — C. The Advanced Encryption Standard uses a 128‐bit block size, despite the fact that the Rijndael algorithm it is based on allows a variable block size. -
CISSP
What is an advantage of RSA over DSA?
Correct — C. RSA can be used for data encryption, key exchange, and digital signatures. DSA can only be used for digital signatures. -
CISSP
What TCP/IP communications port is used by Transport Layer Security traffic?
Correct — D. Transport Layer Security uses TCP port 443 for encrypted client‐server communications. -
CISSP
What is the most effective means of reducing the risk of losing the data on a mobile device, such as a notebook computer?
Correct — C. The risk of a lost or stolen notebook is the data loss, not the loss of the system itself. Thus, keeping minimal sensitive data on the system is the only way to reduce the risk. Hard drive encryption, cable locks, and strong passwords, although good ideas, are preventive tools, not means of reducing risk. They don’t keep intentional and malicious data compromise from occurring; instead, they encourage honest people to stay honest. -
CISSP
When evaluating safeguards, what is the rule that should be followed in most cases?
Correct — C. The annual costs of safeguards should not exceed the expected annual cost of asset loss. -
CISSP
Who has the responsibility for providing reports to the senior management on the effectiveness of the security controls?
Correct — C. The auditor who has responsibility for providing reports to the senior management on the effectiveness of the security controls.<br/><br/>The role of the auditor is to come around periodically and ensure you are doing what you are supposed to be doing. They make sure the correct controls are in place and are being maintained securely. The target of the auditor is to ensure the organization complies with its own policies and the applicable laws and regulations. Organizations can have internal auditors and/or external auditors. The external auditors commonly work on behalf of a regulatory body to ensure compliance is being met. -
CISSP
What law formalizes many licensing arrangements used by the software industry and attempts to standardize their use from state to state?
Correct — A. The Uniform Computer Information Transactions Act (UCITA) attempts to implement a standard framework of laws regarding computer transactions to be adopted by all states. One of the issues addressed by UCITA is the legality of various types of software license agreements. -
CISSP
Normalizing data within a database could include all or some of the following except which one?
Correct — D. Normalizing data within a database does not eliminate duplicate key fields by putting them into separate tables. -
CISSP
Which of the following are literal value placeholders in a Structured Query Language (SQL) query sent to a server's database?
Correct — A. Bind variables as placeholders for literal values in a Structured Query Language (SQL) query sent to a server's database. The SQL statement is sent to the server for parsing, and the subsequent values are bound to the placeholders and delivered to the server separately. The term bind variable comes from this separate step. -
CISSP
Which is a critical component of database design that assures that attributes in a table are only part of the primary key?
Correct — B. The first normal form (1NF) requires the creation of separate tables for each collection of related data and the identifying of each row by a unique column known as the primary key. The second normal form (2NF) requires the transfer of data that is only partially dependent on the main key to a different table. The third normal form (3NF) requires the elimination of data that does not rely only on the primary key. The process of conforming to the normal form is called normalization. -
CISSP
Concerning Application Control, which is NOT true?
Correct — D. Application control limits what users can see or do within the application. For example, if a user does not have the necessary access privilege to perform some functions, the functions can be hidden from the screen or the screen itself can be hidden so the user cannot select it within the application. In a similar way, only the records a user has access to can be displayed.<br/><br/>What users may see and do within the application is limited by application control. For example, if a user lacks the necessary access privileges to execute some functions, the functions can be hidden from the screen, or the screen itself can be hidden so the user cannot choose it inside the program. Similarly, just the records that a user has access to are displayed. -
CISSP
Sara thinks that someone keeps trying to hack into her company’s system and wants to know who and why. She decides to use a computer to set up a sacrificial lamb on the network. <br/><br/>What is Sara practicing?
Correct — C. When a company decides to use a computer to set up a sacrificial lamb on a network, they are creating a honeypot. This is to entice a would-be attacker to this computer instead of attacking authentic production systems on a network. The honeypot contains no real company information and thus will not be at risk if and when it is attacked. It also enables the administrator to know when certain types of attacks are happening so the environment can be fortified to track down the attacker. -
CISSP
What type of interface testing would identify flaws in a program’s command-line interface?
Correct — A. User interface testing includes assessments of both graphical user interfaces (GUIs) and command‐line interfaces (CLIs) for a software program.
CISSP sample questions
Tap any question below to reveal the answer and a plain-English explanation.
CISSP Who has the responsibility for providing reports to the senior management on the effectiveness of the security controls?
A. Information systems security professionals
B. Data custodians
C. Information systems auditors ✓
D. Data owners
Correct — C. The auditor who has responsibility for providing reports to the senior management on the effectiveness of the security controls.<br/><br/>The role of the auditor is to come around periodically and ensure you are doing what you are supposed to be doing. They make sure the correct controls are in place and are being maintained securely. The target of the auditor is to ensure the organization complies with its own policies and the applicable laws and regulations. Organizations can have internal auditors and/or external auditors. The external auditors commonly work on behalf of a regulatory body to ensure compliance is being met.
CISSP What law formalizes many licensing arrangements used by the software industry and attempts to standardize their use from state to state?
A. Uniform Computer Information Transactions Act ✓
B. Digital Millennium Copyright Act
C. Gramm‐Leach‐Bliley Act
D. Computer Security Act
Correct — A. The Uniform Computer Information Transactions Act (UCITA) attempts to implement a standard framework of laws regarding computer transactions to be adopted by all states. One of the issues addressed by UCITA is the legality of various types of software license agreements.
CISSP Normalizing data within a database could include all or some of the following except which one?
A. Eliminate duplicative columns from the same table.
B. Eliminates functional dependencies on a partial key by putting the fields in a separate table from those that are dependent on the whole key
C. Eliminates Functional dependencies on non-key fields by putting them in a separate table. At this level, all non-key fields are dependent on the primary key.
D. Eliminating duplicate key fields by putting them into separate tables. ✓
Correct — D. Normalizing data within a database does not eliminate duplicate key fields by putting them into separate tables.
CISSP Which of the following are literal value placeholders in a Structured Query Language (SQL) query sent to a server's database?
A. Bind variables ✓
B. Assimilation variables
C. Resolution variables
D. Reduction variables
Correct — A. Bind variables as placeholders for literal values in a Structured Query Language (SQL) query sent to a server's database. The SQL statement is sent to the server for parsing, and the subsequent values are bound to the placeholders and delivered to the server separately. The term bind variable comes from this separate step.
CISSP Which is a critical component of database design that assures that attributes in a table are only part of the primary key?
A. Compaction
B. Normalization ✓
C. Reduction
D. Assimilation
Correct — B. The first normal form (1NF) requires the creation of separate tables for each collection of related data and the identifying of each row by a unique column known as the primary key. The second normal form (2NF) requires the transfer of data that is only partially dependent on the main key to a different table. The third normal form (3NF) requires the elimination of data that does not rely only on the primary key. The process of conforming to the normal form is called normalization.
CISSP Concerning Application Control, which is NOT true?
A. It limits end users use of applications in such a way that only particular screens are visible.
B. Particular usage of the application can be recorded for audit purposes
C. Only specific records can be requested through the application controls
D. It is non-transparent to the endpoint applications so changes are needed to the applications and databases involved ✓
Correct — D. Application control limits what users can see or do within the application. For example, if a user does not have the necessary access privilege to perform some functions, the functions can be hidden from the screen or the screen itself can be hidden so the user cannot select it within the application. In a similar way, only the records a user has access to can be displayed.<br/><br/>What users may see and do within the application is limited by application control. For example, if a user lacks the necessary access privileges to execute some functions, the functions can be hidden from the screen, or the screen itself can be hidden so the user cannot choose it inside the program. Similarly, just the records that a user has access to are displayed.
CISSP Sara thinks that someone keeps trying to hack into her company’s system and wants to know who and why. She decides to use a computer to set up a sacrificial lamb on the network. <br/><br/>What is Sara practicing?
A. Statistical anomaly-based IDS
B. Host-based Detection
C. Honeypot ✓
D. Network-based Detection
Correct — C. When a company decides to use a computer to set up a sacrificial lamb on a network, they are creating a honeypot. This is to entice a would-be attacker to this computer instead of attacking authentic production systems on a network. The honeypot contains no real company information and thus will not be at risk if and when it is attacked. It also enables the administrator to know when certain types of attacks are happening so the environment can be fortified to track down the attacker.
CISSP What type of interface testing would identify flaws in a program’s command-line interface?
A. User interface testing ✓
B. Security interface testing
C. Application programming interface testing
D. Physical interface testing
Correct — A. User interface testing includes assessments of both graphical user interfaces (GUIs) and command‐line interfaces (CLIs) for a software program.
About the CISSP test
CISSP Exam Prep 2026 helps you pass with 1101+ realistic practice questions, each with a clear explanation.
Features
- 1101+ practice questions with detailed answer explanations
- Study modes: quick 10, mock exam, timed, missed questions, and study by topic
- Progress tracking with subject accuracy and a learning curve
- Clean, distraction-free design built for focused study
Whether you are just starting or doing a final review before test day, CISSP Exam Prep gives you the questions and explanations you need to build confidence and pass.
You will be tested on
- The core topics and terminology you'll be tested on
- Rules, standards and best-practice procedures
- Real-world scenarios and how to respond
- Common mistakes and how to avoid them
How TheoryPractice helps you pass
- Real exam-style questions with instant, detailed explanations
- Full timed mock exams that mirror the real test format
- Flashcards & quiz modes from the same question bank
- Progress tracking so you know exactly when you're ready
Topics in this question bank
The core topics and terminology you'll be tested on
Rules, standards and best-practice procedures
Real-world scenarios and how to respond
Common mistakes and how to avoid them
Full CISSP bank + unlimited mocks
Try 30 questions free. Unlock the complete CISSP question bank, every explanation, and unlimited timed mock exams. Practice on any device.
Unlock CISSP →