CISSP practice questions and answers 2026. Tap an option to test yourself — you'll see the correct answer and a plain-English explanation for every question. Free, no login.
Q21What is the most effective means of reducing the risk of losing the data on a mobile device, such as a notebook computer?
✓ Correct answer: C. Minimizing sensitive data stored on the mobile device
The risk of a lost or stolen notebook is the data loss, not the loss of the system itself. Thus, keeping minimal sensitive data on the system is the only way to reduce the risk. Hard drive encryption, cable locks, and strong passwords, although good ideas, are preventive tools, not means of reducing risk. They don’t keep intentional and malicious data compromise from occurring; instead, they encourage honest people to stay honest.
Q22When evaluating safeguards, what is the rule that should be followed in most cases?
✓ Correct answer: C. The annual costs of safeguards should not exceed the expected annual cost of asset loss.
The annual costs of safeguards should not exceed the expected annual cost of asset loss.
Q23Who has the responsibility for providing reports to the senior management on the effectiveness of the security controls?
✓ Correct answer: C. Information systems auditors
The auditor who has responsibility for providing reports to the senior management on the effectiveness of the security controls.<br/><br/>The role of the auditor is to come around periodically and ensure you are doing what you are supposed to be doing. They make sure the correct controls are in place and are being maintained securely. The target of the auditor is to ensure the organization complies with its own policies and the applicable laws and regulations. Organizations can have internal auditors and/or external auditors. The external auditors commonly work on behalf of a regulatory body to ensure compliance is being met.
Q24What law formalizes many licensing arrangements used by the software industry and attempts to standardize their use from state to state?
✓ Correct answer: A. Uniform Computer Information Transactions Act
The Uniform Computer Information Transactions Act (UCITA) attempts to implement a standard framework of laws regarding computer transactions to be adopted by all states. One of the issues addressed by UCITA is the legality of various types of software license agreements.
Q25Normalizing data within a database could include all or some of the following except which one?
✓ Correct answer: D. Eliminating duplicate key fields by putting them into separate tables.
Normalizing data within a database does not eliminate duplicate key fields by putting them into separate tables.
Q26Which of the following are literal value placeholders in a Structured Query Language (SQL) query sent to a server's database?
✓ Correct answer: A. Bind variables
Bind variables as placeholders for literal values in a Structured Query Language (SQL) query sent to a server's database. The SQL statement is sent to the server for parsing, and the subsequent values are bound to the placeholders and delivered to the server separately. The term bind variable comes from this separate step.
Q27Which is a critical component of database design that assures that attributes in a table are only part of the primary key?
✓ Correct answer: B. Normalization
The first normal form (1NF) requires the creation of separate tables for each collection of related data and the identifying of each row by a unique column known as the primary key. The second normal form (2NF) requires the transfer of data that is only partially dependent on the main key to a different table. The third normal form (3NF) requires the elimination of data that does not rely only on the primary key. The process of conforming to the normal form is called normalization.
Q28Concerning Application Control, which is NOT true?
✓ Correct answer: D. It is non-transparent to the endpoint applications so changes are needed to the applications and databases involved
Application control limits what users can see or do within the application. For example, if a user does not have the necessary access privilege to perform some functions, the functions can be hidden from the screen or the screen itself can be hidden so the user cannot select it within the application. In a similar way, only the records a user has access to can be displayed.<br/><br/>What users may see and do within the application is limited by application control. For example, if a user lacks the necessary access privileges to execute some functions, the functions can be hidden from the screen, or the screen itself can be hidden so the user cannot choose it inside the program. Similarly, just the records that a user has access to are displayed.
Q29Sara thinks that someone keeps trying to hack into her company’s system and wants to know who and why. She decides to use a computer to set up a sacrificial lamb on the network. <br/><br/>What is Sara practicing?
✓ Correct answer: C. Honeypot
When a company decides to use a computer to set up a sacrificial lamb on a network, they are creating a honeypot. This is to entice a would-be attacker to this computer instead of attacking authentic production systems on a network. The honeypot contains no real company information and thus will not be at risk if and when it is attacked. It also enables the administrator to know when certain types of attacks are happening so the environment can be fortified to track down the attacker.
Q30What type of interface testing would identify flaws in a program’s command-line interface?
✓ Correct answer: A. User interface testing
User interface testing includes assessments of both graphical user interfaces (GUIs) and command‐line interfaces (CLIs) for a software program.
Use the free CISSP Exam Prep 2026 Test sample, download the PDF, then unlock web-based timed mock exams for a full exam rehearsal.
Theory