How to use these CISSP practice questions
These eight original, single-best-answer questions practise the kind of judgement CISSP scenarios call for: apply security concepts to an enterprise situation, choose a proportionate action and explain its trade-offs. They cover several CBK areas, including security and risk management, asset security, security architecture, communications and network security, identity and access management, security assessment, and security operations.
The CISSP is a computer-based exam covering eight CBK domains. Questions are primarily multiple-choice and may use scenarios to test risk-based decisions, governance and security engineering under constraints. The goal in each item is to choose the best answer for an enterprise security professional—not the most technical-sounding option. These are practice questions, not official exam questions. Check ISC2’s official website for current exam details.
Answer each question in the item, then read the explanation immediately below it. Focus on why the best option fits the business context and why the strongest distractor falls short. If two options seem plausible, look for the one that establishes authority, reduces material risk and respects the organisation’s obligations before jumping to a tool or technical fix.
Questions and worked explanations
Question 1 — Assessing a new business service
This tests whether you establish the risk and ownership context before choosing a control or blocking a business activity. A MySummaries question on risk assessment looks like this:
A business unit has started using an unapproved cloud service to store customer information. The security manager does not yet know what categories of data are being stored or which business process depends on the service. What is the BEST initial action?
First establish what information and business process are involved, who is accountable, and what risks and obligations apply. That makes a proportionate decision possible. Blocking the service immediately may disrupt an important process without clarifying the exposure. Encryption may be one eventual control, but it does not resolve questions such as data handling, access, retention or provider risk. Waiting leaves an unassessed exposure in place.
The useful sequence is to identify the asset and owner, understand the business purpose, assess threats and obligations, then select controls. A tool choice made before those steps can solve the wrong problem.
Question 2 — Policy and control selection
This tests the difference between setting an administrative requirement and implementing a technical control. A MySummaries question on governance and control types is:
An organisation finds that staff accounts retain access to project files after employees change roles. Which action BEST establishes a sustainable, governance-aligned response?
A policy sets the administrative requirement; role-based permissions and a repeatable owner review help implement it. The firewall rule does not address inappropriate file permissions. Informal emails are inconsistent and reactive. Restricting access by time does not correct excessive privileges and may impede legitimate work.
A strong choice connects the control to an accountable process. Technical enforcement matters, but it should implement an authorised requirement rather than substitute for one.
Question 3 — Least privilege
This tests how to handle a request for broad access when the job only requires a narrower set of permissions. A MySummaries question on access control is:
A database analyst requests permanent administrator access to a production database to run monthly reports. The analyst’s role requires read access to a defined set of reporting tables. What is the BEST response?
Least privilege means granting only the permissions needed for an authorised task, with access handled through the organisation’s approval and review process. Permanent administrator access is excessive; making it temporary without a defined expiry and removal process is not a reliable safeguard. Denying all access may be unnecessarily disruptive when narrower access can meet the business need.
The best answer is not automatically “deny”. It identifies the task, limits the permission to that task and keeps authorisation and review in view.
Question 4 — Exposed cryptographic key
This tests how to respond when a key may be compromised, rather than treating removal of the visible copy as sufficient. A MySummaries question on key management is:
A developer discovers that a production encryption key was committed to a public source-code repository. The affected service is still operating. What is the BEST immediate response?
A publicly exposed production key must be treated as compromised. The organisation should follow its incident and key-management processes, contain the exposure, replace the key and assess what data or systems may have been affected. Removing the latest copy does not erase existing copies or undo possible access. Waiting for routine rotation prolongs the risk; a warning does not protect the key.
The response should account for service continuity as well as confidentiality. Rotation and recovery need to be planned so dependent systems use the replacement key safely.
Question 5 — Ransomware response
This tests containment, coordination and evidence preservation during an active security incident. A MySummaries question on incident response is:
A workstation begins encrypting files on a network share. The user reports a ransom message, and the incident response team has been notified. What should the security professional do FIRST to limit further spread while supporting the investigation?
Isolating the affected workstation limits its ability to communicate or affect other systems while the response team coordinates containment and investigation. Deleting files can destroy useful evidence and does not stop the source. Shutting down every server is disproportionate without evidence that this is necessary and could cause major business impact. Continuing activity risks further harm.
Containment should be coordinated with the response process; preserve relevant evidence and escalate decisions that could affect business operations. The strongest answer limits spread without making an unsupported, organisation-wide change.
Question 6 — Recovery objectives
This tests the distinction between how quickly a service must be restored and how much data loss the business can tolerate. A MySummaries question on continuity planning is:
A business owner states that a critical service must be restored within four hours after a disruption and that the business can tolerate losing no more than 30 minutes of data. Which interpretation is correct?
The recovery time objective (RTO) is the target time for restoring the service: four hours here. The recovery point objective (RPO) describes the acceptable amount of data loss, commonly expressed as a time interval: 30 minutes here. Reversing the terms confuses service availability with data recovery. The objectives should inform recovery design and be agreed with the business.
Keep the units attached to the meaning: RTO concerns restoration time; RPO concerns the point to which data must be recoverable. A backup schedule or recovery design should be checked against both objectives.
Question 7 — Cloud provider due diligence
This tests risk ownership and due diligence before sensitive information is entrusted to a third party. A MySummaries question on supplier risk is:
A department wants to move regulated customer records to a cloud provider. The provider advertises strong security, but the organisation has not reviewed the service’s responsibilities, data handling or contractual terms. What is the BEST next step?
A risk-based assessment should establish whether the service and its terms meet the organisation’s needs and obligations before approval. Marketing claims do not demonstrate that controls fit this use. Transferring live records first creates exposure before the assessment. A standard contract should be reviewed in context, with the relevant business, security and legal stakeholders involved.
The organisation remains accountable for deciding whether the service is appropriate. Check applicable obligations and contract terms for the actual data and jurisdiction; do not assume a provider’s claims settle those questions.
Question 8 — Emergency change
This tests how to balance a serious vulnerability with the need for controlled, recoverable change. A MySummaries question on security operations is:
A critical production system is affected by a newly identified vulnerability, and a vendor patch is available. Applying it without testing could interrupt an essential service. What is the BEST course of action?
The emergency change process allows the organisation to act with urgency while assessing impact, obtaining appropriate authority and planning recovery. Testing should be proportionate to the risk and time available. Immediate unapproved deployment can create avoidable outages; waiting for a routine window may leave a serious exposure untreated. Permanent shutdown ignores the service’s business need and available mitigations.
A sound answer acknowledges both sides of the decision: the vulnerability creates risk, and an uncontrolled change may create another. State assumptions, follow the authorised emergency route and explain how the change will be validated and recovered if it fails.
Review what you missed
Do not review only the questions you got wrong. Note whether each error came from a concept gap, a missed business constraint, or choosing a technical action before considering governance and risk. Then practise explaining why the best answer is proportionate and why its closest alternative is weaker. The weak-area view below ranks topics by practice performance; its figures are not exam statistics. A MySummaries weak-area view could look like this:
If the same idea costs marks twice, turn it into a short retrieval prompt: name the principle, state the first action and give the reason. For instance, distinguish “remove the exposed copy” from “treat the key as compromised and manage the incident”. A MySummaries remediation prompt might read:
You lost this mark twice: a production encryption key appears in a public repository. Why is deleting the visible copy not enough, and what should happen to the key?
How MySummaries helps
MySummaries can build a revision board from your own CISSP notes and generate scenario questions, marked written practice, flashcards and audio revision from that material. Use MySummaries to practise applying your course notes to the decisions this question set targets.